Add HMAC verification

META6.json

@@ -8,6 +8,8 @@
     "depends": [
         "Bailador",
         "Config",
+        "Digest::HMAC",
+        "Digest::SHA",
         "IRC::Client"
     ],
     "provides": {

lib/IRC/Client/Plugin/Github.pm6

@@ -4,6 +4,8 @@ use v6.c;
 
 use Bailador;
 use Config;
+use Digest::HMAC;
+use Digest::SHA;
 use IRC::Client;
 use IRC::Client::Plugin::Github::WebhookEvents::IssueComment;
 use IRC::Client::Plugin::Github::WebhookEvents::Issues;
@@ -33,6 +35,15 @@ class IRC::Client::Plugin::Github does IRC::Client::Plugin
 
 				my %json = from-json(request.body);
 
+				# Check signature
+				if ($!config.has("github.webhook.secret") && request.headers<X_HUB_SIGNATURE>:exists) {
+					my Str $hmac = "sha1=" ~ hmac-hex($!config.get("github.webhook.secret"), request.body, &sha1);
+
+					if ($hmac ne request.headers<X_HUB_SIGNATURE>) {
+						return "";
+					}
+				}
+
 				# Make sure there are channels configured to notify
 				my Str $repo-config-key = "github.webhook.repos.{%json<repository><full_name>.subst("/", "-")}.channels";
 				my Str @channels = $!config.get($repo-config-key) || $!config.get("github.webhook.channels", []).unique;

readme.adoc

@@ -71,6 +71,11 @@ message-style = "privmsg"
 # repository's configuration key, this array will be used instead.
 channels = ["#scriptkitties"]
 
+# A secret shared between the bot and the Github webhook. If set, HMAC
+# verification will be employed. Messages failing this verification will be
+# dropped.
+secret = ""
+
 # If set to true, it will notify for every repository that POSTs a payload to
 # the Bailador instance. Note this could be abused to spam through the bot.
 # When false, every repository should be properly defined if you want to see