Skip to content

Commit e256c21

Browse files
authored
Merge branch 'master' into fix_logging
2 parents 12ac467 + 034e2d1 commit e256c21

File tree

4 files changed

+57
-19
lines changed

4 files changed

+57
-19
lines changed

CHANGELOG.rst

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ Changed
4848
* Renamed reference to the RBAC backend/plugin from ``enterprise`` to ``default``. Updated st2api
4949
validation to use the new value when checking RBAC configuration. Removed other references to
5050
enterprise for RBAC related contents. (improvement)
51+
* Remove authentication headers ``St2-Api-Key``, ``X-Auth-Token`` and ``Cookie`` from webhook payloads to
52+
prevent them from being stored in the database. (security bug fix) #4983
53+
54+
Contributed by @potato and @knagy
5155

5256
Fixed
5357
~~~~~

README.md

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,14 @@
22

33
**StackStorm** is a platform for integration and automation across services and tools, taking actions in response to events. Learn more at [www.stackstorm.com](http://www.stackstorm.com/product).
44

5-
[![Tests Build Status](https://travis-ci.org/StackStorm/st2.svg?branch=master)](https://travis-ci.org/StackStorm/st2) [![Packages Build Status](https://circleci.com/gh/StackStorm/st2/tree/master.svg?style=shield)](https://circleci.com/gh/StackStorm/st2) [![Codecov](https://codecov.io/github/StackStorm/st2/badge.svg?branch=master&service=github)](https://codecov.io/github/StackStorm/st2?branch=master) ![Python 2.7 | 3.6](https://img.shields.io/badge/python-2.7%20%7C%203.6-blue) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1833/badge)](https://bestpractices.coreinfrastructure.org/projects/1833) [![Join our community Slack](https://stackstorm-community.herokuapp.com/badge.svg)](https://stackstorm.com/community-signup) [![Forum](https://img.shields.io/discourse/https/forum.stackstorm.com/posts.svg)](https://forum.stackstorm.com/)
5+
[![Travis Unit Tests Status](https://travis-ci.org/StackStorm/st2.svg?branch=master)](https://travis-ci.org/StackStorm/st2)
6+
[![Packages Build Status](https://circleci.com/gh/StackStorm/st2/tree/master.svg?style=shield)](https://circleci.com/gh/StackStorm/st2)
7+
[![Codecov](https://codecov.io/github/StackStorm/st2/badge.svg?branch=master&service=github)](https://codecov.io/github/StackStorm/st2?branch=master)
8+
[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1833/badge)](https://bestpractices.coreinfrastructure.org/projects/1833)
9+
![Python 2.7 | 3.6](https://img.shields.io/badge/python-2.7%20%7C%203.6-blue)
10+
[![Apache Licensed](https://img.shields.io/github/license/StackStorm/st2)](LICENSE)
11+
[![Join our community Slack](https://img.shields.io/badge/slack-stackstorm-success.svg?logo=slack)](https://stackstorm.com/community-signup)
12+
[![Forum](https://img.shields.io/discourse/https/forum.stackstorm.com/posts.svg)](https://forum.stackstorm.com/)
613

714
---
815

@@ -27,51 +34,51 @@ StackStorm is a platform for integration and automation across services and tool
2734

2835
StackStorm helps automate common operational patterns. Some examples are:
2936

30-
* **Facilitated Troubleshooting** - triggering on system failures captured by Nagios, Sensu, New Relic and other monitoring, running a series of diagnostic checks on physical nodes, OpenStack or Amazon instances, and application components, and posting results to a shared communication context, like HipChat or JIRA.
37+
* **Facilitated Troubleshooting** - triggering on system failures captured by Nagios, Sensu, New Relic and other monitoring, running a series of diagnostic checks on physical nodes, OpenStack or Amazon instances, and application components, and posting results to a shared communication context, like Slack or JIRA.
3138
* **Automated remediation** - identifying and verifying hardware failure on OpenStack compute node, properly evacuating instances and emailing VM about potential downtime, but if anything goes wrong - freezing the workflow and calling PagerDuty to wake up a human.
3239
* **Continuous deployment** - build and test with Jenkins, provision a new AWS cluster, turn on some traffic with the load balancer, and roll-forth or roll-back based on NewRelic app performance data.
3340

34-
StackStorm helps you compose these and other operational patterns as rules and workflows or actions; and these rules and workflows - the content within the StackStorm platform - are stored *as code* which means they support the same approach to collaboration that you use today for code development and can be shared with the broader open source community via StackStorm.com/community for example.
41+
StackStorm helps you compose these and other operational patterns as rules and workflows or actions; and these rules and workflows - the content within the StackStorm platform - are stored *as code* which means they support the same approach to collaboration that you use today for code development and can be shared with the broader open source community via [StackStorm Exchange](https://exchange.stackstorm.com).
3542

3643
### Who is using StackStorm?
3744

3845
See the list of known StackStorm [ADOPTERS.md](/ADOPTERS.md) and [Thought Leaders](https://stackstorm.com/stackstorm-thought-leaders/).
3946

4047
### How it works
4148

42-
![stackstorm component diagram](https://cloud.githubusercontent.com/assets/20028/5688946/fabef9ec-9822-11e4-859e-29bbb67df85b.jpg)
49+
#### StackStorm architecture
4350

44-
StackStorm architecture diagram
51+
![StackStorm architecture diagram](https://user-images.githubusercontent.com/597113/92291633-6b5aae00-eece-11ea-912e-3bf977aa3cea.png)
4552

46-
StackStorm plugs into the environment via the extensible set of adapters: sensors and actions.
53+
StackStorm plugs into the environment via an extensible set of adapters: sensors and actions.
4754

48-
* **Sensors** are python plugins for inbound integration that watch for events from external systems and fire a StackStorm trigger when an event happens.
55+
* **Sensors** are Python plugins for inbound integration that watch for events from external systems and fire a StackStorm trigger when an event happens.
4956

50-
* **Triggers** are StackStorm representations of external events. There are generic triggers (e.g. timers, webhooks) and integration triggers (e.g. Sensu alert, JIRA issue updated). A new trigger type can be defined by writing a sensor plugin.
57+
* **Triggers** are StackStorm representations of external events. There are generic triggers (e.g., timers, webhooks) and integration triggers (e.g., Sensu alert, JIRA issue updated). A new trigger type can be defined by writing a sensor plugin.
5158

52-
* **Actions** are StackStorm outbound integrations. There are generic actions (ssh, REST call), integrations (OpenStack, Docker, Puppet), or custom actions. Actions are either python plugins, or any scripts, consumed into StackStorm by adding a few lines of metadata. Actions can be invoked directly by user via CLI or API, or used and called as part of automations - rules and workflows.
59+
* **Actions** are StackStorm outbound integrations. There are generic actions (SSH, HTTP request), integrations (OpenStack, Docker, Puppet), or custom actions. Actions are either Python plugins, or any scripts, consumed into StackStorm by adding a few lines of metadata. Actions can be invoked directly by user via CLI, API, or the web UI, or used and called as part of automations - rules and workflows.
5360

54-
* **Rules** map triggers to actions (or to workflows), applying matching criterias and mapping trigger payload to action inputs.
61+
* **Rules** map triggers to actions (or to workflows), applying matching criterias and map trigger payload data to action inputs.
5562

56-
* **Workflows** stitch actions together into uber-actions, defining the order, transition conditions, and passing the data. Most automations are more than one-step and thus need more than one action. Workflows, just like atomic actions, are available in action library, can be invoked manually or triggered by rules.
63+
* **Workflows** stitch actions together into "uber-actions", defining the order, transition conditions, and passing context data from one action to the next. Most automations are multi-step (eg: more than one action). Workflows, just like "atomic" actions, are available in the action library, and can be invoked manually or triggered by rules.
5764

58-
* **Packs** are the units of content deployment. They simplify the management and sharing of StackStorm pluggable content by grouping integrations (triggers and actions) and automations (rules and workflows). A growing number of packs is available on StackStorm community. User can create their own packs, share them on Github, or submit to StackStorm community repo.
65+
* **Packs** are the units of content deployment. They simplify the management and sharing of StackStorm pluggable content by grouping integrations (triggers and actions) and automations (rules and workflows). A growing number of packs is available on the StackStorm Exchange. Users can create their own packs, share them on GitHub, or submit them to the StackStorm Exchange organization.
5966

60-
* **Audit trail** of action executions, manual or automated, is recorded and stored with full details of triggering context and execution results. It is is also captured in audit logs for integrating with external logging and analytical tools: LogStash, Splunk, statsd, syslog.
67+
* **Audit trail** is the historical list of action executions, manual or automated, and is recorded and stored with full details of triggering context and execution results. It is is also captured in audit logs for integrating with external logging and analytical tools: LogStash, Splunk, statsd, or syslog.
6168

62-
StackStorm is a service with modular architecture. It comprises loosely coupled service components that communicate over the message bus, and scales horizontally to deliver automation at scale. StackStorm has a full REST API, CLI client for admins and users to operate it locally or remotely, and Python client bindings for developer’s convenience. Web UI is coming soon.
69+
StackStorm is a service with modular architecture. It is comprised of loosely coupled microservice components that communicate over a message bus, and scales horizontally to deliver automation at scale. StackStorm has a full REST API, CLI client, and web UI for admins and users to operate it locally or remotely, as well as Python client bindings for developer convenience.
6370

64-
StackStorm is new and under active development. We are opening it early to engage community, get feedback, and refine directions, and welcome contributions.
71+
StackStorm is an established project and remains actively developed by a broad community.
6572

6673
## Documentation
6774

68-
Additional documentation describing installation proceduces, action/rule/workflow authoring, and how to setup and use triggers/sensors can be found at [StackStorm Docs](https://docs.stackstorm.com).
75+
Additional documentation, including installation proceduces, action/rule/workflow authoring, and how to setup and use triggers/sensors can be found at [https://docs.stackstorm.com](https://docs.stackstorm.com).
6976

7077
## Hacking / Contributing
7178

72-
To set up dev environment and run StackStorm from sources, follow [these instructions](https://docs.stackstorm.com/development/sources.html).
79+
To set up a development environment and run StackStorm from sources, follow [these instructions](https://docs.stackstorm.com/development/sources.html).
7380

74-
For information on how to contribute, style guide, coding conventions and more,
81+
For information on how to contribute, our style guide, coding conventions and more,
7582
please visit the [Development section](https://docs.stackstorm.com/development/index.html)
7683
in our documentation.
7784

@@ -85,9 +92,10 @@ in 48 hours or less. If further action is necessary, you may receive additional
8592

8693
For more information, please refer to https://docs.stackstorm.com/latest/security.html
8794

88-
## Copyright, License, and Contributors Agreement
95+
## Copyright, License, and Contributor Agreement
8996

9097
Copyright 2020 The StackStorm Authors.
98+
Copyright 2019 Extreme Networks, Inc.
9199
Copyright 2014-2018 StackStorm, Inc.
92100

93101
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this work except in compliance with the License. You may obtain a copy of the License in the [LICENSE](LICENSE) file, or at:

st2api/st2api/controllers/v1/webhooks.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
urljoin = urlparse.urljoin
2020

2121
from st2common import log as logging
22+
from st2common.constants.auth import HEADER_API_KEY_ATTRIBUTE_NAME, HEADER_ATTRIBUTE_NAME
2223
from st2common.constants.triggers import WEBHOOK_TRIGGER_TYPES
2324
from st2common.models.api.trace import TraceContext
2425
from st2common.models.api.trigger import TriggerAPI
@@ -126,6 +127,7 @@ def post(self, hook, webhook_body_api, headers, requester_user):
126127
permission_type=permission_type)
127128

128129
headers = self._get_headers_as_dict(headers)
130+
headers = self._filter_authentication_headers(headers)
129131

130132
# If webhook contains a trace-tag use that else create create a unique trace-tag.
131133
trace_context = self._create_trace_context(trace_tag=headers.pop(TRACE_TAG_HEADER, None),
@@ -219,6 +221,10 @@ def _get_headers_as_dict(self, headers):
219221
headers_dict[key] = value
220222
return headers_dict
221223

224+
def _filter_authentication_headers(self, headers):
225+
auth_headers = [HEADER_API_KEY_ATTRIBUTE_NAME, HEADER_ATTRIBUTE_NAME, 'Cookie']
226+
return {key: value for key, value in headers.items() if key not in auth_headers}
227+
222228
def _log_request(self, msg, headers, body, log_method=LOG.debug):
223229
headers = self._get_headers_as_dict(headers)
224230
body = str(body)

st2api/tests/unit/controllers/v1/test_webhooks.py

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,26 @@ def get_webhook_trigger(name, url):
320320
self.assertTrue(controller._is_valid_hook('with_leading_trailing_slash'))
321321
self.assertTrue(controller._is_valid_hook('with/mixed/slash'))
322322

323+
@mock.patch.object(TriggerInstancePublisher, 'publish_trigger', mock.MagicMock(
324+
return_value=True))
325+
@mock.patch.object(WebhooksController, '_is_valid_hook', mock.MagicMock(
326+
return_value=True))
327+
@mock.patch.object(HooksHolder, 'get_triggers_for_hook', mock.MagicMock(
328+
return_value=[DUMMY_TRIGGER_DICT]))
329+
@mock.patch('st2common.transport.reactor.TriggerDispatcher.dispatch')
330+
def test_authentication_headers_should_be_removed(self, dispatch_mock):
331+
headers = {
332+
'Content-Type': 'application/x-www-form-urlencoded',
333+
'St2-Api-Key': 'foobar',
334+
'X-Auth-Token': 'deadbeaf',
335+
'Cookie': 'foo=bar'
336+
}
337+
338+
self.app.post('/v1/webhooks/git', WEBHOOK_1, headers=headers)
339+
self.assertNotIn('St2-Api-Key', dispatch_mock.call_args[1]['payload']['headers'])
340+
self.assertNotIn('X-Auth-Token', dispatch_mock.call_args[1]['payload']['headers'])
341+
self.assertNotIn('Cookie', dispatch_mock.call_args[1]['payload']['headers'])
342+
323343
def __do_post(self, hook, webhook, expect_errors=False, headers=None):
324344
return self.app.post_json('/v1/webhooks/' + hook,
325345
params=webhook,

0 commit comments

Comments
 (0)