diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8002004d1..784f7836f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -56,7 +56,7 @@ atlantis server --gh-user --gh-token --repo-whiteli ``` ngrok http 4141 ``` -- Create a WebHook in your repo and use the `https` url that `ngrok` printed out after running `ngrok http 4141`. Be sure to append `/events` so your webhook url looks something like `https://efce3bcd.ngrok.io/events`. See [Add GitHub Webhook](https://github.com/runatlantis/atlantis#add-github-webhook). +- Create a Webhook in your repo and use the `https` url that `ngrok` printed out after running `ngrok http 4141`. Be sure to append `/events` so your webhook url looks something like `https://efce3bcd.ngrok.io/events`. See [Add GitHub Webhook](https://github.com/runatlantis/atlantis#add-github-webhook). - Create a pull request and type `atlantis help`. You should see the request in the `ngrok` and Atlantis logs and you should also see Atlantis comment back. ## Code Style diff --git a/cmd/server.go b/cmd/server.go index a6451c806..75567eea1 100644 --- a/cmd/server.go +++ b/cmd/server.go @@ -44,11 +44,11 @@ const ( GHHostnameFlag = "gh-hostname" GHTokenFlag = "gh-token" GHUserFlag = "gh-user" - GHWebHookSecret = "gh-webhook-secret" // nolint: gosec + GHWebhookSecret = "gh-webhook-secret" // nolint: gosec GitlabHostnameFlag = "gitlab-hostname" GitlabTokenFlag = "gitlab-token" GitlabUserFlag = "gitlab-user" - GitlabWebHookSecret = "gitlab-webhook-secret" // nolint: gosec + GitlabWebhookSecret = "gitlab-webhook-secret" // nolint: gosec LogLevelFlag = "log-level" PortFlag = "port" RepoWhitelistFlag = "repo-whitelist" @@ -109,7 +109,7 @@ var stringFlags = []stringFlag{ description: "GitHub token of API user. Can also be specified via the ATLANTIS_GH_TOKEN environment variable.", }, { - name: GHWebHookSecret, + name: GHWebhookSecret, description: "Secret used to validate GitHub webhooks (see https://developer.github.com/webhooks/securing/)." + " SECURITY WARNING: If not specified, Atlantis won't be able to validate that the incoming webhook call came from GitHub. " + "This means that an attacker could spoof calls to Atlantis and cause it to perform malicious actions. " + @@ -129,7 +129,7 @@ var stringFlags = []stringFlag{ description: "GitLab token of API user. Can also be specified via the ATLANTIS_GITLAB_TOKEN environment variable.", }, { - name: GitlabWebHookSecret, + name: GitlabWebhookSecret, description: "Optional secret used to validate GitLab webhooks." + " SECURITY WARNING: If not specified, Atlantis won't be able to validate that the incoming webhook call came from GitLab. " + "This means that an attacker could spoof calls to Atlantis and cause it to perform malicious actions. " + @@ -434,10 +434,10 @@ func (s *ServerCmd) trimAtSymbolFromUsers(userConfig *server.UserConfig) { } func (s *ServerCmd) securityWarnings(userConfig *server.UserConfig) { - if userConfig.GithubUser != "" && userConfig.GithubWebHookSecret == "" && !s.SilenceOutput { + if userConfig.GithubUser != "" && userConfig.GithubWebhookSecret == "" && !s.SilenceOutput { fmt.Fprintf(os.Stderr, "%s[WARN] No GitHub webhook secret set. This could allow attackers to spoof requests from GitHub.%s\n", RedTermStart, RedTermEnd) } - if userConfig.GitlabUser != "" && userConfig.GitlabWebHookSecret == "" && !s.SilenceOutput { + if userConfig.GitlabUser != "" && userConfig.GitlabWebhookSecret == "" && !s.SilenceOutput { fmt.Fprintf(os.Stderr, "%s[WARN] No GitLab webhook secret set. This could allow attackers to spoof requests from GitLab.%s\n", RedTermStart, RedTermEnd) } if userConfig.BitbucketUser != "" && userConfig.BitbucketHostname == DefaultBitbucketHostname && !s.SilenceOutput { diff --git a/cmd/server_test.go b/cmd/server_test.go index 017c87a6a..71d52305b 100644 --- a/cmd/server_test.go +++ b/cmd/server_test.go @@ -334,11 +334,11 @@ func TestExecute_Defaults(t *testing.T) { Equals(t, "github.com", passedConfig.GithubHostname) Equals(t, "token", passedConfig.GithubToken) Equals(t, "user", passedConfig.GithubUser) - Equals(t, "", passedConfig.GithubWebHookSecret) + Equals(t, "", passedConfig.GithubWebhookSecret) Equals(t, "gitlab.com", passedConfig.GitlabHostname) Equals(t, "gitlab-token", passedConfig.GitlabToken) Equals(t, "gitlab-user", passedConfig.GitlabUser) - Equals(t, "", passedConfig.GitlabWebHookSecret) + Equals(t, "", passedConfig.GitlabWebhookSecret) Equals(t, "bitbucket.org", passedConfig.BitbucketHostname) Equals(t, "bitbucket-token", passedConfig.BitbucketToken) Equals(t, "bitbucket-user", passedConfig.BitbucketUser) @@ -432,11 +432,11 @@ func TestExecute_Flags(t *testing.T) { cmd.GHHostnameFlag: "ghhostname", cmd.GHTokenFlag: "token", cmd.GHUserFlag: "user", - cmd.GHWebHookSecret: "secret", + cmd.GHWebhookSecret: "secret", cmd.GitlabHostnameFlag: "gitlab-hostname", cmd.GitlabTokenFlag: "gitlab-token", cmd.GitlabUserFlag: "gitlab-user", - cmd.GitlabWebHookSecret: "gitlab-secret", + cmd.GitlabWebhookSecret: "gitlab-secret", cmd.LogLevelFlag: "debug", cmd.PortFlag: 8181, cmd.RepoWhitelistFlag: "github.com/runatlantis/atlantis", @@ -456,11 +456,11 @@ func TestExecute_Flags(t *testing.T) { Equals(t, "ghhostname", passedConfig.GithubHostname) Equals(t, "token", passedConfig.GithubToken) Equals(t, "user", passedConfig.GithubUser) - Equals(t, "secret", passedConfig.GithubWebHookSecret) + Equals(t, "secret", passedConfig.GithubWebhookSecret) Equals(t, "gitlab-hostname", passedConfig.GitlabHostname) Equals(t, "gitlab-token", passedConfig.GitlabToken) Equals(t, "gitlab-user", passedConfig.GitlabUser) - Equals(t, "gitlab-secret", passedConfig.GitlabWebHookSecret) + Equals(t, "gitlab-secret", passedConfig.GitlabWebhookSecret) Equals(t, "debug", passedConfig.LogLevel) Equals(t, 8181, passedConfig.Port) Equals(t, "github.com/runatlantis/atlantis", passedConfig.RepoWhitelist) @@ -509,11 +509,11 @@ ssl-key-file: key-file Equals(t, "ghhostname", passedConfig.GithubHostname) Equals(t, "token", passedConfig.GithubToken) Equals(t, "user", passedConfig.GithubUser) - Equals(t, "secret", passedConfig.GithubWebHookSecret) + Equals(t, "secret", passedConfig.GithubWebhookSecret) Equals(t, "gitlab-hostname", passedConfig.GitlabHostname) Equals(t, "gitlab-token", passedConfig.GitlabToken) Equals(t, "gitlab-user", passedConfig.GitlabUser) - Equals(t, "gitlab-secret", passedConfig.GitlabWebHookSecret) + Equals(t, "gitlab-secret", passedConfig.GitlabWebhookSecret) Equals(t, "debug", passedConfig.LogLevel) Equals(t, 8181, passedConfig.Port) Equals(t, "github.com/runatlantis/atlantis", passedConfig.RepoWhitelist) @@ -587,11 +587,11 @@ ssl-key-file: key-file Equals(t, "override-gh-hostname", passedConfig.GithubHostname) Equals(t, "override-gh-token", passedConfig.GithubToken) Equals(t, "override-gh-user", passedConfig.GithubUser) - Equals(t, "override-gh-webhook-secret", passedConfig.GithubWebHookSecret) + Equals(t, "override-gh-webhook-secret", passedConfig.GithubWebhookSecret) Equals(t, "override-gitlab-hostname", passedConfig.GitlabHostname) Equals(t, "override-gitlab-token", passedConfig.GitlabToken) Equals(t, "override-gitlab-user", passedConfig.GitlabUser) - Equals(t, "override-gitlab-webhook-secret", passedConfig.GitlabWebHookSecret) + Equals(t, "override-gitlab-webhook-secret", passedConfig.GitlabWebhookSecret) Equals(t, "info", passedConfig.LogLevel) Equals(t, 8282, passedConfig.Port) Equals(t, "override,override", passedConfig.RepoWhitelist) @@ -636,11 +636,11 @@ ssl-key-file: key-file cmd.GHHostnameFlag: "override-gh-hostname", cmd.GHTokenFlag: "override-gh-token", cmd.GHUserFlag: "override-gh-user", - cmd.GHWebHookSecret: "override-gh-webhook-secret", + cmd.GHWebhookSecret: "override-gh-webhook-secret", cmd.GitlabHostnameFlag: "override-gitlab-hostname", cmd.GitlabTokenFlag: "override-gitlab-token", cmd.GitlabUserFlag: "override-gitlab-user", - cmd.GitlabWebHookSecret: "override-gitlab-webhook-secret", + cmd.GitlabWebhookSecret: "override-gitlab-webhook-secret", cmd.LogLevelFlag: "info", cmd.PortFlag: 8282, cmd.RepoWhitelistFlag: "override,override", @@ -658,11 +658,11 @@ ssl-key-file: key-file Equals(t, "override-gh-hostname", passedConfig.GithubHostname) Equals(t, "override-gh-token", passedConfig.GithubToken) Equals(t, "override-gh-user", passedConfig.GithubUser) - Equals(t, "override-gh-webhook-secret", passedConfig.GithubWebHookSecret) + Equals(t, "override-gh-webhook-secret", passedConfig.GithubWebhookSecret) Equals(t, "override-gitlab-hostname", passedConfig.GitlabHostname) Equals(t, "override-gitlab-token", passedConfig.GitlabToken) Equals(t, "override-gitlab-user", passedConfig.GitlabUser) - Equals(t, "override-gitlab-webhook-secret", passedConfig.GitlabWebHookSecret) + Equals(t, "override-gitlab-webhook-secret", passedConfig.GitlabWebhookSecret) Equals(t, "info", passedConfig.LogLevel) Equals(t, 8282, passedConfig.Port) Equals(t, "override,override", passedConfig.RepoWhitelist) @@ -709,11 +709,11 @@ func TestExecute_FlagEnvVarOverride(t *testing.T) { cmd.GHHostnameFlag: "override-gh-hostname", cmd.GHTokenFlag: "override-gh-token", cmd.GHUserFlag: "override-gh-user", - cmd.GHWebHookSecret: "override-gh-webhook-secret", + cmd.GHWebhookSecret: "override-gh-webhook-secret", cmd.GitlabHostnameFlag: "override-gitlab-hostname", cmd.GitlabTokenFlag: "override-gitlab-token", cmd.GitlabUserFlag: "override-gitlab-user", - cmd.GitlabWebHookSecret: "override-gitlab-webhook-secret", + cmd.GitlabWebhookSecret: "override-gitlab-webhook-secret", cmd.LogLevelFlag: "info", cmd.PortFlag: 8282, cmd.RepoWhitelistFlag: "override,override", @@ -733,11 +733,11 @@ func TestExecute_FlagEnvVarOverride(t *testing.T) { Equals(t, "override-gh-hostname", passedConfig.GithubHostname) Equals(t, "override-gh-token", passedConfig.GithubToken) Equals(t, "override-gh-user", passedConfig.GithubUser) - Equals(t, "override-gh-webhook-secret", passedConfig.GithubWebHookSecret) + Equals(t, "override-gh-webhook-secret", passedConfig.GithubWebhookSecret) Equals(t, "override-gitlab-hostname", passedConfig.GitlabHostname) Equals(t, "override-gitlab-token", passedConfig.GitlabToken) Equals(t, "override-gitlab-user", passedConfig.GitlabUser) - Equals(t, "override-gitlab-webhook-secret", passedConfig.GitlabWebHookSecret) + Equals(t, "override-gitlab-webhook-secret", passedConfig.GitlabWebhookSecret) Equals(t, "info", passedConfig.LogLevel) Equals(t, 8282, passedConfig.Port) Equals(t, "override,override", passedConfig.RepoWhitelist) diff --git a/server/events_controller.go b/server/events_controller.go index 9f9059b02..7293b9b42 100644 --- a/server/events_controller.go +++ b/server/events_controller.go @@ -44,16 +44,16 @@ type EventsController struct { Logger *logging.SimpleLogger Parser events.EventParsing CommentParser events.CommentParsing - // GithubWebHookSecret is the secret added to this webhook via the GitHub + // GithubWebhookSecret is the secret added to this webhook via the GitHub // UI that identifies this call as coming from GitHub. If empty, no // request validation is done. - GithubWebHookSecret []byte + GithubWebhookSecret []byte GithubRequestValidator GithubRequestValidator GitlabRequestParserValidator GitlabRequestParserValidator - // GitlabWebHookSecret is the secret added to this webhook via the GitLab + // GitlabWebhookSecret is the secret added to this webhook via the GitLab // UI that identifies this call as coming from GitLab. If empty, no // request validation is done. - GitlabWebHookSecret []byte + GitlabWebhookSecret []byte RepoWhitelistChecker *events.RepoWhitelistChecker // SupportedVCSHosts is which VCS hosts Atlantis was configured upon // startup to support. @@ -106,7 +106,7 @@ func (e *EventsController) Post(w http.ResponseWriter, r *http.Request) { func (e *EventsController) handleGithubPost(w http.ResponseWriter, r *http.Request) { // Validate the request against the optional webhook secret. - payload, err := e.GithubRequestValidator.Validate(r, e.GithubWebHookSecret) + payload, err := e.GithubRequestValidator.Validate(r, e.GithubWebhookSecret) if err != nil { e.respond(w, logging.Warn, http.StatusBadRequest, err.Error()) return @@ -294,7 +294,7 @@ func (e *EventsController) handlePullRequestEvent(w http.ResponseWriter, baseRep } func (e *EventsController) handleGitlabPost(w http.ResponseWriter, r *http.Request) { - event, err := e.GitlabRequestParserValidator.ParseAndValidate(r, e.GitlabWebHookSecret) + event, err := e.GitlabRequestParserValidator.ParseAndValidate(r, e.GitlabWebhookSecret) if err != nil { e.respond(w, logging.Warn, http.StatusBadRequest, err.Error()) return diff --git a/server/events_controller_e2e_test.go b/server/events_controller_e2e_test.go index fa39a7cc2..a54926506 100644 --- a/server/events_controller_e2e_test.go +++ b/server/events_controller_e2e_test.go @@ -301,10 +301,10 @@ func setupE2E(t *testing.T) (server.EventsController, *vcsmocks.MockClientProxy, Logger: logger, Parser: eventParser, CommentParser: commentParser, - GithubWebHookSecret: nil, + GithubWebhookSecret: nil, GithubRequestValidator: &server.DefaultGithubRequestValidator{}, GitlabRequestParserValidator: &server.DefaultGitlabRequestParserValidator{}, - GitlabWebHookSecret: nil, + GitlabWebhookSecret: nil, RepoWhitelistChecker: repoWhitelistChecker, SupportedVCSHosts: []models.VCSHostType{models.Gitlab, models.Github, models.BitbucketCloud}, VCSClient: e2eVCSClient, diff --git a/server/events_controller_test.go b/server/events_controller_test.go index a3bda4b43..163116cee 100644 --- a/server/events_controller_test.go +++ b/server/events_controller_test.go @@ -528,9 +528,9 @@ func setup(t *testing.T) (server.EventsController, *mocks.MockGithubRequestValid CommentParser: cp, CommandRunner: cr, PullCleaner: c, - GithubWebHookSecret: secret, + GithubWebhookSecret: secret, SupportedVCSHosts: []models.VCSHostType{models.Github, models.Gitlab}, - GitlabWebHookSecret: secret, + GitlabWebhookSecret: secret, GitlabRequestParserValidator: gl, RepoWhitelistChecker: repoWhitelistChecker, VCSClient: vcsmock, diff --git a/server/server.go b/server/server.go index 63af666e5..c4d7bb1f6 100644 --- a/server/server.go +++ b/server/server.go @@ -92,11 +92,11 @@ type UserConfig struct { GithubHostname string `mapstructure:"gh-hostname"` GithubToken string `mapstructure:"gh-token"` GithubUser string `mapstructure:"gh-user"` - GithubWebHookSecret string `mapstructure:"gh-webhook-secret"` + GithubWebhookSecret string `mapstructure:"gh-webhook-secret"` GitlabHostname string `mapstructure:"gitlab-hostname"` GitlabToken string `mapstructure:"gitlab-token"` GitlabUser string `mapstructure:"gitlab-user"` - GitlabWebHookSecret string `mapstructure:"gitlab-webhook-secret"` + GitlabWebhookSecret string `mapstructure:"gitlab-webhook-secret"` LogLevel string `mapstructure:"log-level"` Port int `mapstructure:"port"` RepoWhitelist string `mapstructure:"repo-whitelist"` @@ -319,10 +319,10 @@ func NewServer(userConfig UserConfig, config Config) (*Server, error) { Parser: eventParser, CommentParser: commentParser, Logger: logger, - GithubWebHookSecret: []byte(userConfig.GithubWebHookSecret), + GithubWebhookSecret: []byte(userConfig.GithubWebhookSecret), GithubRequestValidator: &DefaultGithubRequestValidator{}, GitlabRequestParserValidator: &DefaultGitlabRequestParserValidator{}, - GitlabWebHookSecret: []byte(userConfig.GitlabWebHookSecret), + GitlabWebhookSecret: []byte(userConfig.GitlabWebhookSecret), RepoWhitelistChecker: repoWhitelist, SupportedVCSHosts: supportedVCSHosts, VCSClient: vcsClient,