feat: Using repo hash as HMAC key for Bitbucket webhook

go.mod

@@ -36,6 +36,7 @@ require (
  github.com/moby/moby v20.10.25+incompatible
  github.com/moby/term v0.5.0
  github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450
+ github.com/neticdk/go-bitbucket v1.0.0
  github.com/oklog/ulid/v2 v2.1.0
  github.com/pkg/errors v0.9.1
  github.com/prometheus/client_golang v1.16.0
@@ -123,7 +124,6 @@ require (
  github.com/modern-go/reflect2 v1.0.2 // indirect
  github.com/morikuni/aec v1.0.0 // indirect
  github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
- github.com/neticdk/go-bitbucket v0.1.2
  github.com/onsi/ginkgo v1.16.4 // indirect
  github.com/opencontainers/go-digest v1.0.0 // indirect
  github.com/opencontainers/image-spec v1.0.2 // indirect

go.sum

@@ -331,8 +331,8 @@ github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 h1:j2kD3MT1z4PXCiUll
 github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450/go.mod h1:skjdDftzkFALcuGzYSklqYd8gvat6F1gZJ4YPVbkZpM=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/neticdk/go-bitbucket v0.1.2 h1:V7xC3hd3fOGFjGyhfVaf87f6wjo97z9lv3T6gLxtXUo=
-github.com/neticdk/go-bitbucket v0.1.2/go.mod h1:IrHeWO1CrNi0DlOvfhAA9bGRSeNSUB6/SAfzmwbA5aU=
+github.com/neticdk/go-bitbucket v1.0.0 h1:FPvHEgPHoDwD2VHbpyu2R2gnoWQ867RxZd2FivS4wSw=
+github.com/neticdk/go-bitbucket v1.0.0/go.mod h1:IrHeWO1CrNi0DlOvfhAA9bGRSeNSUB6/SAfzmwbA5aU=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=

server/forge/bitbucketserver/bitbucketserver.go

@@ -43,8 +43,6 @@ const (
  requestTokenURL = "%s/plugins/servlet/oauth/request-token"
  authorizeTokenURL = "%s/plugins/servlet/oauth/authorize"
  accessTokenURL = "%s/plugins/servlet/oauth/access-token"
-
- secret = "045dfb11b042c3c44d68274fd22338e0" // TODO: Temporary 32 bytes?
 )
 
 // Opts defines configuration options.
@@ -420,7 +418,7 @@ func (c *client) Activate(ctx context.Context, u *model.User, r *model.Repo, lin
  Events: []bb.EventKey{bb.EventKeyRepoRefsChanged, bb.EventKeyPullRequestFrom},
  Active: true,
  Config: &bb.WebhookConfiguration{
- Secret: secret,
+ Secret: r.Hash,
  },
  }
  _, _, err = bc.Projects.CreateWebhook(ctx, r.Owner, r.Name, webhook)
@@ -468,7 +466,7 @@ func (c *client) Deactivate(ctx context.Context, u *model.User, r *model.Repo, l
 }
 
 func (c *client) Hook(ctx context.Context, r *http.Request) (*model.Repo, *model.Pipeline, error) {
- ev, err := bb.ParsePayload(r, []byte(secret))
+ ev, payload, err := bb.ParsePayloadWithoutSignature(r)
  if err != nil {
  return nil, nil, fmt.Errorf("unable to parse payload from webhook invocation: %w", err)
  }
@@ -486,7 +484,17 @@ func (c *client) Hook(ctx context.Context, r *http.Request) (*model.Repo, *model
  return nil, nil, nil
  }
 
- pipe, err = c.updatePipelineFromCommit(ctx, repo, pipe)
+ user, repo, err := c.getUserAndRepo(ctx, repo)
+ if err != nil {
+ return nil, nil, err
+ }
+
+ err = bb.ValidateSignature(r, payload, []byte(repo.Hash))
+ if err != nil {
+ return nil, nil, fmt.Errorf("unable to validate signature on incoming webhook payload: %w", err)
+ }
+
+ pipe, err = c.updatePipelineFromCommit(ctx, user, repo, pipe)
  if err != nil {
  return nil, nil, err
  }
@@ -498,42 +506,47 @@ func (c *client) Hook(ctx context.Context, r *http.Request) (*model.Repo, *model
  return repo, pipe, nil
 }
 
-func (c *client) updatePipelineFromCommit(ctx context.Context, r *model.Repo, p *model.Pipeline) (*model.Pipeline, error) {
- if p == nil {
- return nil, nil
- }
-
+func (c *client) getUserAndRepo(ctx context.Context, r *model.Repo) (*model.User, *model.Repo, error) {
  _store, ok := store.TryFromContext(ctx)
  if !ok {
  log.Error().Msg("could not get store from context")
- return nil, nil
+ return nil, nil, fmt.Errorf("unable to get store from context")
  }
 
  repo, err := _store.GetRepoForgeID(r.ForgeRemoteID)
  if err != nil {
- return nil, err
+ return nil, nil, fmt.Errorf("unable to get repo: %w", err)
  }
  log.Trace().Any("repo", repo).Msg("got repo")
 
- u, err := _store.GetUser(repo.UserID)
+ user, err := _store.GetUser(repo.UserID)
  if err != nil {
- return nil, err
+ return nil, nil, fmt.Errorf("unable to get user: %w", err)
+ }
+ log.Trace().Any("user", user).Msg("got user")
+
+ return user, repo, nil
+}
+
+func (c *client) updatePipelineFromCommit(ctx context.Context, u *model.User, r *model.Repo, p *model.Pipeline) (*model.Pipeline, error) {
+ if p == nil {
+ return nil, nil
  }
 
  bc, err := c.newClient(u)
  if err != nil {
  return nil, fmt.Errorf("unable to create bitbucket client: %w", err)
  }
 
- commit, _, err := bc.Projects.GetCommit(ctx, repo.Owner, repo.Name, p.Commit)
+ commit, _, err := bc.Projects.GetCommit(ctx, r.Owner, r.Name, p.Commit)
  if err != nil {
  return nil, fmt.Errorf("unable to read commit: %w", err)
  }
  p.Message = commit.Message
 
  opts := &bb.ListOptions{}
  for {
- changes, resp, err := bc.Projects.ListChanges(ctx, repo.Owner, repo.Name, p.Commit, opts)
+ changes, resp, err := bc.Projects.ListChanges(ctx, r.Owner, r.Name, p.Commit, opts)
  if err != nil {
  return nil, fmt.Errorf("unable to list commit changes: %w", err)
  }