• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

go-playground / webhooks / 7039862713

29 Nov 2023 11:34PM UTC coverage: 88.586% (-0.2%) from 88.765%
7039862713

Pull #187

github

AdamKorcz
Add length check to github signature

Signed-off-by: AdamKorcz <adam@adalogics.com>
Pull Request #187: Add length check to github signature

3 of 3 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

877 of 990 relevant lines covered (88.59%)

8.88 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.07
/github/github.go
1
package github
2

3
import (
4
        "crypto/hmac"
5
        "crypto/sha256"
6
        "encoding/hex"
7
        "encoding/json"
8
        "errors"
9
        "fmt"
10
        "io"
11
        "net/http"
12
        "strings"
13
)
14

15
// parse errors
16
var (
17
        ErrEventNotSpecifiedToParse  = errors.New("no Event specified to parse")
18
        ErrInvalidHTTPMethod         = errors.New("invalid HTTP Method")
19
        ErrMissingGithubEventHeader  = errors.New("missing X-GitHub-Event Header")
20
        ErrMissingHubSignatureHeader = errors.New("missing X-Hub-Signature-256 Header")
21
        ErrEventNotFound             = errors.New("event not defined to be parsed")
22
        ErrParsingPayload            = errors.New("error parsing payload")
23
        ErrHMACVerificationFailed    = errors.New("HMAC verification failed")
24
        ErrWrongHubSignatureHeader   = errors.New("Invalid Github signature")
25
)
26

27
// Event defines a GitHub hook event type
28
type Event string
29

30
// GitHub hook types
31
const (
32
        CheckRunEvent                            Event = "check_run"
33
        CheckSuiteEvent                          Event = "check_suite"
34
        CommitCommentEvent                       Event = "commit_comment"
35
        CreateEvent                              Event = "create"
36
        DeleteEvent                              Event = "delete"
37
        DependabotAlertEvent                     Event = "dependabot_alert"
38
        DeployKeyEvent                           Event = "deploy_key"
39
        DeploymentEvent                          Event = "deployment"
40
        DeploymentStatusEvent                    Event = "deployment_status"
41
        ForkEvent                                Event = "fork"
42
        GollumEvent                              Event = "gollum"
43
        InstallationEvent                        Event = "installation"
44
        InstallationRepositoriesEvent            Event = "installation_repositories"
45
        IntegrationInstallationEvent             Event = "integration_installation"
46
        IntegrationInstallationRepositoriesEvent Event = "integration_installation_repositories"
47
        IssueCommentEvent                        Event = "issue_comment"
48
        IssuesEvent                              Event = "issues"
49
        LabelEvent                               Event = "label"
50
        MemberEvent                              Event = "member"
51
        MembershipEvent                          Event = "membership"
52
        MilestoneEvent                           Event = "milestone"
53
        MetaEvent                                Event = "meta"
54
        OrganizationEvent                        Event = "organization"
55
        OrgBlockEvent                            Event = "org_block"
56
        PageBuildEvent                           Event = "page_build"
57
        PingEvent                                Event = "ping"
58
        ProjectCardEvent                         Event = "project_card"
59
        ProjectColumnEvent                       Event = "project_column"
60
        ProjectEvent                             Event = "project"
61
        PublicEvent                              Event = "public"
62
        PullRequestEvent                         Event = "pull_request"
63
        PullRequestReviewEvent                   Event = "pull_request_review"
64
        PullRequestReviewCommentEvent            Event = "pull_request_review_comment"
65
        PushEvent                                Event = "push"
66
        ReleaseEvent                             Event = "release"
67
        RepositoryEvent                          Event = "repository"
68
        RepositoryVulnerabilityAlertEvent        Event = "repository_vulnerability_alert"
69
        SecurityAdvisoryEvent                    Event = "security_advisory"
70
        StatusEvent                              Event = "status"
71
        TeamEvent                                Event = "team"
72
        TeamAddEvent                             Event = "team_add"
73
        WatchEvent                               Event = "watch"
74
        WorkflowDispatchEvent                    Event = "workflow_dispatch"
75
        WorkflowJobEvent                         Event = "workflow_job"
76
        WorkflowRunEvent                         Event = "workflow_run"
77
        GitHubAppAuthorizationEvent              Event = "github_app_authorization"
78
)
79

80
// EventSubtype defines a GitHub Hook Event subtype
81
type EventSubtype string
82

83
// GitHub hook event subtypes
84
const (
85
        NoSubtype     EventSubtype = ""
86
        BranchSubtype EventSubtype = "branch"
87
        TagSubtype    EventSubtype = "tag"
88
        PullSubtype   EventSubtype = "pull"
89
        IssueSubtype  EventSubtype = "issues"
90
)
91

92
// Option is a configuration option for the webhook
93
type Option func(*Webhook) error
94

95
// Options is a namespace var for configuration options
96
var Options = WebhookOptions{}
97

98
// WebhookOptions is a namespace for configuration option methods
99
type WebhookOptions struct{}
100

101
// Secret registers the GitHub secret
102
func (WebhookOptions) Secret(secret string) Option {
1✔
103
        return func(hook *Webhook) error {
2✔
104
                hook.secret = secret
1✔
105
                return nil
1✔
106
        }
1✔
107
}
108

109
// Webhook instance contains all methods needed to process events
110
type Webhook struct {
111
        secret string
112
}
113

114
// New creates and returns a WebHook instance denoted by the Provider type
115
func New(options ...Option) (*Webhook, error) {
1✔
116
        hook := new(Webhook)
1✔
117
        for _, opt := range options {
2✔
118
                if err := opt(hook); err != nil {
1✔
119
                        return nil, errors.New("Error applying Option")
×
120
                }
×
121
        }
122
        return hook, nil
1✔
123
}
124

125
// Parse verifies and parses the events specified and returns the payload object or an error
126
func (hook Webhook) Parse(r *http.Request, events ...Event) (interface{}, error) {
53✔
127
        defer func() {
106✔
128
                _, _ = io.Copy(io.Discard, r.Body)
53✔
129
                _ = r.Body.Close()
53✔
130
        }()
53✔
131

132
        if len(events) == 0 {
53✔
133
                return nil, ErrEventNotSpecifiedToParse
×
134
        }
×
135
        if r.Method != http.MethodPost {
53✔
136
                return nil, ErrInvalidHTTPMethod
×
137
        }
×
138

139
        event := r.Header.Get("X-GitHub-Event")
53✔
140
        if event == "" {
54✔
141
                return nil, ErrMissingGithubEventHeader
1✔
142
        }
1✔
143
        gitHubEvent := Event(event)
52✔
144

52✔
145
        var found bool
52✔
146
        for _, evt := range events {
104✔
147
                if evt == gitHubEvent {
103✔
148
                        found = true
51✔
149
                        break
51✔
150
                }
151
        }
152
        // event not defined to be parsed
153
        if !found {
53✔
154
                return nil, ErrEventNotFound
1✔
155
        }
1✔
156

157
        payload, err := io.ReadAll(r.Body)
51✔
158
        if err != nil || len(payload) == 0 {
52✔
159
                return nil, ErrParsingPayload
1✔
160
        }
1✔
161

162
        // If we have a Secret set, we should check the MAC
163
        if len(hook.secret) > 0 {
100✔
164
                signature := r.Header.Get("X-Hub-Signature-256")
50✔
165
                if len(signature) == 0 {
52✔
166
                        return nil, ErrMissingHubSignatureHeader
2✔
167
                }
2✔
168

169
                signature = strings.TrimPrefix(signature, "sha256=")
48✔
170
                if len(signature) < 6 {
49✔
171
                        return nil, ErrWrongHubSignatureHeader
1✔
172
                }
1✔
173
                mac := hmac.New(sha256.New, []byte(hook.secret))
47✔
174
                _, _ = mac.Write(payload)
47✔
175
                expectedMAC := hex.EncodeToString(mac.Sum(nil))
47✔
176

47✔
177
                if !hmac.Equal([]byte(signature), []byte(expectedMAC)) {
47✔
UNCOV
178
                        return nil, ErrHMACVerificationFailed
×
UNCOV
179
                }
×
180
        }
181

182
        switch gitHubEvent {
47✔
183
        case CheckRunEvent:
1✔
184
                var pl CheckRunPayload
1✔
185
                err = json.Unmarshal([]byte(payload), &pl)
1✔
186
                return pl, err
1✔
187
        case CheckSuiteEvent:
1✔
188
                var pl CheckSuitePayload
1✔
189
                err = json.Unmarshal([]byte(payload), &pl)
1✔
190
                return pl, err
1✔
191
        case CommitCommentEvent:
1✔
192
                var pl CommitCommentPayload
1✔
193
                err = json.Unmarshal([]byte(payload), &pl)
1✔
194
                return pl, err
1✔
195
        case CreateEvent:
1✔
196
                var pl CreatePayload
1✔
197
                err = json.Unmarshal([]byte(payload), &pl)
1✔
198
                return pl, err
1✔
199
        case DeployKeyEvent:
1✔
200
                var pl DeployKeyPayload
1✔
201
                err = json.Unmarshal([]byte(payload), &pl)
1✔
202
                return pl, err
1✔
203
        case DeleteEvent:
1✔
204
                var pl DeletePayload
1✔
205
                err = json.Unmarshal([]byte(payload), &pl)
1✔
206
                return pl, err
1✔
207
        case DependabotAlertEvent:
1✔
208
                var pl DependabotAlertPayload
1✔
209
                err = json.Unmarshal([]byte(payload), &pl)
1✔
210
                return pl, err
1✔
211
        case DeploymentEvent:
1✔
212
                var pl DeploymentPayload
1✔
213
                err = json.Unmarshal([]byte(payload), &pl)
1✔
214
                return pl, err
1✔
215
        case DeploymentStatusEvent:
1✔
216
                var pl DeploymentStatusPayload
1✔
217
                err = json.Unmarshal([]byte(payload), &pl)
1✔
218
                return pl, err
1✔
219
        case ForkEvent:
1✔
220
                var pl ForkPayload
1✔
221
                err = json.Unmarshal([]byte(payload), &pl)
1✔
222
                return pl, err
1✔
223
        case GollumEvent:
1✔
224
                var pl GollumPayload
1✔
225
                err = json.Unmarshal([]byte(payload), &pl)
1✔
226
                return pl, err
1✔
227
        case InstallationEvent, IntegrationInstallationEvent:
2✔
228
                var pl InstallationPayload
2✔
229
                err = json.Unmarshal([]byte(payload), &pl)
2✔
230
                return pl, err
2✔
231
        case InstallationRepositoriesEvent, IntegrationInstallationRepositoriesEvent:
2✔
232
                var pl InstallationRepositoriesPayload
2✔
233
                err = json.Unmarshal([]byte(payload), &pl)
2✔
234
                return pl, err
2✔
235
        case IssueCommentEvent:
2✔
236
                var pl IssueCommentPayload
2✔
237
                err = json.Unmarshal([]byte(payload), &pl)
2✔
238
                return pl, err
2✔
239
        case IssuesEvent:
1✔
240
                var pl IssuesPayload
1✔
241
                err = json.Unmarshal([]byte(payload), &pl)
1✔
242
                return pl, err
1✔
243
        case LabelEvent:
1✔
244
                var pl LabelPayload
1✔
245
                err = json.Unmarshal([]byte(payload), &pl)
1✔
246
                return pl, err
1✔
247
        case MemberEvent:
1✔
248
                var pl MemberPayload
1✔
249
                err = json.Unmarshal([]byte(payload), &pl)
1✔
250
                return pl, err
1✔
251
        case MembershipEvent:
1✔
252
                var pl MembershipPayload
1✔
253
                err = json.Unmarshal([]byte(payload), &pl)
1✔
254
                return pl, err
1✔
255
        case MetaEvent:
×
256
                var pl MetaPayload
×
257
                err = json.Unmarshal([]byte(payload), &pl)
×
258
                return pl, err
×
259
        case MilestoneEvent:
1✔
260
                var pl MilestonePayload
1✔
261
                err = json.Unmarshal([]byte(payload), &pl)
1✔
262
                return pl, err
1✔
263
        case OrganizationEvent:
1✔
264
                var pl OrganizationPayload
1✔
265
                err = json.Unmarshal([]byte(payload), &pl)
1✔
266
                return pl, err
1✔
267
        case OrgBlockEvent:
1✔
268
                var pl OrgBlockPayload
1✔
269
                err = json.Unmarshal([]byte(payload), &pl)
1✔
270
                return pl, err
1✔
271
        case PageBuildEvent:
1✔
272
                var pl PageBuildPayload
1✔
273
                err = json.Unmarshal([]byte(payload), &pl)
1✔
274
                return pl, err
1✔
275
        case PingEvent:
1✔
276
                var pl PingPayload
1✔
277
                err = json.Unmarshal([]byte(payload), &pl)
1✔
278
                return pl, err
1✔
279
        case ProjectCardEvent:
1✔
280
                var pl ProjectCardPayload
1✔
281
                err = json.Unmarshal([]byte(payload), &pl)
1✔
282
                return pl, err
1✔
283
        case ProjectColumnEvent:
1✔
284
                var pl ProjectColumnPayload
1✔
285
                err = json.Unmarshal([]byte(payload), &pl)
1✔
286
                return pl, err
1✔
287
        case ProjectEvent:
1✔
288
                var pl ProjectPayload
1✔
289
                err = json.Unmarshal([]byte(payload), &pl)
1✔
290
                return pl, err
1✔
291
        case PublicEvent:
1✔
292
                var pl PublicPayload
1✔
293
                err = json.Unmarshal([]byte(payload), &pl)
1✔
294
                return pl, err
1✔
295
        case PullRequestEvent:
1✔
296
                var pl PullRequestPayload
1✔
297
                err = json.Unmarshal([]byte(payload), &pl)
1✔
298
                return pl, err
1✔
299
        case PullRequestReviewEvent:
1✔
300
                var pl PullRequestReviewPayload
1✔
301
                err = json.Unmarshal([]byte(payload), &pl)
1✔
302
                return pl, err
1✔
303
        case PullRequestReviewCommentEvent:
1✔
304
                var pl PullRequestReviewCommentPayload
1✔
305
                err = json.Unmarshal([]byte(payload), &pl)
1✔
306
                return pl, err
1✔
307
        case PushEvent:
1✔
308
                var pl PushPayload
1✔
309
                err = json.Unmarshal([]byte(payload), &pl)
1✔
310
                return pl, err
1✔
311
        case ReleaseEvent:
1✔
312
                var pl ReleasePayload
1✔
313
                err = json.Unmarshal([]byte(payload), &pl)
1✔
314
                return pl, err
1✔
315
        case RepositoryEvent:
2✔
316
                var pl RepositoryPayload
2✔
317
                err = json.Unmarshal([]byte(payload), &pl)
2✔
318
                return pl, err
2✔
319
        case RepositoryVulnerabilityAlertEvent:
1✔
320
                var pl RepositoryVulnerabilityAlertPayload
1✔
321
                err = json.Unmarshal([]byte(payload), &pl)
1✔
322
                return pl, err
1✔
323
        case SecurityAdvisoryEvent:
1✔
324
                var pl SecurityAdvisoryPayload
1✔
325
                err = json.Unmarshal([]byte(payload), &pl)
1✔
326
                return pl, err
1✔
327
        case StatusEvent:
1✔
328
                var pl StatusPayload
1✔
329
                err = json.Unmarshal([]byte(payload), &pl)
1✔
330
                return pl, err
1✔
331
        case TeamEvent:
1✔
332
                var pl TeamPayload
1✔
333
                err = json.Unmarshal([]byte(payload), &pl)
1✔
334
                return pl, err
1✔
335
        case TeamAddEvent:
1✔
336
                var pl TeamAddPayload
1✔
337
                err = json.Unmarshal([]byte(payload), &pl)
1✔
338
                return pl, err
1✔
339
        case WatchEvent:
1✔
340
                var pl WatchPayload
1✔
341
                err = json.Unmarshal([]byte(payload), &pl)
1✔
342
                return pl, err
1✔
343
        case WorkflowDispatchEvent:
1✔
344
                var pl WorkflowDispatchPayload
1✔
345
                err = json.Unmarshal([]byte(payload), &pl)
1✔
346
                return pl, err
1✔
347
        case WorkflowJobEvent:
1✔
348
                var pl WorkflowJobPayload
1✔
349
                err = json.Unmarshal([]byte(payload), &pl)
1✔
350
                return pl, err
1✔
351
        case WorkflowRunEvent:
1✔
352
                var pl WorkflowRunPayload
1✔
353
                err = json.Unmarshal([]byte(payload), &pl)
1✔
354
                return pl, err
1✔
355
        case GitHubAppAuthorizationEvent:
1✔
356
                var pl GitHubAppAuthorizationPayload
1✔
357
                err = json.Unmarshal([]byte(payload), &pl)
1✔
358
                return pl, err
1✔
359
        default:
×
360
                return nil, fmt.Errorf("unknown event %s", gitHubEvent)
×
361
        }
362
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc