remotion_lambda 4.0.536 → 4.0.538

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6ac4d5734a0f2eaa87519fe4955a8c5bef10f5a038b30444c02c4d34042297f
-  data.tar.gz: e34a9b20fddb473b30e28081a1b8755211df5911d8a489535c61d7912eb4da15
+  metadata.gz: 45759df0fd53af971ef1e706655f36975e8ca436d281dfee927901a65c8c8df7
+  data.tar.gz: ceef2060641769982f71e75b4b440b26bc70160c560fd79cc7c68d56baf1316c
 SHA512:
-  metadata.gz: df865ee55235d09466513ac106494876a84d348f9a0f3bc074a7c9c38fbe66a84365aa96b888de7d9d688120837c86d7129b95adf5315c1a678c676a47ae6c06
-  data.tar.gz: 790c7b16bbae96481f006f2cf711a7210631ca64d6bc6021af2af7fbe1e21c1222620946be92e15464733e1eb6dc0108e1bec5323881be2306bfefacf2b6552e
+  metadata.gz: c650d48456a61d127bd534b8097f53d11e43e24a9dd03216bdfccd8f0021caef5a4ad466412e032b3b3a650f386f4f12da8e4cb78b1e40d9c5b1e23337c76830
+  data.tar.gz: 980729ecb7eccdcf9f71ec4f2fe3b864cfafb4e59f90e14020e50fa6abd15268f52144bab86289dc93d40289247a0ba115e9e6401decd42bd894ad3181a468e4

data/lib/remotion_lambda/version.rb

@@ -1 +1 @@
-VERSION = "4.0.536"
+VERSION = "4.0.538"

data/lib/remotion_lambda/webhook.rb

@@ -0,0 +1,50 @@
+require 'openssl'
+
+module RemotionLambda
+  # Validates that an incoming webhook request was sent by Remotion and that its
+  # body was not modified in transit.
+  #
+  # Pass the webhook secret that was configured when the render was started, the
+  # raw request body exactly as it was received, and the value of the
+  # X-Remotion-Signature header. Raises if the request cannot be verified and
+  # returns nil if it is authentic.
+  #
+  # The signature covers the raw JSON bytes, so pass the body as it arrived
+  # (request.body.read in Sinatra, request.raw_post in Rails) and parse it only
+  # after this method returns. Parsing and regenerating the JSON first can change
+  # whitespace and how numbers are formatted, which would break the comparison
+  # even for a genuine request.
+  #
+  # This mirrors validateWebhookSignature() from @remotion/lambda/client and uses
+  # the same scheme: "sha512=" followed by the hex digest of an HMAC-SHA512 over
+  # the request body, keyed with the webhook secret.
+  def self.validate_webhook_signature(secret, body, signature_header)
+    if secret.nil? || secret.empty?
+      raise ArgumentError, "No 'secret' was provided to validate_webhook_signature()."
+    end
+
+    if body.nil? || body.empty?
+      raise ArgumentError, "No 'body' was provided to validate_webhook_signature()."
+    end
+
+    if signature_header.nil? || signature_header.empty? ||
+       signature_header == 'NO_SECRET_PROVIDED'
+      raise 'No webhook signature was provided'
+    end
+
+    expected = "sha512=#{OpenSSL::HMAC.hexdigest('SHA512', secret, body)}"
+
+    # The header is attacker-controlled, so force both sides to binary before
+    # comparing: fixed_length_secure_compare() compares bytes and must fail the
+    # check instead of raising when the header has an unexpected encoding.
+    signature = signature_header.b
+
+    matches =
+      expected.bytesize == signature.bytesize &&
+      OpenSSL.fixed_length_secure_compare(expected.b, signature)
+
+    raise 'Signatures do not match' unless matches
+
+    nil
+  end
+end

data/lib/remotion_lambda.rb

@@ -7,6 +7,7 @@ require_relative 'remotion_lambda/render_frames_on_lambda_payload'
 require_relative 'remotion_lambda/render_progress_payload'
 require_relative 'remotion_lambda/render_still_on_lambda_payload'
 require_relative 'remotion_lambda/s3_output_provider'
+require_relative 'remotion_lambda/webhook'
 require_relative 'remotion_lambda/sdk'
 
 module RemotionLambda

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: remotion_lambda
 version: !ruby/object:Gem::Version
-  version: 4.0.536
+  version: 4.0.538
 platform: ruby
 authors:
 - Jonny Burger
@@ -98,6 +98,7 @@ files:
 - lib/remotion_lambda/s3_output_provider.rb
 - lib/remotion_lambda/sdk.rb
 - lib/remotion_lambda/version.rb
+- lib/remotion_lambda/webhook.rb
 - lib/render_media_on_lambda_payload.rb
 - lib/render_media_on_lambda_payload_spec.rb
 - lib/render_progress_payload.rb