Do validate the SHA-256 signature

Not that SHA-1 is _practically_ broken yet... but still...

Signed-off-by: Johannes Schindelin <[email protected]>

Author: dscho

GitGitGadget/index.js

@@ -19,16 +19,16 @@ const validateGitHubWebHook = (context) => {
     if (context.req.headers['content-type'] !== 'application/json') {
         throw new Error('Unexpected content type: ' + context.req.headers['content-type']);
     }
-    const signature = context.req.headers['x-hub-signature'];
+    const signature = context.req.headers['x-hub-signature-256'];
     if (!signature) {
         throw new Error('Missing X-Hub-Signature');
     }
-    const sha1 = signature.match(/^sha1=(.*)/);
-    if (!sha1) {
+    const sha256 = signature.match(/^sha256=(.*)/);
+    if (!sha256) {
         throw new Error('Unexpected X-Hub-Signature format: ' + signature);
     }
-    const computed = crypto.createHmac('sha1', secret).update(context.req.rawBody).digest('hex');
-    if (sha1[1] !== computed) {
+    const computed = crypto.createHmac('sha256', secret).update(context.req.rawBody).digest('hex');
+    if (sha256[1] !== computed) {
         throw new Error('Incorrect X-Hub-Signature');
     }
 }

__tests__/index.test.js

@@ -38,10 +38,10 @@ test('reject requests other than webhook payloads', async () => {
     context.req.headers['content-type'] = 'application/json'
     await expectInvalidWebhook('Missing X-Hub-Signature')
 
-    context.req.headers['x-hub-signature'] = 'invalid'
+    context.req.headers['x-hub-signature-256'] = 'invalid'
     await expectInvalidWebhook('Unexpected X-Hub-Signature format: invalid')
 
-    context.req.headers['x-hub-signature'] = 'sha1=incorrect'
+    context.req.headers['x-hub-signature-256'] = 'sha256=incorrect'
     context.req.rawBody = '# empty'
     await expectInvalidWebhook('Incorrect X-Hub-Signature')
 })