Skip to content

Fix possible vulnerabilities in webhook proxy #1398

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jorge-romero merged 16 commits into from
Jul 24, 2026
Merged

Fix possible vulnerabilities in webhook proxy #1398

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
0f5541f
Trigger secret won't use a default value
jorge-romero Jul 9, 2026
1aa6307
Add validation for cross-project pull requests in webhook handler
jorge-romero Jul 9, 2026
d60bd7a
Add test for rejecting cross-project pull requests in webhook handler
jorge-romero Jul 9, 2026
20d006b
Update Dockerfile to use specific image digest for ubi-micro and adju…
jorge-romero Jul 9, 2026
521785c
Remove trigger secret from logs.
jorge-romero Jul 9, 2026
cfa2090
Enhance validation and escaping in webhook handler and template proce…
jorge-romero Jul 10, 2026
58d9579
Add validation for jenkinsfile_path parameter in webhook handler
jorge-romero Jul 10, 2026
ceecf02
Validate target project in webhook handler and update test payloads f…
jorge-romero Jul 10, 2026
40347d9
Fix as the cluster assign an user and provides conflicts
jorge-romero Jul 10, 2026
ebd40e9
Add redirect handling to secure HTTP client to prevent token leakage
jorge-romero Jul 13, 2026
f6e8c18
Enhance branch protection checks to be case-insensitive in webhook ha…
jorge-romero Jul 13, 2026
a9d1501
Use constant-time comparison for trigger_secret in webhook handler to…
jorge-romero Jul 13, 2026
9890feb
Edit Changelog
jorge-romero Jul 13, 2026
f5caae5
Fix linting problems in test file.
jorge-romero Jul 13, 2026
0ab87a7
Add IP range validation for webhook requests
jorge-romero Jul 13, 2026
0fefb19
Enhance security
jorge-romero Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
## Unreleased

### Added
- Webhook proxy security enhancements ([#1398](https://github.com/opendevstack/ods-core/pull/1398/))

### Changed

Expand Down
12 changes: 11 additions & 1 deletion jenkins/ocp-config/deploy/jenkins-webhook-proxy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,13 @@ parameters:
- name: MAX_DELETION_CHECKS
value: '10'
required: true
- name: ALLOWED_WEBHOOK_IP_RANGES
description: >-
Comma-separated list of allowed source IP addresses or CIDR ranges for
incoming webhook requests (e.g. "185.166.140.0/22,10.0.0.1").
Leave empty to allow all source IPs.
value: ''
required: true
- name: WEBHOOK_PROXY_CPU_REQUEST
value: 25m
- name: WEBHOOK_PROXY_CPU_LIMIT
Expand Down Expand Up @@ -103,6 +110,8 @@ objects:
value: ${OPENSHIFT_APPS_BASEDOMAIN}
- name: MAX_DELETION_CHECKS
value: ${MAX_DELETION_CHECKS}
- name: ALLOWED_WEBHOOK_IP_RANGES
value: ${ALLOWED_WEBHOOK_IP_RANGES}
- name: TRIGGER_SECRET
valueFrom:
secretKeyRef:
Expand All @@ -123,7 +132,8 @@ objects:
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
securityContext:
runAsNonRoot: true
serviceAccount: '${JENKINS_SERVICE_NAME}'
serviceAccountName: '${JENKINS_SERVICE_NAME}'
terminationGracePeriodSeconds: 30
Expand Down
1 change: 1 addition & 0 deletions jenkins/webhook-proxy/.gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
webhook-proxy_linux_amd64
webhook-proxy_darwin_amd64
webhook-proxy_windows_amd64.exe
local/
4 changes: 3 additions & 1 deletion jenkins/webhook-proxy/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ WORKDIR /home/webhook-proxy
RUN CGO_ENABLED=0 go build -o webhook-proxy

# Final stage
FROM registry.access.redhat.com/ubi9/ubi-micro:latest
FROM registry.access.redhat.com/ubi9/ubi-micro@sha256:35de56a9413112f1474e392ebc35e0cf6f0fb484c8e8877bbae59b513694b41f

# Set default ALLOWED_EXTERNAL_PROJECTS env var
ARG allowedExternalProjects=opendevstack
Expand All @@ -29,6 +29,8 @@ COPY pipeline.json.tmpl /home/webhook-proxy/pipeline.json.tmpl

WORKDIR /home/webhook-proxy

USER 1001

EXPOSE 8080

CMD ./webhook-proxy
Loading
Loading