awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 08:29:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Verify requests are from Bitbucket using signing

Browse Source
This commit is contained in:
x032205
2025-07-03 23:10:32 -04:00
parent aea43c0a8e
commit 06bd593b60
2 changed files with 45 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/plugins/secret-scanner-v2.ts
+34 -3
View File
@@ -7,6 +7,8 @@ import { TBitbucketPushEvent } from "@app/ee/services/secret-scanning-v2/bitbuck
import { getConfig } from "@app/lib/config/env";
import { logger } from "@app/lib/logger";
import { writeLimit } from "@app/server/config/rateLimiter";
import crypto from "crypto";
import { generateBitbucketWebhookSecret } from "@app/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-factory";
export const registerSecretScanningV2Webhooks = async (server: FastifyZodProvider) => {
const probotApp = (app: Probot) => {
@@ -73,16 +75,45 @@ export const registerSecretScanningV2Webhooks = async (server: FastifyZodProvide
schema: {
querystring: z.object({
dataSourceId: z.string().min(1, { message: "Data Source ID is required" })
})
}),
headers: z
.object({
"x-hub-signature": z.string().min(1, { message: "X-Hub-Signature header is required" })
})
.passthrough()
},
config: {
rateLimit: writeLimit
},
handler: async (req, res) => {
// TODO(andrey): Verify request is from bitbucket
const { dataSourceId } = req.query;
// Verify signature
const signature = req.headers["x-hub-signature"];
if (!signature) {
logger.error("Missing X-Hub-Signature header for Bitbucket webhook");
return res.status(401).send({ message: "Unauthorized: Missing signature" });
}
const expectedSignaturePrefix = "sha256=";
if (!signature.startsWith(expectedSignaturePrefix)) {
logger.error({ signature }, "Invalid X-Hub-Signature format for Bitbucket webhook");
return res.status(401).send({ message: "Unauthorized: Invalid signature format" });
}
const cfg = getConfig();
const hmac = crypto.createHmac("sha256", generateBitbucketWebhookSecret(cfg.AUTH_SECRET, dataSourceId));
hmac.update(JSON.stringify(req.body));
const calculatedSignature = hmac.digest("hex");
const receivedSignature = signature.substring(expectedSignaturePrefix.length);
if (calculatedSignature !== receivedSignature) {
logger.error("Invalid signature for Bitbucket webhook");
return res.status(401).send({ message: "Unauthorized: Invalid signature" });
}
if (!dataSourceId) return res.status(400).send({ message: "Data Source ID is required" });
await server.services.secretScanningV2.bitbucket.handlePushEvent({