Commit graph

25 commits

Author SHA1 Message Date
Adnan Hajdarević
896d1608ca
Merge pull request #297 from moorereason/iss207
Return errors on empty secrets during signature validations
2019-01-08 09:30:08 +01:00
Cameron Moore
f056f94305 Allow multiple values for ip-whitelist
Allow the value of ip-whitelist to consist of multiple space-separated
addresses or CIDRs.

Updates #290
2019-01-02 16:50:23 -06:00
Cameron Moore
1a17dc83fe Return errors on empty secrets during signature validations
Fixes #207
2019-01-02 16:09:27 -06:00
Cameron Moore
8d260c6a7e Apply gofmt 2018-02-16 20:26:33 -06:00
Hass_SEA
b595694658
Update to support Scalr Signature Verification
Add a new match rule type that checks for a Scalr webhook signature. Tracking ticket #200

The signature algorithm is described here:
https://scalr-wiki.atlassian.net/wiki/spaces/docs/pages/6193247/Webhook+Security+and+Authentication

An example match rule ifor a Scalr webhook will look like:

"match": {
"type": "scalr-signature",
"secret": ""
}
2017-12-19 12:48:10 -08:00
Cameron Moore
f5f04ddaa2 Allow hooks file to be parsed as a template
Add a -template command line option that instructs webhook to parse the
hooks files as Go text templates.

Includes a `getenv` template func for retrieving environment variables.
2017-11-08 09:14:58 -06:00
Marco Descher
c9abc252e8 Delete hook files by default 2017-11-07 16:38:12 +01:00
Will Rouesnel
53ec2e7acc Add tests for YAML file parsing. 2017-06-29 02:34:58 +10:00
Adnan Hajdarevic
a38875213a fix tests, log ip of the incoming request, bump version 2017-05-27 17:14:38 +02:00
Raphaël Pinson
6b1021925b
Add sha256 payload check 2017-04-06 17:49:31 +02:00
HandcraftedBits
173273b466 Add IP whitelist match rule. 2017-02-20 22:00:39 -05:00
Cameron Moore
6ea2d68b44 Fix failing header tests
Now that we use textproto.CanonicalMIMEHeaderKey, all header field test
data needs to be title-cased.
2016-12-22 10:23:55 -06:00
Adnan Hajdarevic
3b59539a33 do not prefix specified environment variable name with HOOK_ (fixes #98) 2016-09-29 19:15:51 +02:00
Adnan Hajdarević
421fc2cbcd Hotfix backmerge (#89)
* fixes #76, fixes #78, fixes #82, fixes #83 (#84)

* Never disclose expected payload signature (#86)

Fixes #85
2016-08-25 23:42:33 +02:00
Florent Aide
18b0573bc4 Add support for naming env variables (#75)
* Adding ignore patterns

* Adding support for env var naming

* Fixed typo in docstring

* Adding tests for the env var extraction w & w/o explicit naming

* remove coverage script from ignore patterns

* Adding the coverage script to help see which code is tested and which is not

* remove coverage script from sources

* Ignore coverage script from sources tree
2016-05-26 23:33:56 +02:00
Cameron Moore
d2e315d9c6 Fix environment and argument passing
Two issues are addressed in this commit:

1. Instead of only sending the predefined environment arguments, this
commit appends the arguments to the existing OS environment.  Fixes #53.

2. If an argument is not found in the payload, allow the command to run
and pass in an empty string as a placeholder.  Fixes #54.

Additionally, I replaced `hook.ErrInvalidPayloadSignature` with a new
`SignatureError` type so that we can embed the signature in the error.
2015-11-18 12:00:47 -06:00
Cameron Moore
ea3dbf3438 Add environment arguments and improve testing
There's a lot in this commit.

 1. Add `pass-environment-to-command` option that works much like
 `pass-arguments-to-command`.  You can see an example usage in the
 "github" test case.

 2. Add a test program called "hookecho" that is used to test the
 webhook package instead of relying upon a system `echo` command.

 3. Move hooks_test.json to a template so that we can update the path to
 hookecho on the fly.

 4. Don't return an error at the end of hook.MatchRule.Evaluate().  All
 tests succeed for me now.
2015-11-02 15:11:23 -06:00
Cameron Moore
2947e5e0e8 Remove logging side-effects from hook package
The hook package should be self-contained and return errors instead of
relying on the log subsystem.  This commit removes the logging
side-effects from the hook package.  Custom errors are returned that
should be transparent to the caller -- they can just treat them as
simple errors if they don't care to check the type.
2015-10-29 11:00:30 -05:00
Adnan Hajdarevic
4350685330 separated windows and other platforms to different files, removed signal watcher from windows build file so webhook can actually compile on windows, added string as a source, so you can pass static strings to your scripts without having to wrap them around with other scripts 2015-05-16 13:32:21 +02:00
Adnan Hajdarević
12c48f87cb Merge pull request #19 from moorereason/test-json
Add tests for ParseJSONParameters
2015-03-21 10:28:20 +01:00
Cameron Moore
d3f368cb8f Add tests for ParseJSONParameters
This commit adds 100% coverage to Hook.ParaseJSONParameters.
2015-03-20 23:22:30 -05:00
Cameron Moore
943bc258f7 Add new tests for ExtractParameter
This commit regains 100% coverage for ExtractParameter after changes
from commit 688483d.
2015-03-20 22:43:39 -05:00
Adnan Hajdarevic
688483d6d1 added parse-parameters-as-json property to hooks, fixed some bugs in old code 2015-03-21 01:10:17 +01:00
Cameron Moore
9a7dedbc09 Complete hook test suite
This commit provides 100% test coverage of the hook package.

Two bugs were discovered with these tests.  I'll be submitting separate
commits to fix those issues.
2015-03-20 16:46:08 -05:00
Cameron Moore
7dd55f5232 Refactor to remove helpers package
This commit removes the "helpers" package by moving functions from the
package into the other packages that use them.

CheckPayloadSignature() and ExtractParamater() are simply moved to the
"hook" package.  I'm not sure of the usefulness of having these
functions exported, but I left them allow for now.

ValuesToMap() is moved to the "main" webhook package and renamed to
valuesToMap().

Tests were moved into the "hook" package since we only test
ExtractParameter() right now.

This commit closes adnanh/webhook#12.
2015-03-20 08:55:42 -05:00
Renamed from helpers/helpers_test.go (Browse further)