feat(bitbucket): check bitbucket webhook signature if webhook_secret is defined

src/sentry/integrations/bitbucket/webhook.py

@@ -1,3 +1,5 @@
+import hashlib
+import hmac
 import ipaddress
 import logging
 from abc import ABC
@@ -31,6 +33,29 @@
 PROVIDER_NAME = "integrations:bitbucket"
 
 
+def is_valid_signature(body: bytes, secret: str, signature: str) -> bool:
+    hash_object = hmac.new(
+        secret.encode("utf-8"),
+        msg=body,
+        digestmod=hashlib.sha256,
+    )
+    expected_signature = hash_object.hexdigest()
+
+    if not hmac.compare_digest(expected_signature, signature):
+        logger.info(
+            "%s.webhook.invalid-signature",
+            PROVIDER_NAME,
+            extra={"expected": expected_signature, "given": signature},
+        )
+        return False
+    return True
+
+
+class WebhookSignatureException(Exception):
+    def __init__(self, message: str = ""):
+        super().__init__(message)
+
+
 class BitbucketWebhook(SCMWebhook, ABC):
     @property
     def provider(self) -> str:
@@ -73,6 +98,8 @@
 
     def __call__(self, event: Mapping[str, Any], **kwargs) -> None:
         authors = {}
+        if not (request := kwargs.get("request")):
+            raise ValueError("Missing request")
 
         if not (organization := kwargs.get("organization")):
             raise ValueError("Missing organization")
@@ -86,6 +113,19 @@
         except Repository.DoesNotExist:
             raise Http404()
 
+        if "webhook_secret" in repo.config:
+            secret = repo.config["webhook_secret"]
+            try:
+                method, signature = request.META["HTTP_X_HUB_SIGNATURE"].split("=", 1)
+            except (IndexError, KeyError, ValueError):
+                raise WebhookSignatureException("Missing webhook signature")
+
+            if method != "sha256":
+                raise WebhookSignatureException("Signature method is not supported")
+
+            if not is_valid_signature(request.body, secret, signature):
+                raise WebhookSignatureException("Webhook signature is invalid")
+
         # while we're here, make sure repo data is up to date
         self.update_repo_data(repo, event)
 
@@ -206,6 +246,9 @@
             domain=IntegrationDomain.SOURCE_CODE_MANAGEMENT,
             provider_key=event_handler.provider,
         ).capture():
-            event_handler(event, organization=organization)
+            try:
+                event_handler(event, request=request, organization=organization)
+            except WebhookSignatureException as e:
+                return HttpResponse(str(e), status=400)
 
         return HttpResponse(status=204)

tests/sentry/integrations/bitbucket/test_webhook.py

@@ -5,7 +5,7 @@
 from unittest.mock import patch
 
 from fixtures.bitbucket import PUSH_EVENT_EXAMPLE
-from sentry.integrations.bitbucket.webhook import PROVIDER_NAME
+from sentry.integrations.bitbucket.webhook import PROVIDER_NAME, is_valid_signature
 from sentry.models.commit import Commit
 from sentry.models.commitauthor import CommitAuthor
 from sentry.models.repository import Repository
@@ -192,3 +192,56 @@ def test_update_repo_url(self):
         # url has been updated
         repo_out_of_date_url.refresh_from_db()
         assert repo_out_of_date_url.url == "https://bitbucket.org/maxbittker/newsdiffs"
+
+
+class WebhookSignatureTest(WebhookBaseTest):
+    method = "post"
+
+    def setUp(self):
+        super().setUp()
+
+        repo = self.create_repository()
+        repo.config["webhook_secret"] = "test_secret"
+        repo.save()
+
+    def send_signed_webhook(self):
+        return self.get_response(
+            self.organization_id,
+            raw_data=PUSH_EVENT_EXAMPLE,
+            extra_headers=dict(
+                HTTP_X_EVENT_KEY="repo:push",
+                HTTP_X_HUB_SIGNATURE=self.signature,
+                REMOTE_ADDR=BITBUCKET_IP,
+            ),
+        )
+
+    def test_is_valid_signature(self):
+        # https://support.atlassian.com/bitbucket-cloud/docs/manage-webhooks/#Examples
+        assert is_valid_signature(
+            b"Hello World!",
+            "It's a Secret to Everybody",
+            "a4771c39fbe90f317c7824e83ddef3caae9cb3d976c214ace1f2937e133263c9",
+        )
+
+    def test_success(self):
+        self.signature = "sha256=ee07bac3b2fa849cf4346113dc5f6b9738660673aca6fa8f07ce459e7543f980"
+        response = self.send_signed_webhook()
+        assert response.status_code == 204
+
+    def test_missing_signature(self):
+        self.signature = ""
+        response = self.send_signed_webhook()
+        assert response.status_code == 400
+        assert response.content == b"Missing webhook signature"
+
+    def test_invalid_signature(self):
+        self.signature = "sha256=definitely-invalid"
+        response = self.send_signed_webhook()
+        assert response.status_code == 400
+        assert response.content == b"Webhook signature is invalid"
+
+    def test_invalid_method(self):
+        self.signature = "sha1=b842d7b7d535c446133bcf18cf085fb9472175c7"
+        response = self.send_signed_webhook()
+        assert response.status_code == 400
+        assert response.content == b"Signature method is not supported"