@kaavee315checks…codex/propose-fix-for-webhook-signature-vulnerability → master6 files · +215 −55updated 1w ago${...} template or a literal/static string in signature.key could be used verbatim as the HMAC/token/Ed25519 verification secret and allow forged webhook events.setup_fields only and that malformed templates are rejected at validation and runtime.signature.key to be exactly a ${setupFields.<key>} template during cross-validation by adding SETUP_FIELD_KEY_TEMPLATE_REGEX and failing when the key is malformed or references undeclared setup-fields in packages/trigger-config/src/signature_scheme.ts.[A-Za-z0-9_] identifiers in extractTemplateRefs and runtime interpolateTemplate, and detect leftover ${...} syntax after interpolation to fail closed in apps/apollo/src/lib/triggers/webhook_ingress/template.ts and packages/trigger-config/src/lib/template_validation.ts.spec.key with the same template regex in apps/apollo/src/lib/triggers/webhook_ingress/signature.ts.packages/trigger-config/src/signature_scheme.test.ts and apps/apollo/src/lib/triggers/webhook_ingress/signature.test.ts, and apply formatting/lint adjustments.pnpm --filter @composiohq/trigger-config test — all 175 tests passed.pnpm --filter @composiohq/trigger-config lint and pnpm exec oxfmt --check ... — linters and formatter checks succeeded after changes.pnpm --filter @composio/lib bundle — bundle succeeded to resolve imports for Apollo tests.verifySignature test file (pnpm vitest run src/lib/triggers/webhook_ingress/signature.test.ts) but full execution is blocked in this environment due to missing Doppler/env secrets and generated Prisma client artifacts, so runtime Apollo suite could not be completed here.Based on git blame analysis of 6 file(s):
| Contributor | Contribution | Files |
|---|---|---|
| anshugarg15 | 100% | 6 |
Based on git history, anshugarg15 would be good reviewer(s) for this PR.
🤖 Based on git blame with recency weighting (recent edits count more).