|
5 | 5 | "crypto/sha1" |
6 | 6 | "encoding/hex" |
7 | 7 | "encoding/json" |
| 8 | + "fmt" |
8 | 9 | "io/ioutil" |
9 | 10 | "net/http" |
10 | 11 |
|
@@ -96,43 +97,51 @@ func (hook Webhook) RegisterEvents(fn webhooks.ProcessPayloadFunc, events ...Eve |
96 | 97 |
|
97 | 98 | // ParsePayload parses and verifies the payload and fires off the mapped function, if it exists. |
98 | 99 | func (hook Webhook) ParsePayload(w http.ResponseWriter, r *http.Request) { |
| 100 | + webhooks.DefaultLog.Info("Parsing Payload...") |
99 | 101 |
|
100 | 102 | event := r.Header.Get("X-GitHub-Event") |
101 | 103 | if len(event) == 0 { |
| 104 | + webhooks.DefaultLog.Error("Missing X-GitHub-Event Header") |
102 | 105 | http.Error(w, "400 Bad Request - Missing X-GitHub-Event Header", http.StatusBadRequest) |
103 | 106 | return |
104 | 107 | } |
| 108 | + webhooks.DefaultLog.Debug(fmt.Sprintf("X-GitHub-Event:%s", event)) |
105 | 109 |
|
106 | 110 | gitHubEvent := Event(event) |
107 | 111 |
|
108 | 112 | fn, ok := hook.eventFuncs[gitHubEvent] |
109 | 113 | // if no event registered |
110 | 114 | if !ok { |
| 115 | + webhooks.DefaultLog.Info(fmt.Sprintf("Webhook Event %s not registered, it is recommended to setup only events in github that will be registered in the webhook to avoid unnecessary traffic and reduce potential attack vectors.", event)) |
111 | 116 | return |
112 | 117 | } |
113 | 118 |
|
114 | 119 | payload, err := ioutil.ReadAll(r.Body) |
115 | 120 | if err != nil || len(payload) == 0 { |
116 | | - http.Error(w, "Error reading Body", http.StatusInternalServerError) |
| 121 | + webhooks.DefaultLog.Error("Issue reading Payload") |
| 122 | + http.Error(w, "Issue reading Payload", http.StatusInternalServerError) |
117 | 123 | return |
118 | 124 | } |
| 125 | + webhooks.DefaultLog.Debug(fmt.Sprintf("Payload:%s", string(payload))) |
119 | 126 |
|
120 | 127 | // If we have a Secret set, we should check the MAC |
121 | 128 | if len(hook.secret) > 0 { |
122 | | - |
| 129 | + webhooks.DefaultLog.Info("Checking secret") |
123 | 130 | signature := r.Header.Get("X-Hub-Signature") |
124 | | - |
125 | 131 | if len(signature) == 0 { |
| 132 | + webhooks.DefaultLog.Error("Missing X-Hub-Signature required for HMAC verification") |
126 | 133 | http.Error(w, "403 Forbidden - Missing X-Hub-Signature required for HMAC verification", http.StatusForbidden) |
127 | 134 | return |
128 | 135 | } |
| 136 | + webhooks.DefaultLog.Debug(fmt.Sprintf("X-Hub-Signature:%s", signature)) |
129 | 137 |
|
130 | 138 | mac := hmac.New(sha1.New, []byte(hook.secret)) |
131 | 139 | mac.Write(payload) |
132 | 140 |
|
133 | 141 | expectedMAC := hex.EncodeToString(mac.Sum(nil)) |
134 | 142 |
|
135 | 143 | if !hmac.Equal([]byte(signature[5:]), []byte(expectedMAC)) { |
| 144 | + webhooks.DefaultLog.Error("HMAC verification failed") |
136 | 145 | http.Error(w, "403 Forbidden - HMAC verification failed", http.StatusForbidden) |
137 | 146 | return |
138 | 147 | } |
|
0 commit comments