fix: [#4545] Please upgrade zod package - botbuilder (#4561)

* update zod in botbuilder * change ts support in test consumer * fix ts config * simplify use of safeParse * fix lint --------- Co-authored-by: JhontSouth <[email protected]>
microsoft · Nov 9, 2023 · ecb77e1 · ecb77e1
1 parent 6abfddf
commit ecb77e1
Show file tree

Hide file tree

Showing 11 changed files with 989 additions and 36 deletions.
diff --git a/libraries/botbuilder/package.json b/libraries/botbuilder/package.json
@@ -40,7 +40,7 @@
     "fs-extra": "^7.0.1",
     "htmlparser2": "^6.0.1",
     "uuid": "^8.3.2",
-    "zod": "~1.11.17"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "chai": "^4.2.0",

diff --git a/libraries/botbuilder/src/botFrameworkAdapter.ts b/libraries/botbuilder/src/botFrameworkAdapter.ts
@@ -37,6 +37,7 @@ import {
     StatusCodes,
     TokenResponse,
     TurnContext,
+    conversationParametersObject,
 } from 'botbuilder-core';
 
 import {
@@ -391,7 +392,7 @@ export class BotFrameworkAdapter
         maybeLogic?: (context: TurnContext) => Promise<void>
     ): Promise<void> {
         let audience: string;
-        if (LogicT.check(oAuthScopeOrlogic)) {
+        if (LogicT.safeParse(oAuthScopeOrlogic).success) {
             // Because the OAuthScope parameter was not provided, get the correct value via the channelService.
             // In this scenario, the ConnectorClient for the continued conversation can only communicate with
             // official channels, not with other bots.
@@ -401,8 +402,8 @@ export class BotFrameworkAdapter
         } else {
             audience = z.string().parse(oAuthScopeOrlogic);
         }
-
-        const logic = LogicT.check(oAuthScopeOrlogic) ? oAuthScopeOrlogic : LogicT.parse(maybeLogic);
+        const logicParse = LogicT.safeParse(oAuthScopeOrlogic);
+        const logic = logicParse.success ? logicParse.data : LogicT.parse(maybeLogic);
 
         let credentials = this.credentials;
 
@@ -510,10 +511,12 @@ export class BotFrameworkAdapter
         if (!reference.serviceUrl) {
             throw new Error('BotFrameworkAdapter.createConversation(): missing serviceUrl.');
         }
+        const logicParse = LogicT.safeParse(parametersOrLogic);
+        const parameterParse = conversationParametersObject.partial().safeParse(parametersOrLogic);
 
-        const parameters = LogicT.check(parametersOrLogic) ? {} : parametersOrLogic;
+        const parameters = parameterParse.success ? parameterParse.data : {};
 
-        const logic = LogicT.check(parametersOrLogic) ? parametersOrLogic : LogicT.parse(maybeLogic);
+        const logic = logicParse.success ? logicParse.data : LogicT.parse(maybeLogic);
 
         // Create conversation parameters, taking care to provide defaults that can be
         // overridden by passed in parameters

diff --git a/libraries/botbuilder/src/cloudAdapter.ts b/libraries/botbuilder/src/cloudAdapter.ts
@@ -38,7 +38,7 @@ import {
 } from 'botframework-streaming';
 
 // Note: this is _okay_ because we pass the result through `validateAndFixActivity`. Should not be used otherwise.
-const ActivityT = z.custom<Activity>((val) => z.record(z.unknown()).check(val), { message: 'Activity' });
+const ActivityT = z.custom<Activity>((val) => z.record(z.unknown()).safeParse(val).success, { message: 'Activity' });
 
 /**
  * An adapter that implements the Bot Framework Protocol and can be hosted in different cloud environmens both public and private.
@@ -118,7 +118,7 @@ export class CloudAdapter extends CloudAdapterBase implements BotFrameworkHttpAd
         // Ensure we have a parsed request body already. We rely on express/restify middleware to parse
         // request body and azure functions, which does it for us before invoking our code. Warn the user
         // to update their code and return an error.
-        if (!z.record(z.unknown()).check(req.body)) {
+        if (!z.record(z.unknown()).safeParse(req.body).success) {
             return end(
                 StatusCodes.BAD_REQUEST,
                 '`req.body` not an object, make sure you are using middleware to parse incoming requests.'

diff --git a/libraries/botbuilder/src/setSpeakMiddleware.ts b/libraries/botbuilder/src/setSpeakMiddleware.ts
@@ -11,20 +11,19 @@ const supportedChannels = new Set<string>([Channels.DirectlineSpeech, Channels.E
 function hasTag(tag: string, nodes: unknown[]): boolean {
     while (nodes.length) {
         const item = nodes.shift();
+        const itemParsed = z
+            .object({ tagName: z.string(), children: z.array(z.unknown()) })
+            .partial()
+            .nonstrict()
+            .safeParse(item);
 
-        if (
-            z
-                .object({ tagName: z.string(), children: z.array(z.unknown()) })
-                .partial()
-                .nonstrict()
-                .check(item)
-        ) {
-            if (item.tagName === tag) {
+        if (itemParsed.success) {
+            if (itemParsed.data.tagName === tag) {
                 return true;
             }
 
-            if (item.children) {
-                nodes.push(...item.children);
+            if (itemParsed.data.children) {
+                nodes.push(...itemParsed.data.children);
             }
         }
     }

diff --git a/libraries/botbuilder/src/teams/teamsSSOTokenExchangeMiddleware.ts b/libraries/botbuilder/src/teams/teamsSSOTokenExchangeMiddleware.ts
@@ -144,15 +144,17 @@ export class TeamsSSOTokenExchangeMiddleware implements Middleware {
             const userTokenClient = context.turnState.get<UserTokenClient>(
                 (context.adapter as CloudAdapterBase).UserTokenClientKey
             );
+            const exchangeToken = ExchangeToken.safeParse(context.adapter);
+
             if (userTokenClient) {
                 tokenExchangeResponse = await userTokenClient.exchangeToken(
                     context.activity.from.id,
                     this.oAuthConnectionName,
                     context.activity.channelId,
                     { token: tokenExchangeRequest.token }
                 );
-            } else if (ExchangeToken.check(context.adapter)) {
-                tokenExchangeResponse = await context.adapter.exchangeToken(
+            } else if (exchangeToken.success) {
+                tokenExchangeResponse = await exchangeToken.data.exchangeToken(
                     context,
                     this.oAuthConnectionName,
                     context.activity.from.id,

diff --git a/libraries/botbuilder/tests/cloudAdapter.test.js b/libraries/botbuilder/tests/cloudAdapter.test.js
@@ -257,7 +257,7 @@ describe('CloudAdapter', function () {
     describe('connectNamedPipe', function () {
         it('throws for bad args', async function () {
             const includesParam = (param) => (err) => {
-                assert(err.message.includes(`at ${param}`), err.message);
+                assert(err.message.includes(`${param}`), err.message);
                 return true;
             };
 

diff --git a/libraries/botframework-connector/package.json b/libraries/botframework-connector/package.json
@@ -37,7 +37,7 @@
     "cross-fetch": "^3.0.5",
     "jsonwebtoken": "^9.0.0",
     "rsa-pem-from-mod-exp": "^0.8.4",
-    "zod": "~1.11.17"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@types/jsonwebtoken": "8.3.5",