21981898d2
Add JSON API for webhook deliveries ( #2785 )
...
* Add JSON API for webhook deliveries
* Extract sanitized_request method on Webhook::Delivery
* Extract response_summary method on Webhook::Delivery
2026-04-07 15:08:27 -04:00
0c10622672
Fix double-escaped HTML entities in webhook payloads
...
`Event::Description#to_plain_text` now returns an html-safe string to
prevent double-escaping when the ERB template renders the basecamp
and campfire payloads.
ref: https://3.basecamp.com/2914079/buckets/27/card_tables/cards/9574495379
2026-02-13 03:25:59 -05:00
29c7926307
Stream response in webhook request manually to check size
...
This addresses a DoS vulnerability where the response might be massive
leading to OOM errors, as the response is read in full in memory by
default.
To prevent this, we need to read the body in chunks, checking the
size of the chunks we've read and raising if we go over a certain limit.
I've set the limit to 100 KB because the responses to these requests
should be fairly small or even empty, and we only care about the status
code in the end.
2025-12-09 11:25:12 +01:00
1b3d7d4276
Fix ipaddr setter
2025-12-05 20:43:56 +01:00
7af93765a8
Security: close narrow window of exposure to DNS rebinding ( #1903 )
2025-12-03 23:12:17 -08:00
7f46063c25
Introduce gitleaks to the codebase
...
- `bin/setup` installs gitleaks
- add `gitleaks dir` command to CI
- configure gitleaks to ignore tmp, log, and encrypted files
- tag existing false positives with `gitleaks:allow`
- add historical false positives to the ignore list
2025-11-26 15:46:47 -05:00
676c2a42fe
Always use the creator name for the plain text form
...
You does not make sense for webhooks
2025-11-06 14:16:01 +01:00
9291e64deb
Add test for weebhook delivery test
2025-11-06 11:21:22 +01:00
03a345609e
Baseline replacing collection with board across code
2025-11-05 13:31:54 +01:00
9ddfe4d803
Fix production Basecamp webhook format
2025-10-01 14:44:36 +02:00
5710aa724f
Send HTML to campfire instead of JSON
2025-09-17 13:16:00 +02:00
dd3063b01d
Simplify delinquency tracking
2025-09-16 20:08:03 +02:00
02a421675f
Scope Webhooks to Collections
2025-09-16 20:07:25 +02:00
1d192c9d42
Ignore low-volume webhooks for delinquency checks
2025-09-16 20:04:20 +02:00
fee25a49ea
Periodically cleanup deliveries
2025-09-16 20:04:20 +02:00
9d77b17b8c
Remove encryption
2025-09-16 20:04:20 +02:00
2fc9215b1d
Add support for Basecamp, Campfire & Slack webhooks
2025-09-16 20:04:20 +02:00
1d69b171b6
Test the abuse prevention logic
2025-09-16 20:04:20 +02:00
a515ea3b1f
Create webhooks
2025-09-16 20:03:55 +02:00
Rob Zolkos