From f8515ab5be432e8ff744cfd7c71abd15b968d541 Mon Sep 17 00:00:00 2001
From: Kyle Hornberg <kyle.hornberg@gmail.com>
Date: Tue, 6 Feb 2018 14:18:47 -0600
Subject: [PATCH] Feature: verify webhooks

---
 README.rst                      |   5 ++
 src/octokit/data/events.json    | 121 ++++++++++++++++++++++++++++++++
 src/octokit/utils.py            |   7 ++
 src/octokit/webhook/__init__.py |  21 ++++++
 tests/test_webhook.py           |  38 ++++++++++
 5 files changed, 192 insertions(+)
 create mode 100644 src/octokit/data/events.json
 create mode 100644 src/octokit/webhook/__init__.py
 create mode 100644 tests/test_webhook.py

diff --git a/README.rst b/README.rst
index 0fcc6ec..02dbe06 100644
--- a/README.rst
+++ b/README.rst
@@ -85,6 +85,11 @@ Default values::
 
     TODO Show them
 
+Webhooks::
+
+    from octokit import webhook
+    webhook.verify(headers, payload, secret, events=['push'])
+
 Authentication
 --------------
 
diff --git a/src/octokit/data/events.json b/src/octokit/data/events.json
new file mode 100644
index 0000000..bc0aac8
--- /dev/null
+++ b/src/octokit/data/events.json
@@ -0,0 +1,121 @@
+[
+  "*",
+  "error",
+  "commit_comment",
+  "commit_comment.created",
+  "create",
+  "delete",
+  "deployment",
+  "deployment_status",
+  "fork",
+  "gollum",
+  "installation",
+  "installation_repositories",
+  "installation_repositories.added",
+  "installation_repositories.removed",
+  "installation.created",
+  "installation.deleted",
+  "issue_comment",
+  "issue_comment.created",
+  "issue_comment.deleted",
+  "issue_comment.edited",
+  "issues",
+  "issues.assigned",
+  "issues.closed",
+  "issues.demilestoned",
+  "issues.edited",
+  "issues.labeled",
+  "issues.milestoned",
+  "issues.opened",
+  "issues.reopened",
+  "issues.unassigned",
+  "issues.unlabeled",
+  "label",
+  "label.created",
+  "label.deleted",
+  "label.edited",
+  "marketplace_purchase",
+  "marketplace_purchase.cancelled",
+  "marketplace_purchase.changed",
+  "marketplace_purchase.purchased",
+  "member",
+  "member.added",
+  "member.deleted",
+  "member.edited",
+  "membership",
+  "membership.added",
+  "membership.removed",
+  "milestone",
+  "milestone.closed",
+  "milestone.created",
+  "milestone.deleted",
+  "milestone.edited",
+  "milestone.opened",
+  "org_block",
+  "org_block.blocked",
+  "org_block.unblocked",
+  "organization",
+  "organization.member_added",
+  "organization.member_invited",
+  "organization.member_removed",
+  "page_build",
+  "ping",
+  "project",
+  "project_card",
+  "project_card.closed",
+  "project_card.created",
+  "project_card.deleted",
+  "project_card.edited",
+  "project_card.reopened",
+  "project_column",
+  "project_column.created",
+  "project_column.deleted",
+  "project_column.edited",
+  "project_column.moved",
+  "project.converted",
+  "project.created",
+  "project.deleted",
+  "project.edited",
+  "project.moved",
+  "public",
+  "pull_request",
+  "pull_request_review",
+  "pull_request_review_comment",
+  "pull_request_review_comment.created",
+  "pull_request_review_comment.deleted",
+  "pull_request_review_comment.edited",
+  "pull_request_review.dismissed",
+  "pull_request_review.edited",
+  "pull_request_review.submitted",
+  "pull_request.assigned",
+  "pull_request.closed",
+  "pull_request.edited",
+  "pull_request.labeled",
+  "pull_request.opened",
+  "pull_request.reopened",
+  "pull_request.review_request_removed",
+  "pull_request.review_requested",
+  "pull_request.synchronize",
+  "pull_request.unassigned",
+  "pull_request.unlabeled",
+  "push",
+  "release",
+  "release.published",
+  "repository",
+  "repository.archived",
+  "repository.created",
+  "repository.deleted",
+  "repository.privatized",
+  "repository.publicized",
+  "repository.unarchived",
+  "status",
+  "team",
+  "team_add",
+  "team.added_to_repository",
+  "team.created",
+  "team.deleted",
+  "team.edited",
+  "team.removed_from_repository",
+  "watch",
+  "watch.started"
+]
diff --git a/src/octokit/utils.py b/src/octokit/utils.py
index 36e0af1..ae16379 100644
--- a/src/octokit/utils.py
+++ b/src/octokit/utils.py
@@ -1,3 +1,5 @@
+import json
+import os
 import re
 
 
@@ -6,3 +8,8 @@ def snake_case(string):
         From https://gist.github.com/jaytaylor/3660565#gistcomment-2271689
     """
     return re.compile(r'(?!^)(?<!_)([A-Z])').sub(r'_\1', string).lower()
+
+
+def get_json_data(filename):
+    with open(os.path.join(os.path.dirname(__file__), 'data', 'rest.json'), 'r') as f:
+        return json.load(f)
diff --git a/src/octokit/webhook/__init__.py b/src/octokit/webhook/__init__.py
new file mode 100644
index 0000000..db3c07e
--- /dev/null
+++ b/src/octokit/webhook/__init__.py
@@ -0,0 +1,21 @@
+import hashlib
+import hmac
+import json
+
+from octokit import utils
+
+
+def verify(headers, payload, secret, events=[]):
+    event = headers.get('X-GitHub-Event')
+    if event not in utils.get_json_data('events.json'):
+        return False
+    if event not in events and '*' not in events:
+        return False
+    return _compare(headers, payload, secret)
+
+
+def _compare(headers, payload, secret):
+    encoding = 'utf-8'
+    algo, sig = headers.get('X-Hub-Signature').split('=')
+    digest = hmac.new(secret.encode(encoding), json.dumps(payload).encode(encoding), getattr(hashlib, algo)).hexdigest()
+    return hmac.compare_digest(sig.encode(encoding), digest.encode(encoding))
diff --git a/tests/test_webhook.py b/tests/test_webhook.py
new file mode 100644
index 0000000..797c4c1
--- /dev/null
+++ b/tests/test_webhook.py
@@ -0,0 +1,38 @@
+from octokit import webhook
+
+
+class TestWebhook(object):
+
+    def test_can_verify_webhook(self):
+        headers = {'X-Hub-Signature': 'sha1=5d61605c3feea9799210ddcb71307d4ba264225f', 'X-GitHub-Event': 'push'}
+        payload = {}
+        secret = 'secret'
+        events = ['push']
+        assert webhook.verify(headers, payload, secret, events=events)
+
+    def test_can_filter_webhook_events(self):
+        headers = {'X-Hub-Signature': 'sha1=5d61605c3feea9799210ddcb71307d4ba264225f'}
+        payload = {}
+        secret = 'secret'
+        events = ['push']
+        assert webhook.verify(headers, payload, secret, events=events) is False
+
+    def test_must_specify_events_to_allow(self):
+        headers = {'X-Hub-Signature': 'sha1=5d61605c3feea9799210ddcb71307d4ba264225f'}
+        payload = {}
+        secret = 'secret'
+        assert webhook.verify(headers, payload, secret) is False
+
+    def test_can_specify_all_events(self):
+        headers = {'X-Hub-Signature': 'sha1=5d61605c3feea9799210ddcb71307d4ba264225f', 'X-GitHub-Event': 'push'}
+        payload = {}
+        secret = 'secret'
+        events = ['*']
+        assert webhook.verify(headers, payload, secret, events=events)
+
+    def test_only_known_events_are_valid(self):
+        headers = {'X-Hub-Signature': 'sha1=5d61605c3feea9799210ddcb71307d4ba264225f', 'X-GitHub-Event': 'pushy'}
+        payload = {}
+        secret = 'secret'
+        events = ['pushy']
+        assert webhook.verify(headers, payload, secret, events=events) is False