geckoboard / cake-bot Goto Github PK

Seems to only label PRs after a comment has been made on the pr.

Hey guys,

Great work on the bot! 😃 🎉 🍰

I'm in the process of creating a GitHub App when I came across this bot.
While reading the codebase, I noticed that we are not validating whether the webhook request received by the bot is actually triggered by a GitHub WebHook or not. This could lead to a minor security issue if one could find the payload URL and send custom POST requests to the /github endpoint. Setting a webhook secret (in the bot's configuration) allows us to ensure that POST requests sent to the payload URL are from GitHub.

Given that the bot no longer uses go-github, we would have to write our own HMAC authenticator for validating the incoming request. As the guide suggests, we would also require a new environment variable (let's call it GITHUB_SECRET) to be set, possibly in main.go.

Just let me know if you consider this to be useful, and I would be happy to add the functionality and contribute to the cake-bot. 😄

Refer: Securing your webhooks