refactor: isolate webhook signature verification - #921
Merged
Conversation
apcha-oai
added
the
custom-code-burndown
Contributor
Castiron custom code✅ No new custom-code files detected. 61 mixed files remain; 1 existing customization changed. Compared
60 existing customizations unchanged
20 more in the full report. A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32430461716 --repo openai/openai-java \
--name castiron-custom-code-32430461716-1 --dir /tmp/castiron-custom-code-32430461716-1
git apply --stat /tmp/castiron-custom-code-32430461716-1/custom-code.patch
cat /tmp/castiron-custom-code-32430461716-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin ca9c11dd90be5b10b67797a0af6e575ce776bb6a 8e78342415389cb8e1cac4902076f932f76ccb1d
python3 scripts/castiron/custom_code_report.py report \
--base ca9c11dd90be5b10b67797a0af6e575ce776bb6a \
--head 8e78342415389cb8e1cac4902076f932f76ccb1d --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-8e7834241538
cat /tmp/castiron-custom-code-8e7834241538/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
apcha-oai
marked this pull request as ready for review
August 20, 2026 23:52
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
jbeckwith-oai
approved these changes
Aug 20, 2026
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
Contributor
There was a problem hiding this comment.
Completed an independent security-focused review: the extracted webhook verifier is token-equivalent to the previous implementation and preserves HMAC-SHA256, timing-safe comparison, timestamp/replay protection, injected-clock behavior, secret decoding/precedence, multiple signatures, malformed-input errors, and verify-before-parse ordering for both blocking and async clients. Public signatures and compatibility remain unchanged.
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Move the existing webhook-signature algorithm out of the generated blocking service into an SDK-owned, Kotlin-internal/JVM-synthetic helper.
verifySignatureis now a thin typed delegate. The algorithm is unchanged, including secret precedence, required-header order, timestamp tolerance, HMAC calculation, timing-safe comparison, and exception messages. The existingunwrapimplementation and async delegation are unchanged.The mixed-file count remains 61, but the handwritten patch in
WebhookServiceImplshrinks from +112/-3 to +26/-3. The other 60 customizations are unchanged. Public service signatures, generation metadata, and API-reference artifacts are unchanged.All existing tests remain intact. The new
WebhookVerificationTestruns each of these cases through both public client flavors:usesClientSecretAndPerCallOverride: configured secret, per-call override, and mismatch.acceptsInclusiveToleranceAndRejectsOutsideIt: both tolerance boundaries, outside values, and custom tolerance.preservesRequiredHeaderAndTimestampErrors: missing-secret/header precedence and malformed timestamps.acceptsRawAndEncodedSecretsAndAnyMatchingSignature: raw/encoded secrets and multiple signatures.unwrapVerifiesBeforeParsing: valid events, signature failure before parsing, and parse-error wrapping.withOptionsUsesUpdatedClock: the derived service uses the updated clock.Security-focused review is requested because this relocates signature-verification code.
Test Plan
Automated
WebhookVerificationTest: 23 passed, no skips.