Verify GitLab headers on push webhook

Gitlab sends the 'X-Gitlab-Event' header for all the webhook requests. Verify it so we reduce the chance that robots call the hooks accidentally. Signed off by: Daniel Miranda <danielkza2@gmail.com>

Verify GitLab headers on push webhook
Gitlab sends the 'X-Gitlab-Event' header for all the webhook requests. Verify it so we reduce the chance that robots call the hooks accidentally. Signed off by: Daniel Miranda <danielkza2@gmail.com>
Heitor
1 parent bd6b0bc9
Showing 2 changed files with 27 additions and 12 deletions Show diff stats
app/controllers/repositories_controller.rb
spec/controllers/repositories_controller_spec.rb
@@ -97,13 +97,17 @@ class RepositoriesController &lt; ApplicationController
   end
   def notify_push
+    gitlab_event = request.headers['X-Gitlab-Event']
+    if gitlab_event.nil? || !gitlab_event.end_with?('Push Hook')
+      return render nothing: true, status: :unprocessable_entity
+    end
     set_repository
-    @repository.cancel_processing_of_repository if @repository.last_processing_state.end_with? 'ING'
+    @repository.cancel_processing_of_repository unless %w(READY, ERROR).include? @repository.last_processing_state
     @repository.process
-    render :nothing => true, :status => :ok
+    render nothing: true, status: :ok
   end
-private
+  private
   def set_project_id_repository_types_and_configurations
     @project_id = params[:project_id]
     @repository_types = Repository.repository_types
@@ -475,9 +475,14 @@ describe RepositoriesController, :type =&gt; :controller do
   end
   describe 'notify_push' do
-    context 'with a valid repository' do
-      let(:repository) { FactoryGirl.build(:repository) }
+    let(:repository) { FactoryGirl.build(:repository) }
+    def post_push
+      @request.env['HTTP_X_GITLAB_EVENT'] = ['Push Hook', 'Tag Push Hook'].sample
+      post :notify_push, id: repository.id
+    end
+
+    context 'with a valid repository' do
       before :each do
         Repository.expects(:find).with(repository.id).returns(repository)
       end
@@ -487,7 +492,7 @@ describe RepositoriesController, :type =&gt; :controller do
           repository.expects(:last_processing_state).returns('INTERPRETING')
           repository.expects(:cancel_processing_of_repository).once
           repository.expects(:process).once
-          post :notify_push, id: repository.id
+          post_push
         end
         it { is_expected.to respond_with(:ok) }
@@ -497,7 +502,7 @@ describe RepositoriesController, :type =&gt; :controller do
         before do
           repository.expects(:last_processing_state).returns('ERROR')
           repository.expects(:process).once
-          post :notify_push, id: repository.id
+          post_push
         end
         it { is_expected.to respond_with(:ok) }
@@ -507,7 +512,7 @@ describe RepositoriesController, :type =&gt; :controller do
         before do
           repository.expects(:last_processing_state).returns('READY')
           repository.expects(:process).once
-          post :notify_push, id: repository.id
+          post_push
         end
         it { is_expected.to respond_with(:ok) }
@@ -515,14 +520,20 @@ describe RepositoriesController, :type =&gt; :controller do
     end
     context 'with an invalid repository' do
-      let(:repository_id) { 1 }
-
       before :each do
-        Repository.expects(:find).with(repository_id).raises(KalibroClient::Errors::RecordNotFound)
-        post :notify_push, id: repository_id
+        Repository.expects(:find).with(repository.id).raises(KalibroClient::Errors::RecordNotFound)
+        post_push
       end
       it { is_expected.to respond_with(:not_found) }
     end
+
+    context 'with an invalid header' do
+      before :each do
+        post :notify_push, id: repository.id
+      end
+
+      it { is_expected.to respond_with(:unprocessable_entity) }
+    end
   end
 end