github_webhook 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eeb186a10b99f572358acea6a3cba8678fb064b203a98afda9f07bab407b9e24
-  data.tar.gz: 8393af3c4ff44abf949488732113c200110dfe040886e17bda22c5ba18f33e9c
+  metadata.gz: 68085b2caf36fbd2af5d858a0fd98ce539d0c98a0c23b45e399eca378f17175b
+  data.tar.gz: 547ce4ef7686bb5a886a03e2f7c550a8602729608302aa1f9daeaacee9a26acd
 SHA512:
-  metadata.gz: adbcecc3754189f8c73d68839ae8b4a3e48b1711e81b7d6ce95a74011a9e5212412dd4aeaa3dad86c435435063f3e2f3f665fa96294251b5550e11cf794400ad
-  data.tar.gz: 5b65bba2ee6a2ddc1b3f61ad05db8a635e6456f18cbc541fb9370e26c90f44ffacf9b796c02c9fd77ff3cb4ec4cff1533d5acadcd0e2a7e764ff3886824a5e83
+  metadata.gz: e4cd1c3ff4f074510e1228e950b9d71d2e663869cb78e5f7f98cc0028d365ece7ddacd447c0bfd1525ed04739d3b156ffe1cc8f9fde12a865212ab379eed5252
+  data.tar.gz: 549b72dcc5a79abddbd693c1771c96f51a35a58dd53012240bad08164f5217f71c399d71ca4c4d30aff3d8047775907bb1132515601c6d0f0eea37bce4bff519

data/README.md

@@ -1,11 +1,21 @@
+
 [![Gem Version](https://badge.fury.io/rb/github_webhook.svg)](http://badge.fury.io/rb/github_webhook)
 
 
-# GithubWebhook
+# Github Webhook for Rails
 
 This gem will help you to quickly setup a route in your Rails application which listens
 to a [GitHub webhook](https://developer.github.com/webhooks/)
 
+## Alternatives
+
+If you want to use this logic outside of Rails, you should consider the following gems (cf [#19](https://github.com/ssaunier/github_webhook/issues/19)):
+
+- [`sinatra-github_webhooks`](https://github.com/chrismytton/sinatra-github_webhooks)
+- [`rack-github_webhooks`](https://github.com/chrismytton/rack-github_webhooks)
+
+If you are on Rails, please read on!
+
 ## Installation
 
 Add this line to your application's Gemfile:

data/lib/github_webhook/processor.rb

@@ -86,13 +86,13 @@ module GithubWebhook::Processor
 
   private
 
-  HMAC_DIGEST = OpenSSL::Digest.new('sha1')
+  HMAC_DIGEST = OpenSSL::Digest.new('sha256')
 
   def authenticate_github_request!
     raise UnspecifiedWebhookSecretError.new unless respond_to?(:webhook_secret, true)
     secret = webhook_secret(json_body)
 
-    expected_signature = "sha1=#{OpenSSL::HMAC.hexdigest(HMAC_DIGEST, secret, request_body)}"
+    expected_signature = "sha256=#{OpenSSL::HMAC.hexdigest(HMAC_DIGEST, secret, request_body)}"
     unless ActiveSupport::SecurityUtils.secure_compare(signature_header, expected_signature)
       GithubWebhook.logger && GithubWebhook.logger.warn("[GithubWebhook::Processor] signature "\
         "invalid, actual: #{signature_header}, expected: #{expected_signature}")
@@ -131,7 +131,7 @@ module GithubWebhook::Processor
   end
 
   def signature_header
-    @signature_header ||= request.headers['X-Hub-Signature']
+    @signature_header ||= request.headers['X-Hub-Signature-256'] || ''
   end
 
   def event_method

data/lib/github_webhook/version.rb

@@ -1,3 +1,3 @@
 module GithubWebhook
-  VERSION = "1.2.0"
+  VERSION = "1.3.0"
 end

data/spec/github_webhook/processor_spec.rb

@@ -65,7 +65,7 @@ module GithubWebhook
         it "calls the #push method in controller" do
           expect(controller).to receive(:github_push)
           controller.request.body = StringIO.new({ :foo => "bar" }.to_json.to_s)
-          controller.request.headers['X-Hub-Signature'] = "sha1=52b582138706ac0c597c315cfc1a1bf177408a4d"
+          controller.request.headers['X-Hub-Signature-256'] = "sha256=3f3ab3986b656abb17af3eb1443ed6c08ef8fff9fea83915909d1b421aec89be"
           controller.request.headers['X-GitHub-Event'] = 'push'
           controller.request.headers['Content-Type'] = 'application/json'
           controller.send :authenticate_github_request!  # Manually as we don't have the before_filter logic in our Mock object
@@ -75,7 +75,7 @@ module GithubWebhook
 
       it "calls the #push method in controller (json)" do
         controller.request.body = StringIO.new({ :foo => "bar" }.to_json.to_s)
-        controller.request.headers['X-Hub-Signature'] = "sha1=52b582138706ac0c597c315cfc1a1bf177408a4d"
+        controller.request.headers['X-Hub-Signature-256'] = "sha256=3f3ab3986b656abb17af3eb1443ed6c08ef8fff9fea83915909d1b421aec89be"
         controller.request.headers['X-GitHub-Event'] = 'push'
         controller.request.headers['Content-Type'] = 'application/json'
         controller.send :authenticate_github_request!  # Manually as we don't have the before_action logic in our Mock object
@@ -86,7 +86,7 @@ module GithubWebhook
       it "calls the #push method (x-www-form-urlencoded encoded)" do
         body = "payload=" + CGI::escape({ :foo => "bar" }.to_json.to_s)
         controller.request.body = StringIO.new(body)
-        controller.request.headers['X-Hub-Signature'] = "sha1=6986874ecdf710b04de7ef5a040161d41687407a"
+        controller.request.headers['X-Hub-Signature-256'] = "sha256=cefe60b775fcb22483ceece8f20be4869868a20fb4aa79829e53c1de61b99d01"
         controller.request.headers['X-GitHub-Event'] = 'push'
         controller.request.headers['Content-Type'] = 'application/x-www-form-urlencoded'
         controller.send :authenticate_github_request!  # Manually as we don't have the before_action logic in our Mock object
@@ -96,7 +96,7 @@ module GithubWebhook
 
       it "raises an error when signature does not match" do
         controller.request.body = StringIO.new({ :foo => "bar" }.to_json.to_s)
-        controller.request.headers['X-Hub-Signature'] = "sha1=FOOBAR"
+        controller.request.headers['X-Hub-Signature-256'] = "sha256=FOOBAR"
         controller.request.headers['X-GitHub-Event'] = 'push'
         controller.request.headers['Content-Type'] = 'application/json'
         expect { controller.send :authenticate_github_request! }.to raise_error(Processor::SignatureError)
@@ -116,11 +116,18 @@ module GithubWebhook
 
       it "raises an error when the content type is not correct" do
         controller.request.body = StringIO.new({ :foo => "bar" }.to_json.to_s)
-        controller.request.headers['X-Hub-Signature'] = "sha1=52b582138706ac0c597c315cfc1a1bf177408a4d"
+        controller.request.headers['X-Hub-Signature-256'] = "sha256=3f3ab3986b656abb17af3eb1443ed6c08ef8fff9fea83915909d1b421aec89be"
         controller.request.headers['X-GitHub-Event'] = 'ping'
         controller.request.headers['Content-Type'] = 'application/xml'
         expect { controller.send :authenticate_github_request! }.to raise_error(Processor::UnsupportedContentTypeError)
       end
+
+      it 'raises SignatureError when the X-Hub-Signature header is missing' do
+        controller.request.body = StringIO.new('{}')
+        controller.request.headers['Content-Type'] = 'application/json'
+        controller.request.headers['X-GitHub-Event'] = 'ping'
+        expect { controller.send :authenticate_github_request! }.to raise_error(Processor::SignatureError)
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: github_webhook
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Sebastien Saunier
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-08-26 00:00:00.000000000 Z
+date: 2021-12-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack