remotion_lambda 4.0.537 → 4.0.538

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b36ee099eb8262e376138e3e4a495fac351e7ea349fa7b3f32c4b31afd4063e
-  data.tar.gz: 14313742f7e352704e9bfa99c85ea5ea6c089c09f8ee85f70e6eaa3def4ac50b
+  metadata.gz: 45759df0fd53af971ef1e706655f36975e8ca436d281dfee927901a65c8c8df7
+  data.tar.gz: ceef2060641769982f71e75b4b440b26bc70160c560fd79cc7c68d56baf1316c
 SHA512:
-  metadata.gz: 638fb0c155eef435cc3c20d6a7a6f7a6bfe5cad7d9b1737555000b1f20ec55e300740f4a9795f9ebb04047773ecf1f109a96ee1a0b64a798ded9f78bd6365711
-  data.tar.gz: ff7b770403134c6372ab99cad0aacd1d7a8989eb84a1070fbb2ac417f937fa35cb99b56ba113041d26f0d5e2ed2a067455611e2ecc0d0ce38f0409f8d0a7331c
+  metadata.gz: c650d48456a61d127bd534b8097f53d11e43e24a9dd03216bdfccd8f0021caef5a4ad466412e032b3b3a650f386f4f12da8e4cb78b1e40d9c5b1e23337c76830
+  data.tar.gz: 980729ecb7eccdcf9f71ec4f2fe3b864cfafb4e59f90e14020e50fa6abd15268f52144bab86289dc93d40289247a0ba115e9e6401decd42bd894ad3181a468e4

data/lib/remotion_lambda/version.rb

@@ -1 +1 @@
-VERSION = "4.0.537"
+VERSION = "4.0.538"

data/lib/remotion_lambda/webhook.rb

@@ -0,0 +1,50 @@
+require 'openssl'
+
+module RemotionLambda
+  # Validates that an incoming webhook request was sent by Remotion and that its
+  # body was not modified in transit.
+  #
+  # Pass the webhook secret that was configured when the render was started, the
+  # raw request body exactly as it was received, and the value of the
+  # X-Remotion-Signature header. Raises if the request cannot be verified and
+  # returns nil if it is authentic.
+  #
+  # The signature covers the raw JSON bytes, so pass the body as it arrived
+  # (request.body.read in Sinatra, request.raw_post in Rails) and parse it only
+  # after this method returns. Parsing and regenerating the JSON first can change
+  # whitespace and how numbers are formatted, which would break the comparison
+  # even for a genuine request.
+  #
+  # This mirrors validateWebhookSignature() from @remotion/lambda/client and uses
+  # the same scheme: "sha512=" followed by the hex digest of an HMAC-SHA512 over
+  # the request body, keyed with the webhook secret.
+  def self.validate_webhook_signature(secret, body, signature_header)
+    if secret.nil? || secret.empty?
+      raise ArgumentError, "No 'secret' was provided to validate_webhook_signature()."
+    end
+
+    if body.nil? || body.empty?
+      raise ArgumentError, "No 'body' was provided to validate_webhook_signature()."
+    end
+
+    if signature_header.nil? || signature_header.empty? ||
+       signature_header == 'NO_SECRET_PROVIDED'
+      raise 'No webhook signature was provided'
+    end
+
+    expected = "sha512=#{OpenSSL::HMAC.hexdigest('SHA512', secret, body)}"
+
+    # The header is attacker-controlled, so force both sides to binary before
+    # comparing: fixed_length_secure_compare() compares bytes and must fail the
+    # check instead of raising when the header has an unexpected encoding.
+    signature = signature_header.b
+
+    matches =
+      expected.bytesize == signature.bytesize &&
+      OpenSSL.fixed_length_secure_compare(expected.b, signature)
+
+    raise 'Signatures do not match' unless matches
+
+    nil
+  end
+end

data/lib/remotion_lambda.rb

@@ -7,6 +7,7 @@ require_relative 'remotion_lambda/render_frames_on_lambda_payload'
 require_relative 'remotion_lambda/render_progress_payload'
 require_relative 'remotion_lambda/render_still_on_lambda_payload'
 require_relative 'remotion_lambda/s3_output_provider'
+require_relative 'remotion_lambda/webhook'
 require_relative 'remotion_lambda/sdk'
 
 module RemotionLambda

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: remotion_lambda
 version: !ruby/object:Gem::Version
-  version: 4.0.537
+  version: 4.0.538
 platform: ruby
 authors:
 - Jonny Burger
@@ -98,6 +98,7 @@ files:
 - lib/remotion_lambda/s3_output_provider.rb
 - lib/remotion_lambda/sdk.rb
 - lib/remotion_lambda/version.rb
+- lib/remotion_lambda/webhook.rb
 - lib/render_media_on_lambda_payload.rb
 - lib/render_media_on_lambda_payload_spec.rb
 - lib/render_progress_payload.rb