Error Signature does not match event payload and secret from verifyAndReceive caused from ERR_INVALID_ARG_TYPE

[jimjaeger]

With Update from probot ^12.3.3 to 13.0.2 the underlaying octokit throws an exception when a github request arrives. The pattern worked before and I verified the appid and secret. Is it framework issue or can I solve it on my own?

It breaks in

 return `${algorithm}=${(0, import_crypto.createHmac)(algorithm, secret).update(payload).digest("hex")}`;

and ends in the exception:

Original Error:

message": "[@octokit/webhooks] signature does not match event payload and secret",
      "stack":
          Error: [@octokit/webhooks] signature does not match event payload and secret
              at verifyAndReceive (/node_modules/@octokit/webhooks/dist-node/index.js:485:19)
              at processTicksAndRejections (node:internal/process/task_queues:95:5)
              at async middleware (/node_modules/@octokit/webhooks/dist-node/index.js:616:5)

The exception is catched with a () => false and ends in the exception message.
When I look into the Underlaying error it is a Argument exception that indicates an incorrect octokit/probot handling:

TypeError: The "data" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received an instance of Object
    at Hmac.update (node:internal/crypto/hash:104:11)
    at sign (/node_modules/@octokit/webhooks-methods/dist-node/index.js:58:75)
    at verify (/node_modules/@octokit/webhooks-methods/dist-node/index.js:81:11)
    at verifyAndReceive (/node_modules/@octokit/webhooks/dist-node/index.js:476:69)
    at middleware (/node_modules/@octokit/webhooks/dist-node/index.js:616:20)
    at processTicksAndRejections (node:internal/process/task_queues:95:5) {
  code: 'ERR_INVALID_ARG_TYPE'
}

If I add a JSON.stringify in the used sign method, then the verification works well and a next verification of valid JSON fails because it event.payload is an object and not an string. Both looks like the octokit verify path rely on string type payload and not the object payload.

What can I change that probot use octokit as expected?

[wolfy1339]

How are you using Probot? Are you using Probot directly, or any serverless framework?

[jimjaeger]

Indeed it is may an important information in this case. I use probot with createNodeMiddleware in an express application (https://probot.github.io/docs/development/#use-createnodemiddleware). And yes the express application has a JSON Parser. It worked with v12 but start to fail with V13. Temporary I removed the JSON Parser but it continues to fail.

   public createProbotAppFunction(): ApplicationFunction {
      return (app: Probot) => {
        // configure listeners to github events
        app.log.info("Github Probot %s starting ...", app.version);
        app.on(["pull_request.opened", "pull_request.reopened", "pull_request.synchronize"], this.pullRequestCheck);
        // app.on(["check_run.created", "check_run.completed"], infoShort);
        // app.on(["check_suite.requested"], infoShort);
        app.on(["check_run.rerequested"], this.checkRunRequested);
        // app.on(["create"], infoShort);
        app.log.info("Github Probot configured.");
      }
    }

...
this.app = express();
this.app.use(express.json());
this.app.use(createNodeMiddleware(this.createProbotAppFunction(), { probot: createProbot({ defaults: { log: this.logger } }) }));
...

[wolfy1339]

Starting with v13, we only accept strings as input for webhooks in order to facilitate validation as parsing the JSON and stringifying it may inadvertently change it.

Let's start with removing the express.json() parser

I am using the Octokit libraries (with the same versions as Probot) directly in an express app and haven't experienced this issue.

Are you able to share the payload as received by express before any parsing, signature and secret (once it is invalidated, and changed)? That would be helpful to debug

[jimjaeger]

Hello,

I had to remove all body parsers (json and urlencode) to get it running. I guess the changes in getPayload (@octokit/webhook) are not fully compatible with req.body initialization of native express bodyparser especially urlencoded.

Thanks for the help. The upgrade to v13 has been completed.