search

SciTools-incubator / scitools-cla-checker

A Heroku service that checks whether a PR is covered by a completed CLA
BSD 3-Clause "New" or "Revised" License
1 stars 1 forks source link

Verify webhook signature #11

Closed QuLogic closed 6 years ago

QuLogic commented 6 years ago

As evidenced in #10, I can send arbitrary triggers to the webhook without authentication or verification. GitHub apparently sends an X-Hub-Signature header using a secret which could possibly be used to verify the webhook sender and payload.

pelson commented 6 years ago

Agreed. I decided not to check this because the behaviour is a tightly limited set, but there is no harm in preventing arbitrary execution of that set.

Thanks @QuLogic

pelson commented 6 years ago

Closed in #12. Thanks @QuLogic.