diff --git a/server/.golangci.yml b/server/.golangci.yml index 4e722f51e9..85826beb6d 100644 --- a/server/.golangci.yml +++ b/server/.golangci.yml @@ -165,7 +165,6 @@ issues: channels/web/oauth_test.go|\ channels/web/saml.go|\ channels/web/web_test.go|\ - channels/web/webhook.go|\ cmd/mattermost/commands/cmdtestlib.go|\ cmd/mattermost/commands/db.go|\ cmd/mattermost/commands/export.go|\ diff --git a/server/channels/web/webhook.go b/server/channels/web/webhook.go index ac511f3913..98e1b13a23 100644 --- a/server/channels/web/webhook.go +++ b/server/channels/web/webhook.go @@ -27,7 +27,11 @@ func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) { id := params["id"] errCtx := map[string]any{"hook_id": id} - r.ParseForm() + err := r.ParseForm() + if err != nil { + c.Err = model.NewAppError("incomingWebhook", "web.incoming_webhook.parse_form.app_error", errCtx, "", http.StatusBadRequest).Wrap(err) + return + } var appErr *model.AppError var mediaType string @@ -69,7 +73,10 @@ func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) { return } } else if mediaType == "multipart/form-data" { - r.ParseMultipartForm(0) + if err := r.ParseMultipartForm(0); err != nil { + c.Err = model.NewAppError("incomingWebhook", "web.incoming_webhook.parse_multipart.app_error", errCtx, "", http.StatusBadRequest).Wrap(err) + return + } decoder := schema.NewDecoder() err := decoder.Decode(incomingWebhookPayload, r.PostForm) @@ -93,7 +100,10 @@ func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) { } w.Header().Set("Content-Type", "text/plain") - w.Write([]byte("ok")) + if _, err := w.Write([]byte("ok")); err != nil { + c.Logger.Warn("Error while writing response", mlog.Err(err)) + return + } } func commandWebhook(c *Context, w http.ResponseWriter, r *http.Request) { @@ -114,7 +124,10 @@ func commandWebhook(c *Context, w http.ResponseWriter, r *http.Request) { } w.Header().Set("Content-Type", "text/plain") - w.Write([]byte("ok")) + if _, err := w.Write([]byte("ok")); err != nil { + c.Logger.Warn("Error while writing response", mlog.Err(err)) + return + } } func decodePayload(payload io.Reader) (*model.IncomingWebhookRequest, *model.AppError) { diff --git a/server/i18n/en.json b/server/i18n/en.json index 70ddb22ca4..106663a479 100644 --- a/server/i18n/en.json +++ b/server/i18n/en.json @@ -10544,6 +10544,14 @@ "id": "web.incoming_webhook.parse.app_error", "translation": "Unable to parse incoming data." }, + { + "id": "web.incoming_webhook.parse_form.app_error", + "translation": "Failed to parse form for webhook {{.hook_id}}." + }, + { + "id": "web.incoming_webhook.parse_multipart.app_error", + "translation": "Failed to parse multipart form for webhook {{.hook_id}}." + }, { "id": "web.incoming_webhook.permissions.app_error", "translation": "User {{.user}} does not have appropriate permissions to channel {{.channel}}"