[JENKINS-33974] Payload verification using shared secrets#134
[JENKINS-33974] Payload verification using shared secrets#134lanwen merged 2 commits intojenkinsci:masterfrom
Conversation
Current coverage is 75.07% (diff: 86.74%)@@ master #134 diff @@
==========================================
Files 62 64 +2
Lines 1339 1412 +73
Methods 0 0
Messages 0 0
Branches 141 146 +5
==========================================
+ Hits 999 1060 +61
- Misses 296 307 +11
- Partials 44 45 +1
|
452f399 to
b1dae00
Compare
also don't bother signature validation if no header from github with signature
|
This seems to fail for some form encoded payloads, like the one attached below @lanwen. Running |
|
@MartinNowak can you write a test to reproduce? (And may be a full fix?:) |
|
No, too much time already spent on figuring this out, and I'm neither familiar with nor keen to dig further into this mass of Java code/plugins. There isn't much wrong with recommending application/json as workaround, though GH uses application/x-www-form-urlencoded by default which applies to the hooks installed by github-organization (or github-branch-source or github-api or whatever). |
|
Ok, thanks in any case, will try to do something |
|
I'm also still seeing I suspect in my case it's because the branch name contains a |
Closes #129
This change is