From 07fde7caf3162ba8ff2bdeff5abb558abdef7723 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Brunner?= Date: Fri, 5 Jul 2024 11:28:31 +0200 Subject: [PATCH] GitHub signature: Don't fail on dryrun mode on missing signature --- github_app_geo_project/views/webhook.py | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/github_app_geo_project/views/webhook.py b/github_app_geo_project/views/webhook.py index 2d40a028f1c..5e7e5f8dafa 100644 --- a/github_app_geo_project/views/webhook.py +++ b/github_app_geo_project/views/webhook.py @@ -30,21 +30,24 @@ def webhook(request: pyramid.request.Request) -> dict[str, None]: github_secret = request.registry.settings.get(f"application.{application}.github_app_webhook_secret") if github_secret: - dry_run = os.environ.get("GHCI_WEBHOOK_SECRET_DRY_RUN", "false").lower() == "true" + dry_run = os.environ.get("GHCI_WEBHOOK_SECRET_DRY_RUN", "false").lower() in ("true", "1", "yes", "on") if "X-Hub-Signature-256" not in request.headers: _LOGGER.error("No signature in the request") if not dry_run: raise pyramid.httpexceptions.HTTPBadRequest("No signature in the request") - our_signature = hmac.new( - key=github_secret.encode("utf-8"), - msg=request.body, - digestmod=hashlib.sha256, - ).hexdigest() - if not hmac.compare_digest(our_signature, request.headers["X-Hub-Signature-256"].split("=", 1)[1]): - _LOGGER.error("Invalid signature in the request") - if not dry_run: - raise pyramid.httpexceptions.HTTPBadRequest("Invalid signature in the request") + else: + our_signature = hmac.new( + key=github_secret.encode("utf-8"), + msg=request.body, + digestmod=hashlib.sha256, + ).hexdigest() + if not hmac.compare_digest( + our_signature, request.headers["X-Hub-Signature-256"].split("=", 1)[-1] + ): + _LOGGER.error("Invalid signature in the request") + if not dry_run: + raise pyramid.httpexceptions.HTTPBadRequest("Invalid signature in the request") _LOGGER.debug( "Webhook received for %s on %s", request.headers.get("X-GitHub-Event", "undefined"), application