-
Notifications
You must be signed in to change notification settings - Fork 79
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: handle preparsed body payloads in verifyAndReceive accordingly #962
Conversation
👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labled with |
typeof event.payload === "string" | ||
? event.payload | ||
: JSON.stringify(event.payload), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This could cause problems if GitHub ever changes payload serialization, so the signature would not match...
We should check if it's possible to disable this parsing in Vercel.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is possible probot/probot#1955 (comment)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems like you don't even need to do that: https://vercel.com/guides/how-do-i-get-the-raw-body-of-a-serverless-function
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
#963 should be a better implementation based on that guide
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have no preference. But you should add a test to your PR.
That is the The webhooks aren't really called anywhere, we just pass through the data from the integrated web server and do the handliin this library: |
Closing as per discussion in #963 |
fixes #961
probot/probot#1955 (comment)