Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement escaping of webhook params #74

Closed
416rehman opened this issue Jan 31, 2023 · 0 comments · Fixed by #400
Closed

Implement escaping of webhook params #74

416rehman opened this issue Jan 31, 2023 · 0 comments · Fixed by #400
Labels
area: devOps Services/tools that are not our main functionality, but help the project category: deployment Related to building our local code into a working unit

Comments

@416rehman
Copy link

When serving webhooks with user provided data, such as the deploy webhook, we want the received webhook parameters to be properly escaped.

This can be done by providing each argument to the printf utility with a '%q' specifier.

printf %q "$ARG1"

This will print a properly escaped value of $ARG1 by escaping all special characters such as quotes, slashes, etc in the $ARG1 variable.

The webhook image we are running is a based on Alpine and does not contain most GNU tools, therefore the printf utility in the image does not support %q specifier.

https://www.shellcheck.net/wiki/SC3050

The webhook/hooks directory contains scripts for all the webhooks, it also houses utility scripts, prefixed with a . such as .authenticate.sh, consider creating a .escape.sh script to achieve the functionality of printf %q to be used in the webhook scripts.

@humphd humphd added the category: deployment Related to building our local code into a working unit label Feb 1, 2023
@sirinoks sirinoks added the area: devOps Services/tools that are not our main functionality, but help the project label Feb 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: devOps Services/tools that are not our main functionality, but help the project category: deployment Related to building our local code into a working unit
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants