s483780/git-webhook
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added link to verify_signature

Browse Source
This commit is contained in:
Wojciech Kubicki 2023-05-26 14:39:02 +02:00
parent 58d529c93c
commit a61b44d329
1 changed files with 57 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

113
app.py
View File

@ -1,56 +1,57 @@
from flask import Flask, request from flask import Flask, request
import subprocess import subprocess
import hashlib import hashlib
import hmac import hmac
import os import os
app = Flask(__name__) app = Flask(__name__)
# Secret key used for HMAC signature verification # Secret key used for HMAC signature verification
secret_token = os.environ.get('SECRET_TOKEN') secret_token = os.environ.get('SECRET_TOKEN')
@app.route('/webhook', methods=['POST']) @app.route('/webhook', methods=['POST'])
def webhook(): def webhook():
# Check if the received webhook is from Git # Check if the received webhook is from Git
if request.headers.get('X-GitHub-Event') == 'push': if request.headers.get('X-GitHub-Event') == 'push':
# Verify HMAC signature # Verify HMAC signature
signature = request.headers.get('X-Hub-Signature-256') signature = request.headers.get('X-Hub-Signature-256')
if verify_signature(request.data, signature, secret_token): if verify_signature(request.data, signature, secret_token):
return 'Invalid HMAC signature.', 400 return 'Invalid HMAC signature.', 400
# Pull the latest changes from Git # Pull the latest changes from Git
subprocess.run(['git', 'pull']) subprocess.run(['git', 'pull'])
# Restart the example_app # Restart the example_app
subprocess.run(['systemctl', 'restart', 'restart_this_app.service']) subprocess.run(['systemctl', 'restart', 'restart_this_app.service'])
return 'Success!', 200 return 'Success!', 200
else: else:
return 'Invalid webhook event.', 400 return 'Invalid webhook event.', 400
def verify_signature(payload_body, signature_header, secret_token): # https://docs.github.com/en/enterprise-server@3.6/webhooks-and-events/webhooks/securing-your-webhooks#python-example
"""Verify that the payload was sent from GitHub by validating SHA256. def verify_signature(payload_body, signature_header, secret_token):
"""Verify that the payload was sent from GitHub by validating SHA256.
Raise and return 403 if not authorized.
Raise and return 403 if not authorized.
Args:
payload_body: original request body to verify (request.body()) Args:
secret_token: GitHub app webhook token (WEBHOOK_SECRET) payload_body: original request body to verify (request.body())
signature_header: header received from GitHub (x-hub-signature-256) secret_token: GitHub app webhook token (WEBHOOK_SECRET)
""" signature_header: header received from GitHub (x-hub-signature-256)
if not signature_header: """
return False if not signature_header:
return False
hash_object = hmac.new(secret_token.encode('utf-8'), msg=payload_body, digestmod=hashlib.sha256)
expected_signature = "sha256=" + hash_object.hexdigest() hash_object = hmac.new(secret_token.encode('utf-8'), msg=payload_body, digestmod=hashlib.sha256)
if not hmac.compare_digest(expected_signature, signature_header): expected_signature = "sha256=" + hash_object.hexdigest()
return False if not hmac.compare_digest(expected_signature, signature_header):
return False
return True
return True
if __name__ == '__main__':
app.run(host='0.0.0.0', port=5001) if __name__ == '__main__':
app.run(host='0.0.0.0', port=5001)