Fix passing callback requests without secret key

SevereCloud · Jan 8, 2022 · 4917458 · 4917458
1 parent 4343582
commit 4917458
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 6 deletions.
diff --git a/callback/callback.go b/callback/callback.go
@@ -58,13 +58,15 @@ func (cb *Callback) HandleFunc(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if cb.SecretKeys[e.GroupID] != "" || cb.SecretKey != "" {
-		if e.Secret != cb.SecretKeys[e.GroupID] && e.Secret != cb.SecretKey {
-			cb.logf("callback: bad secret %d", e.GroupID)
-			http.Error(w, "Bad Secret", http.StatusForbidden)
+	secretKey, ok := cb.SecretKeys[e.GroupID]
+	if !ok {
+		secretKey = cb.SecretKey
+	}
+	if secretKey != "" && e.Secret != secretKey {
+		cb.logf("callback: bad secret %d", e.GroupID)
+		http.Error(w, "Bad Secret", http.StatusForbidden)
 
-			return
-		}
+		return
 	}
 
 	if e.Type == events.EventConfirmation {

diff --git a/callback/callback_test.go b/callback/callback_test.go
@@ -93,6 +93,15 @@ func TestCallback_HandleFunc(t *testing.T) {
 			body:     `{"type": "confirmation", "group_id": 123456, "secret": "secret_123456"}`,
 			expected: "confirmation_123456",
 		},
+		{
+			name: "check SecretKey missing",
+			fields: fields{
+				ConfirmationKey: "confirmation_123456",
+				SecretKey:       "secret_654321",
+			},
+			body:     `{"type": "confirmation", "group_id": 123456}`,
+			expected: "Bad Secret\n",
+		},
 		{
 			name: "check SecretKey bad",
 			fields: fields{