Skip to content
This repository was archived by the owner on Aug 26, 2020. It is now read-only.

Commit eaca215

Browse files
committed
WIP - Attmpt to verify signatures
1 parent 3de4b29 commit eaca215

File tree

3 files changed

+19
-2
lines changed

3 files changed

+19
-2
lines changed

README.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,15 @@ robot.emit "github-repo-event", eventBody
3232

3333
For details on these fields, see the [Github Webhook documentation](https://developer.github.com/webhooks/).
3434

35-
**SECURITY WARNING**: This script does not currently validate the Github Secret to verify that the webhook came from Github. So, if someone knows the URL to your Hubot, they can spoof webhooks and issue your Hubot commands. So, for now be careful about exposing commands like `destroy company`, etc. I plan to validate these webhooks soon. In the meantime, patches are welcome. :)
35+
### Securing Your Webhooks
36+
To ensure non-github sources cannot send messages to your hubot, set
37+
`robot.brain.set('github_secret_token, 'YOUR-WEBHOOK-SECRET')` to your [Github
38+
hooks secret](https://developer.github.com/v3/repos/hooks/#create-a-hook).
3639

40+
This will raise exceptions when the webhook requests signatures do not match one
41+
builtfrom the request payload and your webhook secret.
42+
43+
### Consuming the event
3744
You can consume it like so from one of your scripts:
3845
```coffeescript
3946
@robot.on "github-repo-event", (repo_event) =>

package.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
},
3232
"dependencies": {
3333
"querystring": "^0.2.0",
34-
"url": "^0.10.3"
34+
"url": "^0.10.3",
35+
"verify-github-webhook": "^1.0.1"
3536
}
3637
}

src/hubot-github-webhook-listener.coffee

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,17 @@
3838

3939
url = require('url')
4040
querystring = require('querystring')
41+
verifyGithubWebhook = require('verify-github-webhook')
4142

4243
debug = false
4344

4445
module.exports = (robot) ->
4546

47+
# In the event no secret is set, we wish to carry on without verifying
48+
verifySignature = (signature, payload, secret) ->
49+
return true unless secret?
50+
verifyGithubWebhook(signature, payload, secret)
51+
4652
#TODO: Introduce secret so that these are verified:
4753
# See: https://developer.github.com/webhooks/securing/ and
4854
# https://gist.github.com/dcollien/c5d86c968cbc85e88286
@@ -57,6 +63,9 @@ module.exports = (robot) ->
5763
payload : req.body
5864
query : querystring.parse(url.parse(req.url).query)
5965

66+
if verifySignature(eventBody.signature, eventBody.payload, robot.brain.get('github_secret_token'))
67+
throw new Error('Webhook Signatures Do Not Match Generated Signature')
68+
6069
robot.emit "github-repo-event", eventBody
6170
catch error
6271
robot.logger.error "Github repo webhook listener error: #{error.stack}. Request: #{req.body}"

0 commit comments

Comments
 (0)