From 979c3c153ae9a28a5cce46531cf32590a8d412fd Mon Sep 17 00:00:00 2001
From: DongZifan <169039417+DongZifan@users.noreply.github.com>
Date: Thu, 23 Apr 2026 14:50:50 +0800
Subject: [PATCH 1/2] Implement security checks for webhook data

Add validation for repository, branch, and owner names to prevent invalid characters in webhook data.
---
 jekyll-hook.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/jekyll-hook.js b/jekyll-hook.js
index 7bedc41..b00e49c 100755
--- a/jekyll-hook.js
+++ b/jekyll-hook.js
@@ -52,6 +52,13 @@ app.post('/hooks/jekyll/*', function(req, res) {
         data.branch = data.ref.replace('refs/heads/', '');
         data.owner = data.repository.owner.name;
 
+        var safePattern = /^[a-zA-Z0-9._-]+$/;
+        if (!safePattern.test(data.repo) || !safePattern.test(data.branch) || !safePattern.test(data.owner)) {
+            console.log('Security Error: Invalid characters detected in webhook data.');
+            if (typeof cb === 'function') cb();
+            return;
+        }
+
         // End early if not permitted account
         if (config.accounts.indexOf(data.owner) === -1) {
             console.log(data.owner + ' is not an authorized account.');

From 38cc830195cf2bf0dfc8b0cb2193413d42ed0f46 Mon Sep 17 00:00:00 2001
From: DongZifan <169039417+DongZifan@users.noreply.github.com>
Date: Fri, 15 May 2026 10:09:05 +0800
Subject: [PATCH 2/2] Update jekyll-hook.js

---
 jekyll-hook.js | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/jekyll-hook.js b/jekyll-hook.js
index b00e49c..ebd8bdb 100755
--- a/jekyll-hook.js
+++ b/jekyll-hook.js
@@ -13,17 +13,32 @@ var crypto  = require('crypto');
 
 app.use(express.bodyParser({
     verify: function(req,res,buffer){
-        if(!req.headers['x-hub-signature']){
-            return;
+        if (!config.secret || config.secret === "") {
+            console.warn("Webhook secret is not configured.");
+            var err = new Error("Webhook secret is required");
+            err.status = 500;
+            throw err;
         }
 
-        if(!config.secret || config.secret==""){
-            console.log("Recieved a X-Hub-Signature header, but cannot validate as no secret is configured");
-            return;
+        if (!req.headers['x-hub-signature']) {
+            console.warn("Missing X-Hub-Signature header.");
+            var err = new Error("Missing signature");
+            err.status = 403;
+            throw err;
+        }
+
+        var signature = req.headers['x-hub-signature'];
+        var parts = signature.split('=');
+
+        if (parts.length !== 2 || parts[0] !== 'sha1') {
+            console.warn("Invalid X-Hub-Signature format.");
+            var err = new Error("Invalid signature format");
+            err.status = 403;
+            throw err;
         }
 
         var hmac         = crypto.createHmac('sha1', config.secret);
-        var recieved_sig = req.headers['x-hub-signature'].split('=')[1];
+        var recieved_sig = parts[1];
         var computed_sig = hmac.update(buffer).digest('hex');
 
         if(recieved_sig != computed_sig){