bingshuo/guanghulab
1
0
Fork 0
Code Issues 2 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: Git Sync Webhook 签名验证 — 使用 raw body 替代 JSON.stringify

Browse Source
This commit is contained in:
铸渊 (ICE-GL-ZY001) 2026-05-13 04:49:26 +00:00
parent d884d3ced2
commit e985225095
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
server/git-sync/server.js
View File

@ -29,7 +29,14 @@ const fs = require("fs");
const path = require("path"); const path = require("path");
const app = express(); const app = express();
app.use(express.json({ limit: "1mb" }));
// 捕获 raw body 用于 Webhook 签名验证
app.use(express.json({
limit: "1mb",
verify: (req, _res, buf) => {
req.rawBody = buf.toString("utf8");
}
}));
// ─── 配置 ───────────────────────────────────────────────────── // ─── 配置 ─────────────────────────────────────────────────────
const CONFIG = { const CONFIG = {
@ -201,7 +208,8 @@ async function syncWithRetry(commitSha, committer, message) {
// Webhook 接收端点 // Webhook 接收端点
app.post("/webhook", async (req, res) => { app.post("/webhook", async (req, res) => {
const signature = req.headers["x-gitea-signature"] || req.headers["x-hub-signature-256"] || ""; const signature = req.headers["x-gitea-signature"] || req.headers["x-hub-signature-256"] || "";
const payload = JSON.stringify(req.body); // 使用 raw body 验证签名（Express JSON 解析后 stringify 会和原始 body 不一致）
const payload = req.rawBody || JSON.stringify(req.body);
// 验证签名 // 验证签名
if (!verifyWebhook(payload, signature)) { if (!verifyWebhook(payload, signature)) {