remi / Liberaforms hook

- id: debug execute-command: /usr/local/bin/log-hook.sh include-command-output-in-response: true pass-arguments-to-command: - source: entire-headers - source: raw-request-body - id: liberaforms execute-command: /usr/local/bin/verify-hook.py include-command-output-in-response: true pass-arguments-to-command: - source: header name: X-Timestamp - source: header name: X-Signature-256 - source: raw-request-body pass-environment-to-command: - source: string name: foobar envname: WEBHOOK_SECRET trigger-rule: and: - match: type: regex regex: '^[0-9a-f]{64}$' parameter: source: header name: X-Signature-256 - match: type: regex regex: '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,6})?(Z|[+-]\d{2}:\d{2})$' parameter: source: header name: X-Timestamp

#!/usr/bin/env python3 import os import sys import hmac import hashlib from datetime import datetime, timezone MAX_SKEW = 300 # secondes def main(): if len(sys.argv) != 4: print("INVALIDE: arguments manquants (attendu: timestamp signature raw_body)") return 1 timestamp, signature, body_arg = sys.argv[1:4] signature = signature.removeprefix("sha256=") secret = os.environ.get("WEBHOOK_SECRET", "") if not secret: print("INVALIDE: WEBHOOK_SECRET non défini") return 1 # 1. Fraîcheur du timestamp try: ts = datetime.fromisoformat(timestamp) if ts.tzinfo is None: ts = ts.replace(tzinfo=timezone.utc) except ValueError: print(f"INVALIDE: timestamp illisible ({timestamp})") return 1 skew = abs((datetime.now(timezone.utc) - ts).total_seconds()) if skew > MAX_SKEW: print(f"INVALIDE: timestamp trop ancien/futur ({skew:.0f}s d'écart)") return 1 # 2. Signature sur les octets bruts + timestamp # os.fsencode restitue les octets exacts reçus dans argv raw_body = os.fsencode(body_arg) expected = hmac.new( secret.encode("utf-8"), raw_body + timestamp.encode("utf-8"), hashlib.sha256, ).hexdigest() if not hmac.compare_digest(expected, signature): print("INVALIDE: signature incorrecte") return 1 print("VALIDE") return 0 if __name__ == "__main__": sys.exit(main())