Repository: louislam/uptime-kuma
File: server/notification-providers/aliyun-sms.js (JavaScript)

Code before:
        }
        return false;
    }

    /**
     * Aliyun request sign
     * @param {Object} param Parameters object to sign
     * @param {string} AccessKeySecret Secret key to sign parameters with
     * @returns {string}
     */
    sign(param, AccessKeySecret) {
        let param2 = {};
        let data = [];

        let oa = Object.keys(param).sort();

        for (let i = 0; i < oa.length; i++) {
            let key = oa[i];
            param2[key] = param[key];
        }

        // Escape more characters than encodeURIComponent does.
        // For generating Aliyun signature, all characters except A-Za-z0-9~-._ are encoded.
        // See https://help.aliyun.com/document_detail/315526.html

        let moreEscapesTable = function (m) {
            return {
                "!": "%21",
                "*": "%2A",
                "'": "%27",
                "(": "%28",
                ")": "%29"
            }[m];
        };

        for (let key in param2) {
            let value = encodeURIComponent(param2[key]).replace(/[!*'()]/g, moreEscapesTable);
            data.push(`${encodeURIComponent(key)}=${value}`);
        }

        let StringToSign = `POST&${encodeURIComponent("/")}&${encodeURIComponent(data.join("&"))}`;
        return Crypto
            .createHmac("sha1", `${AccessKeySecret}&`)
            .update(Buffer.from(StringToSign))
            .digest("base64");
    }

    /**
     * Convert status constant to string
     * @param {const} status The status constant
     * @returns {string}

Review comment (security):
```suggestion
        // See https://help.aliyun.com/document_detail/315526.html
        let moreEscapesTable = function (m) {
```

Code after:
        }
        return false;
    }

    /**
     * Aliyun request sign
     * @param {Object} param Parameters object to sign
     * @param {string} AccessKeySecret Secret key to sign parameters with
     * @returns {string}
     */
    sign(param, AccessKeySecret) {
        let param2 = {};
        let data = [];

        let oa = Object.keys(param).sort();

        for (let i = 0; i < oa.length; i++) {
            let key = oa[i];
            param2[key] = param[key];
        }

        // Escape more characters than encodeURIComponent does.
        // For generating Aliyun signature, all characters except A-Za-z0-9~-._ are encoded.
        // See https://help.aliyun.com/document_detail/315526.html
        // This encoding methods as known as RFC 3986 (https://tools.ietf.org/html/rfc3986)
        let moreEscapesTable = function (m) {
            return {
                "!": "%21",
                "*": "%2A",
                "'": "%27",
                "(": "%28",
                ")": "%29"
            }[m];
        };

        for (let key in param2) {
            let value = encodeURIComponent(param2[key]).replace(/[!*'()]/g, moreEscapesTable);
            data.push(`${encodeURIComponent(key)}=${value}`);
        }

        let StringToSign = `POST&${encodeURIComponent("/")}&${encodeURIComponent(data.join("&"))}`;
        return Crypto
            .createHmac("sha1", `${AccessKeySecret}&`)
            .update(Buffer.from(StringToSign))
            .digest("base64");
    }

    /**
     * Convert status constant to string
     * @param {const} status The status constant
     * @returns {string}