search

scality / runner-manager

Service to manage github Actions self-hosted runners
https://scality.github.io/runner-manager/
Apache License 2.0
6 stars 5 forks source link

webhook: fix non-matching webhook secrets not being rejected #601

Closed harryfinbow closed 1 month ago

harryfinbow commented 1 month ago

Fixes an issue which allowed webhooks to be processed with an incorrect webhook secret.

This adds a case to return a 401 when the verify function returns false. The verify function also always returns false as it is being passed in JSON from a WorkflowJob webhook object instead of the request body (which is how GitHub generates it's signitures) meaning the signatures will never match (see https://github.com/yanyongyu/githubkit?tab=readme-ov-file#webhook-verification).

harryfinbow commented 1 month ago

I am not familiar with FastAPI at all so if there is a better way of getting the request body without having to add async that you know of I am happy to change it :)