Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CID-2777: Secure webhook listener endpoint #16

Merged

Conversation

mohamedlajmileanix
Copy link
Contributor

@mohamedlajmileanix mohamedlajmileanix commented Aug 8, 2024

🛠 Changes made

This PR adds security measurements to only accept trusted webhook events.
All events include X-GitHub-Enterprise-Host header, indicating the host of GHE, which should be the same as the ghe_url passed as docker command argument.
GitHub also offers another layer of securing the events, by adding a signature header to the event. This signature is based on a secret, set by the customer. If the customer wishes to use this option, they need to also add this secret as docker command argument, to be provided to the agent to validate the events' signature.

✨ Type of change

  • New feature (non-breaking change which adds functionality)

🧪 How Has This Been Tested?

  • GitHubWebhookControllerTest for different responses
  • GitHubWebhookHandlerTest for validating headers

🏎 Checklist:

  • My code follows the style guidelines
  • I have performed a self-review of my own code
  • I have made corresponding changes to the documentation (README.md)
  • My commit message clearly reflects the changes made
  • Assigned the appropriate labels (version, PR type, etc.)

@mohamedlajmileanix mohamedlajmileanix added the enhancement New feature or request label Aug 8, 2024
Copy link

github-actions bot commented Aug 9, 2024

LeanIX GitHub Agent Code Coverage

File Coverage [80.17%] 🍏
GitHubWebhookHandler.kt 100% 🍏
GitHubWebhookController.kt 100% 🍏
GitHubEnterpriseProperties.kt 93.75% 🍏
WebhookEventService.kt 83.97% 🍏
GitHubWebHookEventHelper.kt 79.71% 🍏
GlobalExceptionHandler.kt 51.92%
Exceptions.kt 38.24%
Total Project Coverage 67.79% 🍏

@mohamedlajmileanix mohamedlajmileanix marked this pull request as ready for review August 9, 2024 09:12
@mohamedlajmileanix mohamedlajmileanix requested a review from a team as a code owner August 9, 2024 09:12
@mohamedlajmileanix mohamedlajmileanix changed the title CID-2777: Secure webhook listener endpoint - Initial implementation CID-2777: Secure webhook listener endpoint Aug 9, 2024
@mohamedlajmileanix mohamedlajmileanix merged commit 649f246 into main Aug 9, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Development

Successfully merging this pull request may close these issues.

2 participants