| 
5 | 5 | 	"crypto/sha1"  | 
6 | 6 | 	"encoding/hex"  | 
7 | 7 | 	"encoding/json"  | 
 | 8 | +	"fmt"  | 
8 | 9 | 	"io/ioutil"  | 
9 | 10 | 	"net/http"  | 
10 | 11 | 
 
  | 
@@ -96,43 +97,51 @@ func (hook Webhook) RegisterEvents(fn webhooks.ProcessPayloadFunc, events ...Eve  | 
96 | 97 | 
 
  | 
97 | 98 | // ParsePayload parses and verifies the payload and fires off the mapped function, if it exists.  | 
98 | 99 | func (hook Webhook) ParsePayload(w http.ResponseWriter, r *http.Request) {  | 
 | 100 | +	webhooks.DefaultLog.Info("Parsing Payload...")  | 
99 | 101 | 
 
  | 
100 | 102 | 	event := r.Header.Get("X-GitHub-Event")  | 
101 | 103 | 	if len(event) == 0 {  | 
 | 104 | +		webhooks.DefaultLog.Error("Missing X-GitHub-Event Header")  | 
102 | 105 | 		http.Error(w, "400 Bad Request - Missing X-GitHub-Event Header", http.StatusBadRequest)  | 
103 | 106 | 		return  | 
104 | 107 | 	}  | 
 | 108 | +	webhooks.DefaultLog.Debug(fmt.Sprintf("X-GitHub-Event:%s", event))  | 
105 | 109 | 
 
  | 
106 | 110 | 	gitHubEvent := Event(event)  | 
107 | 111 | 
 
  | 
108 | 112 | 	fn, ok := hook.eventFuncs[gitHubEvent]  | 
109 | 113 | 	// if no event registered  | 
110 | 114 | 	if !ok {  | 
 | 115 | +		webhooks.DefaultLog.Info(fmt.Sprintf("Webhook Event %s not registered, it is recommended to setup only events in github that will be registered in the webhook to avoid unnecessary traffic and reduce potential attack vectors.", event))  | 
111 | 116 | 		return  | 
112 | 117 | 	}  | 
113 | 118 | 
 
  | 
114 | 119 | 	payload, err := ioutil.ReadAll(r.Body)  | 
115 | 120 | 	if err != nil || len(payload) == 0 {  | 
116 |  | -		http.Error(w, "Error reading Body", http.StatusInternalServerError)  | 
 | 121 | +		webhooks.DefaultLog.Error("Issue reading Payload")  | 
 | 122 | +		http.Error(w, "Issue reading Payload", http.StatusInternalServerError)  | 
117 | 123 | 		return  | 
118 | 124 | 	}  | 
 | 125 | +	webhooks.DefaultLog.Debug(fmt.Sprintf("Payload:%s", string(payload)))  | 
119 | 126 | 
 
  | 
120 | 127 | 	// If we have a Secret set, we should check the MAC  | 
121 | 128 | 	if len(hook.secret) > 0 {  | 
122 |  | - | 
 | 129 | +		webhooks.DefaultLog.Info("Checking secret")  | 
123 | 130 | 		signature := r.Header.Get("X-Hub-Signature")  | 
124 |  | - | 
125 | 131 | 		if len(signature) == 0 {  | 
 | 132 | +			webhooks.DefaultLog.Error("Missing X-Hub-Signature required for HMAC verification")  | 
126 | 133 | 			http.Error(w, "403 Forbidden - Missing X-Hub-Signature required for HMAC verification", http.StatusForbidden)  | 
127 | 134 | 			return  | 
128 | 135 | 		}  | 
 | 136 | +		webhooks.DefaultLog.Debug(fmt.Sprintf("X-Hub-Signature:%s", signature))  | 
129 | 137 | 
 
  | 
130 | 138 | 		mac := hmac.New(sha1.New, []byte(hook.secret))  | 
131 | 139 | 		mac.Write(payload)  | 
132 | 140 | 
 
  | 
133 | 141 | 		expectedMAC := hex.EncodeToString(mac.Sum(nil))  | 
134 | 142 | 
 
  | 
135 | 143 | 		if !hmac.Equal([]byte(signature[5:]), []byte(expectedMAC)) {  | 
 | 144 | +			webhooks.DefaultLog.Error("HMAC verification failed")  | 
136 | 145 | 			http.Error(w, "403 Forbidden - HMAC verification failed", http.StatusForbidden)  | 
137 | 146 | 			return  | 
138 | 147 | 		}  | 
 | 
0 commit comments