trusthook/github_test.go at main · eben-vranken/trusthook · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
package trusthook

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"net/http"
	"testing"
)

func TestGithubValidSignature(t *testing.T) {
	secret := "mysecret"
	body := []byte(`{"action":"opened"}`)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	headers := http.Header{}
	sig := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	headers.Set("X-Hub-Signature-256", sig)

	err := Verify(GitHub, body, headers, secret)

	if err != nil {
		t.Errorf("Error returned %s, expected %v", err, nil)
	}
}

func TestGithubMissingHeader(t *testing.T) {
	secret := "mysecret"
	body := []byte(`{"action":"opened"}`)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	headers := http.Header{}
	sig := hex.EncodeToString(mac.Sum(nil))
	headers.Set("X-Hub-Signature", sig)

	err := Verify(GitHub, body, headers, secret)

	if !errors.Is(err, ErrMissingHeader) {
		t.Errorf("Error returned %s, expected %v", err, ErrMissingHeader)
	}
}

func TestGithubMalformedSignature(t *testing.T) {
	secret := "mysecret"
	body := []byte(`{"action":"opened"}`)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	headers := http.Header{}
	sig := "MalformedSignature" + hex.EncodeToString(mac.Sum(nil))
	headers.Set("X-Hub-Signature-256", sig)

	err := Verify(GitHub, body, headers, secret)

	if !errors.Is(err, ErrMalformedSignature) {
		t.Errorf("Error returned %s, expected %v", err, ErrMalformedSignature)
	}
}

func TestGithubBadHexPrefix(t *testing.T) {
	secret := "mysecret"
	body := []byte(`{"action":"opened"}`)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	headers := http.Header{}
	headers.Set("X-Hub-Signature-256", "sha256=ZZZNOTVALIDHEX")

	err := Verify(GitHub, body, headers, secret)

	if !errors.Is(err, ErrMalformedSignature) {
		t.Errorf("Error returned %s, expected %v", err, ErrMalformedSignature)
	}
}

func TestGithubSignatureMismatch(t *testing.T) {
	secret := "mysecret"
	body := []byte(`{"action":"opened"}`)

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	headers := http.Header{}
	sig := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	headers.Set("X-Hub-Signature-256", sig)

	err := Verify(GitHub, body, headers, "DifferentSecret!")

	if !errors.Is(err, ErrSignatureMismatch) {
		t.Errorf("Error returned %s, expected %v", err, ErrSignatureMismatch)
	}
}