octoks 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4869f327501027d1871533875f3cbc8eb6c22472
-  data.tar.gz: ab852da066b5ba52c262540adc3ac47338ddbbdc
+  metadata.gz: f01a72b6d4686929f27246110d1321cde9803a0c
+  data.tar.gz: 50d1096709d5d3b16b86d24dc68d634e9deefdb9
 SHA512:
-  metadata.gz: c3375aee458e1c59095f2d5be83779ce2f5045eb389bfdf02cd5d8ca9a60c2d7575b78bbefa53609ae50411acb2740310771f458634c72bff9b1a79fc64eec51
-  data.tar.gz: 7b55dfab55af46e3a6217d68bd962962dd7c71a2f38fc7f7b0e9e5f362f67049f025fb83cfe875d9f6e8b6ed7fa5206ee5649df9ba2cd5c2abe4b0f69de19de1
+  metadata.gz: 837a171ab1decbfd3072b9e18ce8aa605204a456f977a193b4712677f7db56f63fb416c08b1ded8f26b8690a8a52586b35fb95e859aeb67fb027567fdd782718
+  data.tar.gz: f583546331816c6ccdbdb095b1c004b423fc69f61cc8590fcd6026f07e2a3dbed5b687e0a7cf21004ed215d840b14a246322d8ccb3f1b05fbe50accdc3525bd1

data/lib/octoks/receiver.rb

@@ -1,12 +1,16 @@
 require 'rack'
 require 'json'
+require 'openssl'
+require 'secure_compare'
 
 module Octoks
   class Receiver
     attr_accessor :hooks
+    attr_reader   :secret
 
-    def initialize
-      @hooks = {}
+    def initialize(secret = nil)
+      @hooks  = {}
+      @secret = secret
     end
 
     def on(name, &cb)
@@ -29,6 +33,10 @@ module Octoks
         return failed
       end
 
+      unless verify_signature(req)
+        return failed
+      end
+
       begin
         payload = JSON.parse(req.params['payload'])
       rescue
@@ -42,5 +50,15 @@ module Octoks
 
       [200, [], ["OK"]]
     end
+
+    HMAC_DIGEST = OpenSSL::Digest.new('sha1')
+    def verify_signature(req)
+      return true unless @secret
+      return false unless req.body
+      sig = 'sha1='+OpenSSL::HMAC.hexdigest(HMAC_DIGEST, @secret, req.body.read)
+      req.body.rewind
+      SecureCompare.compare(sig, req.env["HTTP_HUB_SIGNATURE"])
+    end
+
   end
 end

data/lib/octoks/version.rb

@@ -1,3 +1,3 @@
 module Octoks
-  VERSION = "0.0.2"
+  VERSION = "0.0.3"
 end

data/octoks.gemspec

@@ -18,8 +18,11 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
+  spec.add_runtime_dependency "secure_compare", "~> 0"
+
   spec.add_development_dependency "bundler", "~> 1.5"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rack"
   spec.add_development_dependency "json"
+
 end

data/test/octoks/test_receiver_secret.rb

@@ -0,0 +1,30 @@
+require 'minitest/autorun'
+require 'octoks'
+
+class TestReceiver < MiniTest::Unit::TestCase
+  def test_call
+    receiver = Octoks::Receiver.new("secret1234")
+    env = {
+      'rack.version'           => [1, 2],
+      'REQUEST_METHOD'         => 'POST',
+      'SERVER_NAME'            => 'example.com',
+      'SERVER_PORT'            => 80,
+      'QUERY_STRING'           => '',
+      'PATH_INFO'              => '/',
+      'rack.url_scheme'        => 'http',
+      'HTTPS'                  => 'off',
+      'CONTENT_LENGTH'         => 15,
+      'rack.input'             => StringIO.new('payload={"hoge":"fuga"}'),
+      'HTTP_X_GITHUB_EVENT'    => 'issue',
+      'HTTP_HUB_SIGNATURE'     => 'sha1=b2d620dd0b514b814685364d637058fe5ce29479',
+      'HTTP_X_GITHUB_DELIVERY' => 'gggg',
+    }
+    res = receiver.call(env)
+    assert_equal 200, res[0]
+
+    env['HTTP_HUB_SIGNATURE'] += "fail!"
+    res = receiver.call(env)
+    assert_equal 400, res[0]
+  end
+
+end

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: octoks
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - hisaichi5518
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-12 00:00:00.000000000 Z
+date: 2015-02-24 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: secure_compare
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -87,6 +101,7 @@ files:
 - octoks.gemspec
 - test/octoks/test_event.rb
 - test/octoks/test_receiver.rb
+- test/octoks/test_receiver_secret.rb
 homepage: https://github.com/hisaichi5518/octoks
 licenses:
 - MIT
@@ -107,10 +122,11 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.0
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: github hooks receiver.
 test_files:
 - test/octoks/test_event.rb
 - test/octoks/test_receiver.rb
+- test/octoks/test_receiver_secret.rb