-
Notifications
You must be signed in to change notification settings - Fork 1
fix: Fix 2 template properties deserialization WPB-28090 #138
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
db9fdf8
fix: Fix 2 template properties deserialization WPB-28090
spoonman01 edd35ca
Switch to sender.login
spoonman01 8ea39c2
Use the same format for all templates
spoonman01 8415c2b
Ignore submitted if review.body is missing (happens when it's not a f…
spoonman01 1e2f6fe
Baris comments, moving dynamic text at the end, avoid PR title duplic…
spoonman01 8eef285
Change emoji by state, tweak message of PR review submitted
spoonman01 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| name: Build | ||
| name: Staging | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7 changes: 0 additions & 7 deletions
7
src/main/resources/templates/en/commit_comment.created.template
This file was deleted.
Oops, something went wrong.
11 changes: 5 additions & 6 deletions
11
src/main/resources/templates/en/issue_comment.created.template
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,5 @@ | ||
| **[{{repository.fullName}}]** New comment by **{{sender.login}}** on issue **{{{issue.title}}}** | ||
|
|
||
| {{{comment.body}}} | ||
|
|
||
| [comment]({{comment.htmlUrl}}) | ||
| — | ||
| 📝 **New comment** on PR/issue **{{{issue.title}}}** by **{{sender.login}}** | ||
| **Repository:** {{repository.fullName}} | ||
| **PR/issue:** [#{{issue.number}}]({{issue.htmlUrl}}) - {{issue.title}} | ||
| **Comment:** [link]({{comment.htmlUrl}}) | ||
| **Text:** {{{comment.body}}} |
3 changes: 3 additions & 0 deletions
3
src/main/resources/templates/en/pull_request.ready_for_review.template
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| 🟢 **New Pull Request Ready for Review!** by **{{sender.login}}** | ||
| **Repository:** {{repository.fullName}} | ||
| **PR:** [#{{pullRequest.number}}]({{pullRequest.htmlUrl}}) - {{pullRequest.title}} |
3 changes: 3 additions & 0 deletions
3
src/main/resources/templates/en/pull_request.reopened.template
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| 🟢 **New Pull Request Reopened!** by **{{sender.login}}** | ||
| **Repository:** {{repository.fullName}} | ||
| **PR:** [#{{pullRequest.number}}]({{pullRequest.htmlUrl}}) - {{pullRequest.title}} |
12 changes: 6 additions & 6 deletions
12
src/main/resources/templates/en/pull_request_review.submitted.template
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| {{#review.body}}**[{{repository.fullName}}]** Pull request review **{{pullRequest.title}}** was {{action}} by **{{review.user.login}}** | ||
|
|
||
| {{{review.body}}} | ||
|
|
||
| [pull request]({{pullRequest.htmlUrl}}) | ||
| —{{/review.body}} | ||
| {{#review.body}} | ||
| {{review.emoji}} **Pull request** update: **{{review.state}}** by **{{review.user.login}}** | ||
| **Repository:** {{repository.fullName}} | ||
| **PR:** [#{{pullRequest.number}}]({{pullRequest.htmlUrl}}) - {{pullRequest.title}} | ||
| **Text:** {{{review.body}}} | ||
| {{/review.body}} |
11 changes: 5 additions & 6 deletions
11
src/main/resources/templates/en/pull_request_review_comment.created.template
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,5 @@ | ||
| **[{{repository.fullName}}]** Pull request review **{{pullRequest.title}}** was commented by **{{comment.user.login}}** | ||
|
|
||
| {{{comment.body}}} | ||
|
|
||
| [comment]({{comment.htmlUrl}}) | ||
| — | ||
| 📝 **Pull request** was **commented** by **{{comment.user.login}}** | ||
| **Repository:** {{repository.fullName}} | ||
| **PR:** [#{{pullRequest.number}}]({{pullRequest.htmlUrl}}) - {{pullRequest.title}} | ||
| **Comment:** [link]({{comment.htmlUrl}}) | ||
| **Text:** {{{comment.body}}} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,8 @@ | ||
| {{^commits.isEmpty}} | ||
| **[{{repository.fullName}}]** Push by **{{sender.login}}** | ||
|
|
||
| 🫸 **Push** by **{{sender.login}}** | ||
| **Repository:** {{repository.fullName}} | ||
| {{#commits}} | ||
| - {{{message}}} | ||
| {{/commits}} | ||
|
|
||
| [compare]({{compare}}) | ||
| **Compare:** [link]({{compare}}) | ||
| —{{/commits.isEmpty}} |
127 changes: 127 additions & 0 deletions
127
src/test/kotlin/com/wire/github/util/TemplateHandlerTest.kt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,127 @@ | ||
| package com.wire.github.util | ||
|
|
||
| import com.wire.github.response.model.Commit | ||
| import com.wire.github.response.model.GitHubResponse | ||
| import com.wire.github.response.model.PullRequest | ||
| import com.wire.github.response.model.Repository | ||
| import com.wire.github.response.model.Review | ||
| import com.wire.github.response.model.User | ||
| import kotlin.test.Test | ||
| import kotlin.test.assertContains | ||
| import kotlin.test.assertNull | ||
|
|
||
| class TemplateHandlerTest { | ||
| private val templateHandler = TemplateHandler() | ||
|
|
||
| @Test | ||
| fun `does not render a submitted pull request review without a body`() { | ||
| val message = templateHandler.handleEvent( | ||
| event = "pull_request_review", | ||
| response = reviewResponse(body = null) | ||
| ) | ||
|
|
||
| assertNull(message) | ||
| } | ||
|
|
||
| @Test | ||
| fun `does not render a submitted pull request review with a blank body`() { | ||
| val message = templateHandler.handleEvent( | ||
| event = "pull_request_review", | ||
| response = reviewResponse(body = "") | ||
| ) | ||
|
|
||
| assertNull(message) | ||
| } | ||
|
|
||
| @Test | ||
| fun `renders a submitted pull request review with a body`() { | ||
| val message = templateHandler.handleEvent( | ||
| event = "pull_request_review", | ||
| response = reviewResponse(body = "Looks good") | ||
| ) | ||
|
|
||
| assertContains(message.orEmpty(), "Looks good") | ||
| assertContains(message.orEmpty(), "✅") | ||
| } | ||
|
|
||
| @Test | ||
| fun `renders a note emoji for a commented pull request review`() { | ||
| val message = templateHandler.handleEvent( | ||
| event = "pull_request_review", | ||
| response = reviewResponse(body = "A comment", state = "commented") | ||
| ) | ||
|
|
||
| assertContains(message.orEmpty(), "📝") | ||
| } | ||
|
|
||
| @Test | ||
| fun `renders a change emoji for a pull request review with requested changes`() { | ||
| val message = templateHandler.handleEvent( | ||
| event = "pull_request_review", | ||
| response = reviewResponse(body = "Please update this", state = "changes_requested") | ||
| ) | ||
|
|
||
| assertContains(message.orEmpty(), "🔄") | ||
| } | ||
|
|
||
| @Test | ||
| fun `does not render a push with no commits`() { | ||
| val message = templateHandler.handleEvent( | ||
| event = "push", | ||
| response = pushResponse(commits = emptyList()) | ||
| ) | ||
|
|
||
| assertNull(message) | ||
| } | ||
|
|
||
| @Test | ||
| fun `renders a push with commits`() { | ||
| val message = templateHandler.handleEvent( | ||
| event = "push", | ||
| response = pushResponse(commits = listOf(Commit(message = "Add feature"))) | ||
| ) | ||
|
|
||
| assertContains(message.orEmpty(), "Add feature") | ||
| } | ||
|
|
||
| private fun reviewResponse( | ||
| body: String?, | ||
| state: String = "approved" | ||
| ) = GitHubResponse( | ||
| action = "submitted", | ||
| pullRequest = PullRequest( | ||
| htmlUrl = "https://github.com/wire/example/pull/1", | ||
| title = "Example pull request", | ||
| user = user, | ||
| number = 1 | ||
| ), | ||
| review = Review( | ||
| body = body, | ||
| user = user, | ||
| state = state | ||
| ), | ||
| sender = user, | ||
| repository = Repository( | ||
| fullName = "wire/example", | ||
| name = "example" | ||
| ) | ||
| ) | ||
|
|
||
| private fun pushResponse(commits: List<Commit>) = | ||
| GitHubResponse( | ||
| commits = commits, | ||
| sender = user, | ||
| compare = "https://github.com/wire/example/compare/main", | ||
| repository = Repository( | ||
| fullName = "wire/example", | ||
| name = "example" | ||
| ) | ||
| ) | ||
|
|
||
| private companion object { | ||
| val user = User( | ||
| avatarUrl = "https://github.com/wire.png", | ||
| login = "wire" | ||
| ) | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
The
appservice mapsGHAPP_SERVER_PORTwithout a host-IP restriction, exposing the GitHub app on all host interfaces. Any network-reachable attacker can scan the host and send requests to the application port.More details about this
The
appservice publishes${GHAPP_SERVER_PORT:-8083}as a host port without a host IP, so Docker binds it to all host interfaces (0.0.0.0). IfGHAPP_SERVER_PORTis unset, the application listens athttp://<host>:8083; if it is set, the same value controls the externally reachable host port. This makes the GitHub app endpoint accessible from any network that can reach the Docker host, rather than only from the local machine or an explicitly trusted interface.A plausible attack is:
nmap -p 8083 <host-ip>, and finds the port open because the Compose mapping exposes it on every interface.curl http://<host-ip>:8083/or probes application API routes served by theappcontainer.GHAPP_SERVER_PORTalso comes from the environment, changing that variable can unintentionally move the same service to another publicly reachable port without changing the Compose file.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
127.0.0.1:${GHAPP_SERVER_PORT:-8083}:${GHAPP_SERVER_PORT:-8083}.portsentry and let other Compose services access it through the internal network.portsentry unless Redis must be accessed from the host. Theappservice can reach Redis usingredis:6379without publishing Redis externally.127.0.0.1with the specific trusted host interface address and restrict access with firewall rules. Binding without a host address exposes the port on all host interfaces.💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by port-all-interfaces.
You can view more details about this finding in the Semgrep AppSec Platform.