logstash-input-github 3.0.7 → 3.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16390c34192df416a1e214e8b7e499cb2c3f5049db00e7cb589f72154ee98958
-  data.tar.gz: a829cc58f27ad78706ddf96696fa74f98dd2f1585f05f61193ed4a47924d78ff
+  metadata.gz: 898fe5db49e5f2c9afd605e854ed5e7ff5e06f1273aaa3b23bc07c1aa5501811
+  data.tar.gz: 5bcda0a722657238ad889d952d3a36eb4e6dc49efe3a69f458a91c889332be21
 SHA512:
-  metadata.gz: 34c300c05673d852ad1c50a19a3f81fad994e3ff66fb4c561b89be03f6a81eebb0ad6792e6efbb757ef723ac79cfaa5945adcc0919f24c03d9e85f32803652a6
-  data.tar.gz: 6f5cff98fd4da531b3235df921d6f7362750a05454e2fd42d2680be25dd1ace75edf04306f8063cb47959cfa9a6c12a86f1f5d3e6cbe2c01dc795cdf890353f0
+  metadata.gz: d5bd835b01a9d7ef70e777b83ca729b693471f95124daaa1184432a45ab1c523de390281a07f48583ec3dfa9fd915d6a3ce78e3138b67885b040a86cdb4ddb62
+  data.tar.gz: 448a11174158e05fc093b2085898d766304490f6c821a8735f47bab8ec80542b1cac677f51e77e1b9bedabaaff01b4c42bc42c8ab446f45c99424ce28294df16

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.0.8
+  - Require x-hub-signature header if secret_token defined
+
 ## 3.0.7
   - Docs: Set the default_codec doc attribute.
 
@@ -28,4 +31,3 @@
  - Plugins were updated to follow the new shutdown semantic, this mainly allows Logstash to instruct input plugins to terminate gracefully, 
    instead of using Thread.raise on the plugins' threads. Ref: https://github.com/elastic/logstash/pull/3895
  - Dependency on logstash-core update to 2.0
-

data/lib/logstash/inputs/github.rb

@@ -63,17 +63,18 @@ class LogStash::Inputs::GitHub < LogStash::Inputs::Base
   end
 
   def verify_signature(event,body)
-    is_valid = true
+    # skip validation if we have no secret token
+    return true unless @secret_token
+
     sign_header = event.get("[headers][x-hub-signature]")
-    if @secret_token && sign_header
+    if sign_header
       hash = 'sha1=' + OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha1'), @secret_token, body)
       event.set("hash", hash)
-      if not Rack::Utils.secure_compare(hash, sign_header)
-        event.tag("_Invalid_Github_Message")
-        is_valid = false
-      end
+      return true if Rack::Utils.secure_compare(hash, sign_header)
     end
-    return is_valid
+
+    event.tag("_Invalid_Github_Message")
+    return false
   end
 
   def stop

data/logstash-input-github.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-input-github'
-  s.version         = '3.0.7'
+  s.version         = '3.0.8'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Reads events from a GitHub webhook"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -28,4 +28,3 @@ Gem::Specification.new do |s|
 
   s.add_development_dependency 'logstash-devutils'
 end
-

data/spec/inputs/github_spec.rb

@@ -26,18 +26,18 @@ describe  LogStash::Inputs::GitHub do
     end
   end
 
-  describe "verify webhook signature" do
+  describe "verify webhook signature if token provided" do
     let(:plugin) { LogStash::Plugin.lookup("input", "github").new( {"port" => 9999, "secret_token" => "my_secret"} ) }
     let(:body) {IO.read("spec/fixtures/event_create.json")}
     let(:headers) { {"x-hub-signature" => "hash"} }
     let(:event) {plugin.build_event_from_request(body,headers)}
     let(:hash) { "sha1=43b113fc453c47f1cd4d5b4ded2985581c00a715" }
 
-    it "accept event without signature" do
+    it "reject event without signature" do
       event.set('headers',{})
-      expect(plugin.verify_signature(event,body)).to eq(true)
+      expect(plugin.verify_signature(event,body)).to eq(false)
       expect(event.get("hash")).to be_nil
-      expect(event.get("tags")).to be_nil
+      expect(event.get("tags")).to eq(["_Invalid_Github_Message"])
     end
 
     it "reject event with invalid signature" do
@@ -56,6 +56,36 @@ describe  LogStash::Inputs::GitHub do
 
   end
 
+  describe "don't validate webhook if token missing" do
+    let(:plugin) { LogStash::Plugin.lookup("input", "github").new( {"port" => 9999} ) }
+    let(:body) {IO.read("spec/fixtures/event_create.json")}
+    let(:headers) { {"x-hub-signature" => "hash"} }
+    let(:event) {plugin.build_event_from_request(body,headers)}
+    let(:hash) { "sha1=43b113fc453c47f1cd4d5b4ded2985581c00a715" }
+
+    it "accept event without signature" do
+      event.set('headers',{})
+      expect(plugin.verify_signature(event,body)).to eq(true)
+      expect(event.get("hash")).to be_nil
+      expect(event.get("tags")).to be_nil
+    end
+
+    it "accept event with invalid signature" do
+      event.set('headers',{"x-hub-signature" => "invalid"})
+      expect(plugin.verify_signature(event,body)).to eq(true)
+      expect(event.get("hash")).to be_nil
+      expect(event.get("tags")).to be_nil
+    end
+
+    it "accept event with valid signature" do
+      event.set('headers', {"x-hub-signature" => hash})
+      expect(plugin.verify_signature(event,body)).to eq(true)
+      expect(event.get("hash")).to be_nil
+      expect(event.get("tags")).to be_nil
+    end
+
+  end
+
   describe 'graceful shutdown' do
     context 'when underlying webserver crashes' do
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-github
 version: !ruby/object:Gem::Version
-  version: 3.0.7
+  version: 3.0.8
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-04-06 00:00:00.000000000 Z
+date: 2019-07-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -128,7 +128,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project:
-rubygems_version: 2.6.11
+rubygems_version: 2.6.13
 signing_key:
 specification_version: 4
 summary: Reads events from a GitHub webhook