feat(bitbucket): check bitbucket webhook signature if webhook_secret is defined #82541
Conversation
github-actions
bot
added
the
Scope: Backend
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| try: | ||
| event_handler(request, organization, event) | ||
| except WebhookSignatureException as e: | ||
| return HttpResponse(str(e), status=400) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 days ago
To fix the problem, we should avoid returning the exception message directly to the user. Instead, we should log the exception message on the server and return a generic error message to the user. This way, developers can still access the detailed error information from the logs, but external users will not see any sensitive information.
We need to modify the code in the post method of the BitbucketWebhookEndpoint class to log the exception message and return a generic error message. We will use the existing logger to log the exception and return a generic error response.
| @@ -250,3 +250,8 @@ | ||
| except WebhookSignatureException as e: | ||
| return HttpResponse(str(e), status=400) | ||
| logger.exception( | ||
| "%s.webhook.signature-exception", | ||
| PROVIDER_NAME, | ||
| extra={"organization_id": organization.id, "error": str(e)}, | ||
| ) | ||
| return HttpResponse("An error occurred while processing the webhook.", status=400) | ||
|
|
Preparing Bitbucket webhook secret validation. This is actual signature header validation, but no integrations/repos have the associated secret yet.
TODO in the follow-up PRs:
webhook_secretin repo.config