1
1
using rubberduckvba . Server . Api . Admin ;
2
- using System . Diagnostics ;
3
2
using System . Security . Cryptography ;
4
3
using System . Text ;
5
4
@@ -19,52 +18,43 @@ string[] xHubSignature256
19
18
if ( ! ( userAgent ?? string . Empty ) . StartsWith ( "GitHub-Hookshot/" ) )
20
19
{
21
20
// user agent must be GitHub hookshot
22
- LogMissingHeader ( "USER-AGENT" ) ;
23
21
return false ;
24
22
}
25
23
26
24
if ( ! xGitHubEvent . Contains ( "push" ) )
27
25
{
28
26
// only authenticate push events
29
- LogMissingHeader ( "X-GITHUB-EVENT" ) ;
30
27
return false ;
31
28
}
32
29
33
30
if ( ! Guid . TryParse ( xGitHubDelivery . SingleOrDefault ( ) , out _ ) )
34
31
{
35
32
// delivery should parse as a GUID
36
- LogMissingHeader ( "X-GITHUB-DELIVERY" ) ;
37
33
return false ;
38
34
}
39
35
40
36
if ( ! xHubSignature . Any ( ) )
41
37
{
42
38
// SHA-1 signature header must be present
43
- LogMissingHeader ( "X-HUB-SIGNATURE" ) ;
44
39
return false ;
45
40
}
46
41
47
42
var signature = xHubSignature256 . SingleOrDefault ( ) ;
48
43
if ( signature == default )
49
44
{
50
45
// SHA-256 signature header must be present
51
- LogMissingHeader ( "X-HUB-SIGNATURE-256" ) ;
52
46
return false ;
53
47
}
54
48
55
49
if ( ! IsValidSignature ( signature , payload ) )
56
50
{
57
51
// SHA-256 signature must match
58
- Debug . WriteLine ( "Signature validation failed" ) ;
59
52
return false ;
60
53
}
61
54
62
55
return true ;
63
56
}
64
57
65
- //[Conditional("DEBUG")]
66
- private void LogMissingHeader ( string header ) => Console . WriteLine ( $ "** Webhook validation failed. Missing header: [{ header } ]") ;
67
-
68
58
private bool IsValidSignature ( string ? signature , string payload )
69
59
{
70
60
if ( string . IsNullOrWhiteSpace ( signature ) )
0 commit comments