Skip to content

Commit 869ac76

Browse files
author
Dean Karn
authored
Merge pull request #69 from hatstand/add-security-advisory
Add github security advisory event
2 parents 0f4713c + ebe6b8d commit 869ac76

File tree

4 files changed

+137
-39
lines changed

4 files changed

+137
-39
lines changed

‎github/github.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ const (
6060
PushEvent Event = "push"
6161
ReleaseEvent Event = "release"
6262
RepositoryEvent Event = "repository"
63+
SecurityAdvisoryEvent Event = "security_advisory"
6364
StatusEvent Event = "status"
6465
TeamEvent Event = "team"
6566
TeamAddEvent Event = "team_add"
@@ -288,6 +289,10 @@ func (hook Webhook) Parse(r *http.Request, events ...Event) (interface{}, error)
288289
var pl RepositoryPayload
289290
err = json.Unmarshal([]byte(payload), &pl)
290291
return pl, err
292+
case SecurityAdvisoryEvent:
293+
var pl SecurityAdvisoryPayload
294+
err = json.Unmarshal([]byte(payload), &pl)
295+
return pl, err
291296
case StatusEvent:
292297
var pl StatusPayload
293298
err = json.Unmarshal([]byte(payload), &pl)

‎github/github_test.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,6 +453,16 @@ func TestWebhooks(t *testing.T) {
453453
"X-Hub-Signature": []string{"sha1=df442a8af41edd2d42ccdd997938d1d111b0f94e"},
454454
},
455455
},
456+
{
457+
name: "SecurityAdvisoryEvent",
458+
event: SecurityAdvisoryEvent,
459+
typ: SecurityAdvisoryPayload{},
460+
filename: "../testdata/github/security-advisory.json",
461+
headers: http.Header{
462+
"X-Github-Event": []string{"security_advisory"},
463+
"X-Hub-Signature": []string{"sha1=6a71f24fa69f55469843a91dc3a5c3e29714a565"},
464+
},
465+
},
456466
{
457467
name: "StatusEvent",
458468
event: StatusEvent,

‎github/payload.go‎

Lines changed: 71 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,18 @@ import "time"
44

55
// CheckRunPayload contains the information for GitHub's check_run hook event
66
type CheckRunPayload struct {
7-
Action string `json:"action"`
7+
Action string `json:"action"`
88
CheckRun struct {
9-
ID int64 `json:"id"`
10-
Name string `json:"name"`
11-
HeadSHA string `json:"head_sha"`
12-
Status string `json:"status"`
13-
Conclusion string `json:"conclusion"`
14-
URL string `json:"url"`
15-
HtmlURL string `json:"html_url"`
16-
StarterAt time.Time `json:"started_at"`
17-
CompletedAt time.Time `json:"completed_at"`
18-
Output struct {
9+
ID int64 `json:"id"`
10+
Name string `json:"name"`
11+
HeadSHA string `json:"head_sha"`
12+
Status string `json:"status"`
13+
Conclusion string `json:"conclusion"`
14+
URL string `json:"url"`
15+
HtmlURL string `json:"html_url"`
16+
StarterAt time.Time `json:"started_at"`
17+
CompletedAt time.Time `json:"completed_at"`
18+
Output struct {
1919
Title string `json:"title"`
2020
Summary string `json:"summary"`
2121
Text string `json:"text"`
@@ -32,8 +32,8 @@ type CheckRunPayload struct {
3232
Before string `json:"before"`
3333
After string `json:"after"`
3434
PullRequests []PullRequestPayload `json:"pull_requests"`
35-
App struct {
36-
ID int64 `json:"id"`
35+
App struct {
36+
ID int64 `json:"id"`
3737
Owner struct {
3838
Login string `json:"login"`
3939
ID int64 `json:"id"`
@@ -53,18 +53,18 @@ type CheckRunPayload struct {
5353
Type string `json:"type"`
5454
SiteAdmin bool `json:"site_admin"`
5555
} `json:"owner"`
56-
Name string `json:"name"`
57-
Description string `json:"description"`
58-
ExternalURL string `json:"external_url"`
59-
HtmlURL string `json:"html_url"`
60-
CreatedAt string `json:"created_at"`
61-
UpdatedAt string `json:"updated_at"`
56+
Name string `json:"name"`
57+
Description string `json:"description"`
58+
ExternalURL string `json:"external_url"`
59+
HtmlURL string `json:"html_url"`
60+
CreatedAt string `json:"created_at"`
61+
UpdatedAt string `json:"updated_at"`
6262
} `json:"app"`
63-
CreatedAt time.Time `json:"created_at"`
64-
UpdatedAt time.Time `json:"updated_at"`
63+
CreatedAt time.Time `json:"created_at"`
64+
UpdatedAt time.Time `json:"updated_at"`
6565
} `json:"check_suite"`
6666
App struct {
67-
ID int64 `json:"id"`
67+
ID int64 `json:"id"`
6868
Owner struct {
6969
Login string `json:"login"`
7070
ID int64 `json:"id"`
@@ -84,12 +84,12 @@ type CheckRunPayload struct {
8484
Type string `json:"type"`
8585
SiteAdmin bool `json:"site_admin"`
8686
} `json:"owner"`
87-
Name string `json:"name"`
88-
Description string `json:"description"`
89-
ExternalURL string `json:"external_url"`
90-
HtmlURL string `json:"html_url"`
91-
CreatedAt string `json:"created_at"`
92-
UpdatedAt string `json:"updated_at"`
87+
Name string `json:"name"`
88+
Description string `json:"description"`
89+
ExternalURL string `json:"external_url"`
90+
HtmlURL string `json:"html_url"`
91+
CreatedAt string `json:"created_at"`
92+
UpdatedAt string `json:"updated_at"`
9393
} `json:"app"`
9494
PullRequests []PullRequestPayload `json:"pull_requests"`
9595
} `json:"check_run"`
@@ -203,7 +203,7 @@ type CheckRunPayload struct {
203203

204204
// CheckSuitePayload contains the information for GitHub's check_suite hook event
205205
type CheckSuitePayload struct {
206-
Action string `json:"action"`
206+
Action string `json:"action"`
207207
CheckSuite struct {
208208
ID int64 `json:"id"`
209209
HeadBranch string `json:"head_branch"`
@@ -214,8 +214,8 @@ type CheckSuitePayload struct {
214214
Before string `json:"before"`
215215
After string `json:"after"`
216216
PullRequests []PullRequestPayload `json:"pull_requests"`
217-
App struct {
218-
ID int64 `json:"id"`
217+
App struct {
218+
ID int64 `json:"id"`
219219
Owner struct {
220220
Login string `json:"login"`
221221
ID int64 `json:"id"`
@@ -235,23 +235,23 @@ type CheckSuitePayload struct {
235235
Type string `json:"type"`
236236
SiteAdmin bool `json:"site_admin"`
237237
} `json:"owner"`
238-
Name string `json:"name"`
239-
Description string `json:"description"`
240-
ExternalURL string `json:"external_url"`
241-
HtmlURL string `json:"html_url"`
242-
CreatedAt string `json:"created_at"`
243-
UpdatedAt string `json:"updated_at"`
238+
Name string `json:"name"`
239+
Description string `json:"description"`
240+
ExternalURL string `json:"external_url"`
241+
HtmlURL string `json:"html_url"`
242+
CreatedAt string `json:"created_at"`
243+
UpdatedAt string `json:"updated_at"`
244244
} `json:"app"`
245245
CreatedAt time.Time `json:"created_at"`
246246
UpdatedAt time.Time `json:"updated_at"`
247247
LatestCheckRunsCount int64 `json:"latest_check_runs_count"`
248248
CheckRunsURL string `json:"check_runs_url"`
249-
HeadCommit struct {
249+
HeadCommit struct {
250250
ID string `json:"id"`
251251
TreeID string `json:"tree_id"`
252252
Message string `json:"message"`
253253
Timestamp time.Time `json:"timestamp"`
254-
Author struct {
254+
Author struct {
255255
Name string `json:"name"`
256256
Email string `json:"email"`
257257
} `json:"author"`
@@ -5077,6 +5077,38 @@ type RepositoryPayload struct {
50775077
} `json:"sender"`
50785078
}
50795079

5080+
// SecurityAdvisoryPayload contains the information for GitHub's security_advisory hook event.
5081+
type SecurityAdvisoryPayload struct {
5082+
Action string `json:"action"`
5083+
SecurityAdvisory struct {
5084+
GHSAID string `json:"ghsa_id"`
5085+
Summary string `json:"summary"`
5086+
Description string `json:"description"`
5087+
Severity string `json:"string"`
5088+
Identifiers []struct {
5089+
Value string `json:"value"`
5090+
Type string `json:"type"`
5091+
} `json:"identifiers"`
5092+
References []struct {
5093+
URL string `json:"url"`
5094+
} `json:"references"`
5095+
PublishedAt time.Time `json:"published_at"`
5096+
UpdatedAt time.Time `json:"updated_at"`
5097+
WithdrawnAt *time.Time `json:"withdrawn_at"`
5098+
Vulnerabilities []struct {
5099+
Package struct {
5100+
Ecosystem string `json:"ecosystem"`
5101+
Name string `json:"name"`
5102+
}
5103+
Severity string `json:"severity"`
5104+
VulnerableVersionRange string `json:"vulnerable_version_range"`
5105+
FirstPatchedVersion *struct {
5106+
Identifier string `json:"identifier"`
5107+
} `json:"first_patched_version"`
5108+
} `json:"vulnerabilities"`
5109+
} `json:"security_advisory"`
5110+
}
5111+
50805112
// StatusPayload contains the information for GitHub's status hook event
50815113
type StatusPayload struct {
50825114
ID int64 `json:"id"`

‎testdata/github/security-advisory.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"action": "published",
3+
"security_advisory": {
4+
"ghsa_id": "GHSA-rf4j-j272-fj86",
5+
"summary": "Moderate severity vulnerability that affects django",
6+
"description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.",
7+
"severity": "moderate",
8+
"identifiers": [
9+
{
10+
"value": "GHSA-rf4j-j272-fj86",
11+
"type": "GHSA"
12+
},
13+
{
14+
"value": "CVE-2018-6188",
15+
"type": "CVE"
16+
}
17+
],
18+
"references": [
19+
{
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188"
21+
}
22+
],
23+
"published_at": "2018-10-03T21:13:54Z",
24+
"updated_at": "2018-10-03T21:13:54Z",
25+
"withdrawn_at": null,
26+
"vulnerabilities": [
27+
{
28+
"package": {
29+
"ecosystem": "pip",
30+
"name": "django"
31+
},
32+
"severity": "moderate",
33+
"vulnerable_version_range": ">= 2.0.0, < 2.0.2",
34+
"first_patched_version": {
35+
"identifier": "2.0.2"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "pip",
41+
"name": "django"
42+
},
43+
"severity": "moderate",
44+
"vulnerable_version_range": ">= 1.11.8, < 1.11.10",
45+
"first_patched_version": {
46+
"identifier": "1.11.10"
47+
}
48+
}
49+
]
50+
}
51+
}

0 commit comments

Comments
 (0)