devatherock/slack-webhook-facade

A Slack webhook facade to post messages to other chat clients like Zulip

slack-webhook-facade

A Slack webhook facade to post messages to other chat clients like Zulip

Usage

Zulip

To post a slack webhook message to zulip, use the slack webhook URL in the below format:

{slackWebhookFacadeHost}/zulip/{base64(username:zulipApiKey)}?server={zulipHost}

Sample URL

https://slack-webhook-facade.onrender.com/zulip/Y2ktYm90QHp1bGlwY2hhdC5jb206eHl6?server=https://devatherock-chat.zulipchat.com

Sample slack payload to post to the facade

{
  "text": "https://circleci.com/gh/devatherock/git-sync/66 by devatherock",
  "channel": "general",
  "attachments": [
    {
      "title": "Build completed",
      "text": "https://circleci.com/gh/devatherock/git-sync/66 by devatherock",
      "color": "#764FA5"
    }
  ]
}

Parameters

Path parameters

• slackWebhookFacadeHost - Host name of your slack-webhook-facade instance
• base64(username:zulipApiKey) - Base64 encoded value of the Zulip bot integration's username and API key, joined together by a colon. Will be used as the Basic authorization header in the call to Zulip API. If the username is [email protected] and the API key is xyz, the path variable will be what is in the sample URL

Query parameters

• zulipHost - Host name of your Zulip instance

Payload parameters

• channel - The Zulip stream to post the message to
• title - The topic name in Zulip

slack-webhook-facade's Issues

CVE-2022-41717 (Medium) detected in golang.org/x/sys-v0.0.0-20210510120138-977fb7262007 - autoclosed

CVE-2022-41717 - Medium Severity Vulnerability

Vulnerable Library - golang.org/x/sys-v0.0.0-20210510120138-977fb7262007

Library home page: https://proxy.golang.org/golang.org/x/sys/@v/v0.0.0-20210510120138-977fb7262007.zip

Dependency Hierarchy:

• github.com/sirUpsen/logrus-v1.6.0 (Root Library)
  • ❌ golang.org/x/sys-v0.0.0-20210510120138-977fb7262007 (Vulnerable Library)

Found in HEAD commit: 59a58cf7e138a4c179b33aa079c00c5c1509c3ad

Found in base branch: master

Vulnerability Details

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Publish Date: 2022-12-08

URL: CVE-2022-41717

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-12-08

Fix Resolution: go1.19.4

---

Step up your Open Source Security Game with Mend here

Create and publish a multi-arch docker image supporting linux/amd64 and linux/arm64

Requires #9

Add swagger-ui to document the API

Use the swagger UI as the website link in github

[DepShield] (CVSS 7.5) Vulnerability due to usage of golang.org/x:net:0.0.0-20200226121028-0de0cce0169b

Vulnerabilities

DepShield reports that this application's usage of golang.org/x:net:0.0.0-20200226121028-0de0cce0169b results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-17847] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17142] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17846] Resource Management Errors
• (CVSS 7.5) [CVE-2018-17848] Data Handling
• (CVSS 7.5) [CVE-2018-17143] Improper Input Validation

---

Occurrences

golang.org/x:net:0.0.0-20200226121028-0de0cce0169b is a transitive dependency introduced by the following direct dependency(s):

• honnef.co/go:tools:0.0.1-2020.1.6
        └─ golang.org/x:tools:0.0.0-20200410194907-79a7a3126eef
              └─ golang.org/x:net:0.0.0-20200226121028-0de0cce0169b

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2022-29526 (Medium) detected in golang.org/x/sys-v0.0.0-20210510120138-977fb7262007 - autoclosed

CVE-2022-29526 - Medium Severity Vulnerability

Vulnerable Library - golang.org/x/sys-v0.0.0-20210510120138-977fb7262007

Library home page: https://proxy.golang.org/golang.org/x/sys/@v/v0.0.0-20210510120138-977fb7262007.zip

Dependency Hierarchy:

• github.com/sirUpsen/logrus-v1.6.0 (Root Library)
  • ❌ golang.org/x/sys-v0.0.0-20210510120138-977fb7262007 (Vulnerable Library)

Found in HEAD commit: 59a58cf7e138a4c179b33aa079c00c5c1509c3ad

Found in base branch: master

Vulnerability Details

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

Publish Date: 2022-06-23

URL: CVE-2022-29526

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2022-29526

Release Date: 2022-06-23

Fix Resolution: go1.17.10,go1.18.2,go1.19

---

Step up your Open Source Security Game with Mend here

Move app deployment from heroku to render before 28-Nov-2022

Need to update the slack webhook URL in CircleCI afterwards

Add functional tests

Check why the deployment is consistently unhealthy

[DepShield] (CVSS 7.5) Vulnerability due to usage of golang.org/x:net:0.0.0-20190620200207-3b0461eec859

Vulnerabilities

DepShield reports that this application's usage of golang.org/x:net:0.0.0-20190620200207-3b0461eec859 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-17847] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17142] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17846] Resource Management Errors
• (CVSS 7.5) [CVE-2018-17075] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17848] Data Handling
• (CVSS 7.5) [CVE-2018-17143] Improper Input Validation

---

Occurrences

golang.org/x:net:0.0.0-20190620200207-3b0461eec859 is a transitive dependency introduced by the following direct dependency(s):

• github.com/mdempsky:maligned:0.0.0-20201101000000-d73c43cb16d0
        └─ golang.org/x:tools:0.0.0-20201030204249-4fc0492b8eca
              └─ golang.org/x:mod:0.3.0
                    └─ golang.org/x:tools:0.0.0-20191119224855-298f0cb1881e
                          └─ golang.org/x:net:0.0.0-20190620200207-3b0461eec859

• honnef.co/go:tools:0.0.1-2020.1.6
        └─ golang.org/x:tools:0.0.0-20200410194907-79a7a3126eef
              └─ golang.org/x:mod:0.2.0
                    └─ golang.org/x:tools:0.0.0-20191119224855-298f0cb1881e
                          └─ golang.org/x:net:0.0.0-20190620200207-3b0461eec859
        └─ golang.org/x:mod:0.2.0
              └─ golang.org/x:tools:0.0.0-20191119224855-298f0cb1881e
                    └─ golang.org/x:net:0.0.0-20190620200207-3b0461eec859

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3

Vulnerabilities

DepShield reports that this application's usage of golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-17847] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17142] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17846] Resource Management Errors
• (CVSS 7.5) [CVE-2018-17075] Improper Input Validation
• (CVSS 7.5) [CVE-2018-17848] Data Handling
• (CVSS 7.5) [CVE-2018-17143] Improper Input Validation

---

Occurrences

golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3 is a transitive dependency introduced by the following direct dependency(s):

• github.com/mdempsky:maligned:0.0.0-20201101000000-d73c43cb16d0
        └─ golang.org/x:tools:0.0.0-20201030204249-4fc0492b8eca
              └─ golang.org/x:mod:0.3.0
                    └─ golang.org/x:crypto:0.0.0-20191011191535-87dc89f01550
                          └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3
              └─ golang.org/x:net:0.0.0-20201021035429-f5854403a974
                    └─ golang.org/x:crypto:0.0.0-20200622213623-75b288015ac9
                          └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3

• honnef.co/go:tools:0.0.1-2020.1.6
        └─ golang.org/x:tools:0.0.0-20200410194907-79a7a3126eef
              └─ golang.org/x:mod:0.2.0
                    └─ golang.org/x:crypto:0.0.0-20191011191535-87dc89f01550
                          └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3
        └─ golang.org/x:mod:0.2.0
              └─ golang.org/x:crypto:0.0.0-20191011191535-87dc89f01550
                    └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Upgrade go to 1.17 to fix build failure

Requires #10. Also use cimg/* image in CircleCI pipeline instead of the circleci/* image

Add renovate

Requires #9

[DepShield] (CVSS 5.9) Vulnerability due to usage of golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2

Vulnerabilities

DepShield reports that this application's usage of golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2 results in the following vulnerability(s):

• (CVSS 5.9) [CVE-2019-11840] Use of Insufficiently Random Values

---

Occurrences

golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2 is a transitive dependency introduced by the following direct dependency(s):

• github.com/mdempsky:maligned:0.0.0-20201101000000-d73c43cb16d0
        └─ golang.org/x:tools:0.0.0-20201030204249-4fc0492b8eca
              └─ golang.org/x:mod:0.3.0
                    └─ golang.org/x:crypto:0.0.0-20191011191535-87dc89f01550
                          └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3
                                └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2
                    └─ golang.org/x:tools:0.0.0-20191119224855-298f0cb1881e
                          └─ golang.org/x:net:0.0.0-20190620200207-3b0461eec859
                                └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2
              └─ golang.org/x:net:0.0.0-20201021035429-f5854403a974
                    └─ golang.org/x:crypto:0.0.0-20200622213623-75b288015ac9
                          └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3
                                └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2

• honnef.co/go:tools:0.0.1-2020.1.6
        └─ golang.org/x:tools:0.0.0-20200410194907-79a7a3126eef
              └─ golang.org/x:mod:0.2.0
                    └─ golang.org/x:tools:0.0.0-20191119224855-298f0cb1881e
                          └─ golang.org/x:net:0.0.0-20190620200207-3b0461eec859
                                └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2
                    └─ golang.org/x:crypto:0.0.0-20191011191535-87dc89f01550
                          └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3
                                └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2
              └─ golang.org/x:net:0.0.0-20200226121028-0de0cce0169b
                    └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2
        └─ golang.org/x:mod:0.2.0
              └─ golang.org/x:tools:0.0.0-20191119224855-298f0cb1881e
                    └─ golang.org/x:net:0.0.0-20190620200207-3b0461eec859
                          └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2
              └─ golang.org/x:crypto:0.0.0-20191011191535-87dc89f01550
                    └─ golang.org/x:net:0.0.0-20190404232315-eb5bcb51f2a3
                          └─ golang.org/x:crypto:0.0.0-20190308221718-c2843e01d9a2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Add sonar and coveralls

Add unit tests