GitHub OAuth Security Enhancement

[everettbu]

Test 4

[greptile-apps]

Greptile Summary

This PR implements critical security enhancements to the GitHub OAuth integration flow, addressing vulnerabilities in state validation and user authentication. The changes span three key files:

Core Security Implementation (src/sentry/integrations/github/integration.py):

• Introduces a new OAuthLoginView class that implements proper OAuth 2.0 flow with CSRF protection
• Adds state parameter validation by comparing request.GET.get('state') with pipeline.signature to prevent OAuth state fixation attacks
• Implements user verification by ensuring the authenticated GitHub user matches the app installer (pipeline.fetch_state('github_authenticated_user') != integration.metadata['sender']['login'])
• Refactors error handling with a centralized error() function for consistent security responses

Pipeline Logic Simplification (src/sentry/web/frontend/pipeline_advancer.py):

• Removes the global FORWARD_INSTALL_FOR constant and inlines the GitHub provider check directly
• Maintains the same functional behavior for redirecting GitHub installations that bypass the normal pipeline
• Improves code readability by moving comments closer to the relevant logic

Test Coverage Enhancement (tests/sentry/integrations/github/test_integration.py):

• Adds comprehensive test coverage for the OAuth access token exchange process
• Implements state parameter validation testing in OAuth callbacks
• Introduces user mismatch detection tests to verify installation hijacking prevention
• Updates existing tests to properly simulate the complete OAuth flow with security validations

These changes transform a vulnerable OAuth implementation into a secure flow that follows OAuth 2.0 best practices. The modifications integrate seamlessly with Sentry's existing pipeline architecture while adding essential security boundaries to prevent CSRF attacks and unauthorized integration installations.

Confidence score: 4/5

• This PR significantly improves security by implementing proper OAuth state validation and user verification, making it much safer to merge
• The confidence score reflects that while the security improvements are solid, the changes touch critical authentication flows that require careful testing
• src/sentry/integrations/github/integration.py needs the most attention due to the new OAuth flow implementation and security checks

_{3 files reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}