clawbot
fcead5d401
Some checks failed
check / check (push) Superseded by a newer commit; never tested
The receiver had no inbound authentication of any kind: /webhook/{uuid}
was mounted behind a rate limiter alone, so the only thing protecting an
entrypoint was the secrecy of a v4 UUID in a URL path. Inbound headers are
forwarded almost verbatim to the target, so anyone who learned the URL
also chose the headers the downstream service received.
Adds an optional per-entrypoint secret with two schemes: github
(X-Hub-Signature-256, HMAC-SHA256 hex over the raw body) and gitlab
(X-Gitlab-Token, a plain shared token). Comparison is constant-time, the
HMAC is computed over the raw body before any parsing, and rejection
happens before persistence -- an unauthenticated request creates no event
row. An entrypoint with no secret behaves exactly as before, including
every row that predates this change.
The scheme's credential header is stripped from the header map before it
is marshalled into Event.Headers, so the GitLab token reaches neither the
event store nor any delivery target. SchemeInfo.HeaderIsDigest defaults to
false meaning strip, so a scheme added later is protected unless its
header is positively declared a digest.
86 lines
2.3 KiB
Go
86 lines
2.3 KiB
Go
package database_test
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"sneak.berlin/go/webhooker/internal/database"
|
|
"sneak.berlin/go/webhooker/internal/signature"
|
|
)
|
|
|
|
// TestEntrypointSignatureColumnsMigrateToUnconfigured pins the
|
|
// upgrade path for a deployment that already has entrypoints.
|
|
//
|
|
// The signature columns arrive through GORM's AutoMigrate, so every
|
|
// row written before they existed acquires them with no value. That
|
|
// has to land on "not configured", because the alternative is an
|
|
// upgrade that rejects the traffic the operator was already
|
|
// receiving — a self-inflicted outage on a receiver whose senders
|
|
// cannot be told to start signing.
|
|
//
|
|
// The legacy schema is reproduced by dropping the columns from a
|
|
// migrated database and writing a row through the old shape, so the
|
|
// row really predates them rather than merely being blank.
|
|
func TestEntrypointSignatureColumnsMigrateToUnconfigured(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
db, lc := setupTestDB(t)
|
|
lc.RequireStart()
|
|
|
|
t.Cleanup(lc.RequireStop)
|
|
|
|
for _, column := range []string{
|
|
"signature_scheme", "signature_secret",
|
|
} {
|
|
require.NoError(
|
|
t,
|
|
db.DB().Exec(
|
|
"ALTER TABLE entrypoints DROP COLUMN "+column,
|
|
).Error,
|
|
"dropping %s to reproduce the pre-upgrade schema",
|
|
column,
|
|
)
|
|
}
|
|
|
|
const legacyID = "legacy-entrypoint"
|
|
|
|
require.NoError(
|
|
t,
|
|
db.DB().Exec(
|
|
`INSERT INTO entrypoints
|
|
(id, created_at, updated_at, webhook_id, path,
|
|
description, active)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?)`,
|
|
legacyID, "2026-01-01 00:00:00", "2026-01-01 00:00:00",
|
|
"legacy-webhook", "legacy-path", "predates signatures",
|
|
true,
|
|
).Error,
|
|
)
|
|
|
|
// The upgrade.
|
|
require.NoError(t, db.Migrate())
|
|
|
|
var ep database.Entrypoint
|
|
|
|
require.NoError(
|
|
t,
|
|
db.DB().Where("id = ?", legacyID).First(&ep).Error,
|
|
"the migrated row must still load; a NULL landing in a "+
|
|
"string column would fail here",
|
|
)
|
|
|
|
assert.Equal(t, database.SignatureSchemeNone, ep.SignatureScheme)
|
|
assert.Empty(t, ep.SignatureSecret)
|
|
assert.False(t, ep.SignatureConfigured())
|
|
assert.True(t, ep.Active, "the row's other columns survive")
|
|
|
|
// The behaviour that actually matters: an unsigned request to
|
|
// this entrypoint is still accepted.
|
|
assert.NoError(
|
|
t,
|
|
signature.Verify(&ep, http.Header{}, []byte(`{"a":1}`)),
|
|
)
|
|
}
|