
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
This gem will help you to quickly setup a route in your Rails application which listens to a GitHub webhook
If you want to use this logic outside of Rails, you should consider the following gems (cf #19):
If you are on Rails, please read on!
Add this line to your application's Gemfile:
gem 'github_webhook', '~> 1.4'
And then execute:
$ bundle install
First, configure a route to receive the github webhook POST requests.
# config/routes.rb
resource :github_webhooks, only: :create, defaults: { formats: :json }
Then create a new controller:
# app/controllers/github_webhooks_controller.rb
class GithubWebhooksController < ActionController::API
include GithubWebhook::Processor
# Handle push event
def github_push(payload)
# TODO: handle push webhook
end
# Handle create event
def github_create(payload)
# TODO: handle create webhook
end
private
def webhook_secret(payload)
ENV['GITHUB_WEBHOOK_SECRET']
end
end
Add as many instance methods as events you want to handle in your controller.
All events are prefixed with github_
. So, a push
event can be handled by github_push(payload)
, or a create
event can be handled by github_create(payload)
, etc.
You can read the full list of events GitHub can notify you about.
First, install octokit, then run a rails console.
$ gem install octokit
$ rails console
In the rails console, add the WebHook to GitHub:
require "octokit"
client = Octokit::Client.new(:login => 'ssaunier', :password => 's3cr3t!!!')
repo = "ssaunier/github_webhook"
callback_url = "yourdomain.com/github_webhooks"
webhook_secret = "a_gr34t_s3cr3t" # Must be set after that in ENV['GITHUB_WEBHOOK_SECRET']
# Create the WebHook
client.subscribe "https://github.com/#{repo}/events/push.json", callback_url, webhook_secret
The secret is set at the webhook creation. Store it in an environment variable,
GITHUB_WEBHOOK_SECRET
as per the example. It is important to have such a secret,
as it will guarantee that your process legit webhooks requests, thus only from GitHub.
You can have an overview of your webhooks at the following URL:
https://github.com/:username/:repo/settings/hooks
This project uses Appraisal to test against multiple versions of Rails.
On Travis, builds are also run on multiple versions of Ruby, each with multiple versions of Rails.
When you run bundle install
, it will use the latest version of Rails.
You can then run bundle exec rake spec
to run the test with that version of Rails.
To run the specs against each version of Rails, use bundle exec appraisal rake spec
.
FAQs
Unknown package
We found that github_webhook demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.