Dmitry VerkhoturovandUmputun
45c17a913f
Backend (backend/go.mod): - github.com/go-pkgz/auth/v2 v2.1.2 → v2.1.4 - github.com/klauspost/compress v1.18.5 → v1.18.6 - github.com/redis/go-redis/v9 v9.18.0 → v9.19.0 - github.com/slack-go/slack v0.21.1 → v0.23.1 - golang.org/x/crypto v0.50.0 → v0.51.0 - golang.org/x/image v0.39.0 → v0.40.0 - golang.org/x/net v0.53.0 → v0.54.0 - golang.org/x/sys v0.43.0 → v0.44.0 - golang.org/x/text v0.36.0 → v0.37.0 Example (backend/_example/memory_store/go.mod): - golang.org/x/crypto v0.50.0 → v0.51.0 - golang.org/x/image v0.39.0 → v0.40.0 - golang.org/x/net v0.53.0 → v0.54.0 - golang.org/x/sys v0.43.0 → v0.44.0 Transitive cleanup: github.com/dgryski/go-rendezvous is no longer required after redis/go-redis bump and gets pruned by `go mod tidy`. `go mod tidy` + `go mod vendor` run on both modules. Both build with -race and full test suites pass.
113 lines
2.6 KiB
Go
113 lines
2.6 KiB
Go
package slack
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"hash"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// Signature headers
|
|
const (
|
|
hSignature = "X-Slack-Signature"
|
|
hTimestamp = "X-Slack-Request-Timestamp"
|
|
)
|
|
|
|
// SecretsVerifier contains the information needed to verify that the request comes from Slack
|
|
type SecretsVerifier struct {
|
|
d Debug
|
|
signature []byte
|
|
hmac hash.Hash
|
|
}
|
|
|
|
func unsafeSignatureVerifier(header http.Header, secret string) (_ SecretsVerifier, err error) {
|
|
var (
|
|
bsignature []byte
|
|
)
|
|
|
|
if secret == "" {
|
|
return SecretsVerifier{}, ErrInvalidConfiguration
|
|
}
|
|
|
|
signature := header.Get(hSignature)
|
|
stimestamp := header.Get(hTimestamp)
|
|
|
|
if signature == "" || stimestamp == "" {
|
|
return SecretsVerifier{}, ErrMissingHeaders
|
|
}
|
|
|
|
if bsignature, err = hex.DecodeString(strings.TrimPrefix(signature, "v0=")); err != nil {
|
|
return SecretsVerifier{}, err
|
|
}
|
|
|
|
hash := hmac.New(sha256.New, []byte(secret))
|
|
if _, err = fmt.Fprintf(hash, "v0:%s:", stimestamp); err != nil {
|
|
return SecretsVerifier{}, err
|
|
}
|
|
|
|
return SecretsVerifier{
|
|
signature: bsignature,
|
|
hmac: hash,
|
|
}, nil
|
|
}
|
|
|
|
// NewSecretsVerifier returns a SecretsVerifier object in exchange for an http.Header object and signing secret
|
|
func NewSecretsVerifier(header http.Header, secret string) (sv SecretsVerifier, err error) {
|
|
var (
|
|
timestamp int64
|
|
)
|
|
|
|
stimestamp := header.Get(hTimestamp)
|
|
|
|
if sv, err = unsafeSignatureVerifier(header, secret); err != nil {
|
|
return SecretsVerifier{}, err
|
|
}
|
|
|
|
if timestamp, err = strconv.ParseInt(stimestamp, 10, 64); err != nil {
|
|
return SecretsVerifier{}, err
|
|
}
|
|
|
|
diff := absDuration(time.Since(time.Unix(timestamp, 0)))
|
|
if diff > 5*time.Minute {
|
|
return SecretsVerifier{}, ErrExpiredTimestamp
|
|
}
|
|
|
|
return sv, err
|
|
}
|
|
|
|
func (v *SecretsVerifier) WithDebug(d Debug) *SecretsVerifier {
|
|
v.d = d
|
|
return v
|
|
}
|
|
|
|
func (v *SecretsVerifier) Write(body []byte) (n int, err error) {
|
|
return v.hmac.Write(body)
|
|
}
|
|
|
|
// Ensure compares the signature sent from Slack with the actual computed hash to judge validity
|
|
func (v SecretsVerifier) Ensure() error {
|
|
computed := v.hmac.Sum(nil)
|
|
// use hmac.Equal prevent leaking timing information.
|
|
if hmac.Equal(computed, v.signature) {
|
|
return nil
|
|
}
|
|
if v.d != nil && v.d.Debug() {
|
|
v.d.Debugln(fmt.Sprintf("Expected signing signature: %s, but computed: %s", hex.EncodeToString(v.signature), hex.EncodeToString(computed)))
|
|
}
|
|
return fmt.Errorf("computed unexpected signature of: %s", hex.EncodeToString(computed))
|
|
}
|
|
|
|
func abs64(n int64) int64 {
|
|
y := n >> 63
|
|
return (n ^ y) - y
|
|
}
|
|
|
|
func absDuration(n time.Duration) time.Duration {
|
|
return time.Duration(abs64(int64(n)))
|
|
}
|