fix(events,github): fixes signature validation by using raw req body

Adds raw body information (body as buffer, encoding)
to `RequestDetails` to support more request validation
use cases.

Additionally, uses the raw body to retrieve the transmitted
JSON string unparsed/raw to correctly validate the signature.

Previously, we re-stringified the parsed JSON payload
which could lead to different JSON strings.
Those differences can lead to the rejection of requests
due to a mismatch in expected signature.

Fixes: #26709
Relates-to: PR #26884
Co-authored-by: Christopher Diaz <cdiaz@rvohealth.com>
Signed-off-by: Patrick Jungermann <Patrick.Jungermann@gmail.com>
This commit is contained in:
Patrick Jungermann
2024-10-14 19:52:54 +02:00
parent b1dbdddc87
commit 9816f510dc
15 changed files with 293 additions and 46 deletions
+2
View File
@@ -61,6 +61,7 @@
"@backstage/plugin-events-node": "workspace:^",
"@backstage/types": "workspace:^",
"@types/express": "^4.17.6",
"content-type": "^1.0.5",
"express": "^4.17.1",
"express-promise-router": "^4.1.0",
"knex": "^3.0.0",
@@ -73,6 +74,7 @@
"@backstage/cli": "workspace:^",
"@backstage/plugin-events-backend-test-utils": "workspace:^",
"@backstage/repo-tools": "workspace:^",
"@types/content-type": "^1.1.8",
"supertest": "^7.0.0"
},
"configSchema": "config.d.ts"