adnanh / webhook

webhook is a lightweight incoming webhook server to run shell commands
MIT License
10.38k stars 831 forks source link

body decoding issue (?) breaks JSON payload containing `=` char #697

Closed g1l3sp closed 1 month ago

g1l3sp commented 1 month ago

I have some JSON payloads that I'm sending to a webhook that have + and = characters in them, and the way webhook processes them is changing data and creating JSON format problems for the POST body. Here is a simple test that I performed on Ubuntu 24.04 using the webhook package from the standard repositories, which is version 2.8.0. I saw similar behavior on earlier versions of Ubuntu and the webhook package as well.

Here's the configuration:

/etc/webhook.conf (replace "user" with whoever is configured to be running webhook):

[{
  "id": "bug-test",
  "execute-command": "/home/user/webhook/bug-test-handler.sh",
  "command-working-directory": "/home/user/webhook/",
  "include-command-output-in-response": true,
  "include-command-output-in-response-on-error": true,
  "pass-arguments-to-command": [
    {
      "source": "entire-payload"
    }
  ]
}]

Restart webhook to load the configuration:

sudo systemctl restart webhook.service

/home/user/webhook/bug-test-handler.sh (change path for actual user):

#!/bin/bash

# This will create a file each time it's executed request containing the arguments to the script.
# The file name will be like args.2024-09-18T11_01_45.out
echo "$*" > args.$(date +%FT%H_%M_%S).out

Don't forget to chmod u+x ... the bug-test-handler.sh script

Then to fire the webhook, use the following curl command (correct the port as needed for your config):

curl -d '{"math":"1+2=3"}' http://localhost:9000/hooks/bug-test

Here's the output in the file that gets created after the request is fired:

{"{\"math\":\"1 2":"3\"}"}

As you can see, the + is replaced there by a space, and the = is replaced by ":" which has split the key and value in POST body in a troublesome way, and munged the data by removing those characters.

Thank you for taking a look at this issue!

g1l3sp commented 1 month ago

I was confident that the content-type was being set correctly, but nope, I was wrong. Setting the content-type to application/json was all it took. My apologies for the noise.