@kaavee315checks…codex/propose-fix-for-webhook-v2-vulnerability → master1 files · +5 −7review: @sohamganatraupdated 1w agoprovider_registration_type is null, which bypasses V2 signature verification and allows forged events.apps/apollo/src/pages/api/v3/trigger_instances/[slug]/upsert.ts so V2 setup is chosen when either provider_registration_type is non-null or a valid trigger_spec exists (replace providerRegistrationType != null with providerRegistrationType != null || triggerSpec != null).path logging to reflect the new predicate (v2 vs v1_legacy).WebhookSpec must use V2 setup to avoid downgrading signed triggers to the unauthenticated V1 handler.cd apps/apollo && pnpm lint which executed the repository lint suite and failed due to a large number of pre-existing repository-wide lint/type errors unrelated to this change.eslint invocations for the modified file which failed due to workspace ESLint configuration (flat-config / missing eslint.config.*) rather than the change itself.apps/apollo/src/pages/api/v3/trigger_instances/[slug]/upsert.ts.Based on git blame analysis of 1 file(s):
| Contributor | Contribution | Files |
|---|---|---|
| anshugarg15 | 39% | 1 |
| Jayesh Sharma | 38% | 1 |
| lingalarahul7 | 5% | 1 |
| Zen | 5% | 1 |
| Himanshu Dixit | 3% | 1 |
Based on git history, anshugarg15 or Jayesh Sharma would be good reviewer(s) for this PR.
🤖 Based on git blame with recency weighting (recent edits count more).