add support for verifying a secret key

Author: pietroalbini

README.md

@@ -195,7 +195,7 @@ launching a container from a directory containing a config file, you
 can do the following.
 
 ```
-$ docker run -d --rm --name highfive -p 8000:80 -e HIGHFIVE_GITHUB_TOKEN=token highfive
+$ docker run -d --rm --name highfive -p 8000:80 -e HIGHFIVE_GITHUB_TOKEN=token -e HIGHFIVE_WEBHOOK_SECRET=secret highfive
 ```
 
 At this point, Highfive is accessible at http://localhost:8080.

highfive/app.py

@@ -1,3 +1,5 @@
+import hashlib
+import hmac
 import json
 import sys
 
@@ -11,7 +13,7 @@
 import waitress
 
 
-def create_app(config):
+def create_app(config, webhook_secret=None):
     app = flask.Flask(__name__)
 
     # The canonical URL is /webhook, but other URLs are accepted for backward
@@ -20,6 +22,20 @@ def create_app(config):
     @app.route("/newpr.py", methods=['POST'])
     @app.route("/highfive/newpr.py", methods=['POST'])
     def new_pr():
+        raw_data = flask.request.get_data()
+
+        # Check the signature only if the secret is configured
+        if 'payload' in flask.request.form and webhook_secret is not None:
+            expected = hmac.new(str(webhook_secret), digestmod=hashlib.sha1)
+            expected.update(raw_data)
+            expected = expected.hexdigest()
+            try:
+                signature = str(flask.request.headers['X-Hub-Signature'])
+            except KeyError:
+                return 'Error: missing signature\n', 400
+            if not hmac.compare_digest('sha1='+expected, signature):
+                return 'Error: invalid signature\n', 403
+
         try:
             payload = json.loads(flask.request.form['payload'])
         except (KeyError, ValueError), _:
@@ -40,15 +56,16 @@ def index():
 @click.command()
 @click.option('--port', default=8000)
 @click.option('--github-token', required=True)
-def cli(port, github_token):
+@click.option("--webhook-secret")
+def cli(port, github_token, webhook_secret):
     try:
         config = Config(github_token)
     except InvalidTokenException:
         print 'error: invalid github token provided!'
         sys.exit(1)
     print 'Found a valid GitHub token for user @' + config.github_username
 
-    app = create_app(config)
+    app = create_app(config, webhook_secret)
     waitress.serve(app, port=port)