From 85fbae18137647e517cc0637b0816ace4c3a53b8 Mon Sep 17 00:00:00 2001 From: Pete Matsyburka Date: Mon, 14 Sep 2026 14:48:00 +0300 Subject: [PATCH] validate webhook header --- app/controllers/webhook_secret_controller.rb | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/app/controllers/webhook_secret_controller.rb b/app/controllers/webhook_secret_controller.rb index b9b8a3f2..94a659e4 100644 --- a/app/controllers/webhook_secret_controller.rb +++ b/app/controllers/webhook_secret_controller.rb @@ -3,11 +3,19 @@ class WebhookSecretController < ApplicationController load_and_authorize_resource :webhook_url, parent: false + HEADER_NAME_REGEXP = /\A[\w-]+\z/ + def show; end def update + key = webhook_secret_params[:key] + + if key.present? && !HEADER_NAME_REGEXP.match?(key) + return redirect_back(fallback_location: settings_webhook_path(@webhook_url), alert: I18n.t('unable_to_save')) + end + @webhook_url.update!(secret: { - webhook_secret_params[:key] => webhook_secret_params[:value] + key => webhook_secret_params[:value] }.compact_blank) redirect_back(fallback_location: settings_webhook_path(@webhook_url),