[WEB-8103] fix: stop leaking webhook HMAC secret_key on reads by mguptahub · Pull Request #9382 · makeplane/plane

mguptahub · 2026-07-09T10:45:36Z

Fixes WEB-8103 (MED, admin-only).

Problem

WebhookEndpoint list/retrieve/patch pass a fields=(...) allowlist that deliberately excludes secret_key, but DynamicBaseSerializer.__init__ discards the caller allowlist (fields = self.expand). Combined with WebhookSerializer using fields="__all__" and secret_key only in read_only_fields (read-only fields are still serialized), the HMAC signing secret_key was returned on every webhook read. All handlers are @allow_permission([ADMIN], level="WORKSPACE"), so exposure is workspace-admin-only.

Fix

The advisory suggests secret_key = serializers.CharField(write_only=True), but that would (a) let a client inject their own secret on create/patch (a downgrade — the secret is server-generated via default=generate_token) and (b) break the intended one-time reveal. Instead:

WebhookSerializer.to_representation drops secret_key unless a show_secret_key context flag is set — secure by default. secret_key stays server-generated and non-writable.
POST create and WebhookSecretRegenerateEndpoint pass show_secret_key=True, so the secret is still returned once for the caller to configure their receiver.
list / retrieve / patch no longer emit it.

WebhookSerializer is only used in app/views/webhook/base.py (no external API / EE consumer), so the blast radius is contained.

Tests

tests/contract/app/test_webhook_secret_key_scope_app.py — 6 tests: list/retrieve/patch do not leak, create + regenerate still reveal, and a serializer-level check of both branches of the flag. Fail-before verified (the four no-leak tests return secret_key before the fix). ruff + manage.py check green.

Follow-up

The root DynamicBaseSerializer.__init__ bug (silently discarding the fields= allowlist) also affects other serializers (workspace/project member over-exposure) — tracked as a separate audit.

Summary by CodeRabbit

Bug Fixes
- Webhook responses now keep secret_key hidden by default, including when explicitly requested.
- Webhook creation responses include the secret for initial setup.
- Secret regeneration returns the newly generated secret.
- Listing, retrieving, and updating webhooks no longer expose the secret.
Tests
- Added coverage verifying secret visibility across webhook creation, listing, retrieval, updates, and regeneration.

…3rj) WebhookEndpoint list/retrieve/patch pass a fields= allowlist that excludes secret_key, but DynamicBaseSerializer.__init__ discards the caller allowlist (fields = self.expand). With WebhookSerializer using fields="__all__" and secret_key only in read_only_fields (read-only is still serialized), the HMAC signing secret leaked on every webhook read (GHSA-83rj-4282-x39v; admin-only). Rather than secret_key = CharField(write_only=True) — which would let a client inject their own secret on create/patch and break the intended one-time reveal — hide it by default and reveal only where intended: - WebhookSerializer.to_representation drops secret_key unless the show_secret_key context flag is set (secure by default). secret_key stays server-generated (default=generate_token) and non-writable. - POST create and WebhookSecretRegenerateEndpoint pass show_secret_key so the secret is still returned once for the caller to configure their receiver; list/retrieve/patch no longer emit it. Add contract regression tests (fail-before verified). Follow-up: the DynamicBaseSerializer.__init__ allowlist bug affects other serializers — tracked separately. Co-authored-by: Plane AI <noreply@plane.so>

makeplane · 2026-07-09T10:45:47Z

Linked to Plane Work Item(s)

(WEB-8103) [Security] GHSA-83rj — WebhookSerializer leaks HMAC secret_key on read (CE)

This comment was auto-generated by Plane

coderabbitai · 2026-07-09T10:46:21Z

Warning

Review limit reached

@mguptahub, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4cdb4e04-e511-4606-aa51-c75250665f8f

📥 Commits

Reviewing files that changed from the base of the PR and between cd7ab96 and 3401236.

📒 Files selected for processing (2)

apps/api/plane/app/serializers/webhook.py
apps/api/plane/tests/contract/app/test_webhook_secret_key_scope_app.py

📝 Walkthrough

Walkthrough

WebhookSerializer now hides secret_key by default. Create and regeneration endpoints explicitly enable its serialization. Contract tests cover omission from read and patch responses and inclusion in create and regeneration responses.

Changes

Webhook secret_key scoping

Layer / File(s)	Summary
Serializer secret_key gating `apps/api/plane/app/serializers/webhook.py`	`WebhookSerializer.to_representation` removes `secret_key` unless `context["show_secret_key"]` is truthy.
Endpoint context wiring `apps/api/plane/app/views/webhook/base.py`	Create and regeneration responses pass `show_secret_key: True` to `WebhookSerializer`.
Regression tests for secret_key scope `apps/api/plane/tests/contract/app/test_webhook_secret_key_scope_app.py`	Tests verify endpoint and direct serializer behavior for secret key omission and inclusion.

Estimated code review effort: 2 (Simple) | ~12 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant WebhookEndpoint
  participant WebhookSerializer
  Client->>WebhookEndpoint: POST create or regenerate webhook
  WebhookEndpoint->>WebhookSerializer: instantiate with show_secret_key True
  WebhookSerializer->>WebhookSerializer: check serialization context
  WebhookSerializer-->>WebhookEndpoint: serialized data including secret_key
  WebhookEndpoint-->>Client: response with secret_key

Possibly related PRs

makeplane/plane#9398: Updates WebhookSerializer to control when Webhook.secret_key appears in serialized responses.

Suggested reviewers: dheeru0198, pablohashescobar

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description explains the vulnerability, fix, behavior, tests, and follow-up work; the missing change-type checkbox is non-critical.
Title check	✅ Passed	The title clearly and concisely identifies the fix for webhook HMAC secret_key leakage on reads.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch web-8103/webhook-secret-key-scope

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

Pull request overview

This PR fixes a security issue where webhook HMAC secret_key was being serialized and returned on webhook list/retrieve/patch responses due to a serializer field-allowlist being silently dropped. The change makes secret_key hidden by default in WebhookSerializer and only revealed when explicitly opted-in via serializer context, preserving the intended one-time reveal behavior on create/regenerate.

Changes:

Hide secret_key by default in WebhookSerializer.to_representation, only returning it when context["show_secret_key"] is true.
Opt-in to secret reveal for webhook creation and secret regeneration endpoints via show_secret_key=True.
Add contract regression tests ensuring list/retrieve/patch never leak secret_key, while create/regenerate still reveal it.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
apps/api/plane/app/serializers/webhook.py	Filters `secret_key` out of serialized output by default; supports explicit reveal via serializer context flag.
apps/api/plane/app/views/webhook/base.py	Passes `show_secret_key=True` only on create and secret regeneration responses.
apps/api/plane/tests/contract/app/test_webhook_secret_key_scope_app.py	Adds regression tests covering both non-leak and reveal-once cases.

sriramveeraghanta

Solid fix — verified the claims against the codebase before commenting:

DynamicBaseSerializer.__init__ does discard the caller's fields= (apps/api/plane/app/serializers/base.py:16-18), and WebhookSerializer has no consumer outside app/views/webhook/base.py (the one test usage never serializes), so the blast-radius statement holds.
The contract matches the web frontend: apps/web/core/store/workspace/webhook.store.ts only reads secret_key off the create (createWebhook) and regenerate (regenerateSecretKey) responses — list/retrieve/patch never used it. No client breakage expected.
Test fixtures/routes/markers all line up (session_client + workspace give a workspace ADMIN; contract marker is registered in apps/api/pytest.ini).

Three small, non-blocking suggestions inline.

@sriramveeraghanta

…resentation Per review (@sriramveeraghanta): - Patch the network boundary (validate_url) instead of the whole private _validate_webhook_url method, so the domain/schema checks still run and the test survives a rename of the private method. - Add an assertion that an explicit fields=("secret_key",) request still hides the key, pinning to_representation as the enforcement point so a future DynamicBaseSerializer._filter_fields fix can't silently re-open the leak. Co-authored-by: Plane AI <noreply@plane.so>

mguptahub · 2026-07-20T05:40:20Z

Thanks @sriramveeraghanta — addressed in 1936de0:

Patch the network boundary, not the private method — test_create_reveals_secret_key now does monkeypatch.setattr("plane.app.serializers.webhook.validate_url", lambda *a, **k: None). The domain/schema checks in _validate_webhook_url still run for example.com, and the test no longer breaks if the private method is renamed.
Pin to_representation as the enforcement point — added assert "secret_key" not in WebhookSerializer(webhook, fields=("secret_key",)).data, so an explicit fields= request can't silently re-open the leak if the base-class allowlist is fixed later.

On your first point: agreed, and to spell it out — DynamicBaseSerializer._filter_fields builds allowed but never actually restricts (return self.fields unfiltered), so both the discarded fields= in __init__ and the fields=(...) kwargs in views/webhook/base.py are no-ops on two levels. That base-class redesign (and auditing the workspace/project member serializers that rely on the same allowlist) is the separate follow-up; this PR deliberately enforces at to_representation so it holds regardless of that fix. 6/6 contract tests green.

@sriramveeraghanta

The previous comment named only DynamicBaseSerializer.__init__ discarding the caller's fields=, which is half the root cause. _filter_fields never removes anything either: it builds `allowed` purely to attach expansion serializers for names not already on the serializer, then returns self.fields unfiltered (serializers/base.py:45-119). So the fields= kwargs in views/webhook/base.py are no-ops on two independent levels. Documented so a future `fields = fields or self.expand` fix isn't assumed to re-activate the allowlists for confidentiality — _filter_fields has to be made restrictive first. The show_secret_key context flag remains the sole enforcement point. Addresses @sriramveeraghanta's review on #9382. 6/6 contract tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

github-actions · 2026-07-31T11:44:07Z

React Doctor found 29 new issues in 27 files · 1 error & 28 warnings · score 72 / 100 (Needs work) · 67 fixed · vs preview

Errors

❌ core/components/pages/editor/editor-body.tsx:194 Server and client render different branches no-hydration-branch-on-browser-global

28 warnings

app/(all)/[workspaceSlug]/(projects)/extended-sidebar.tsx

⚠️ L38 Chained array iterations js-combine-iterations

core/components/gantt-chart/chart/main-content.tsx

⚠️ L31 Import from a barrel file no-barrel-import

core/components/home/home-dashboard-widgets.tsx

⚠️ L23 Import from a barrel file no-barrel-import

core/components/issues/issue-detail-widgets/action-buttons.tsx

⚠️ L14 Import from a barrel file no-barrel-import

core/components/issues/issue-detail-widgets/issue-detail-widget-collapsibles.tsx

⚠️ L15 Import from a barrel file no-barrel-import

core/components/issues/issue-detail/issue-activity/activity/actions/helpers/activity-block.tsx

⚠️ L15 Import from a barrel file no-barrel-import

core/components/issues/issue-detail/issue-activity/activity/actions/relation.tsx

⚠️ L15 Import from a barrel file no-barrel-import

core/components/issues/issue-detail/issue-activity/activity/activity-list.tsx

⚠️ L14 Import from a barrel file no-barrel-import

core/components/issues/issue-detail/main-content.tsx

⚠️ L31 Import from a barrel file no-barrel-import

core/components/issues/issue-detail/sidebar.tsx

⚠️ L42 Import from a barrel file no-barrel-import

core/components/issues/issue-layouts/kanban/kanban-group.tsx

⚠️ L47 Import from a barrel file no-barrel-import

core/components/issues/issue-layouts/list/list-group.tsx

⚠️ L38 Import from a barrel file no-barrel-import
⚠️ L240 Missing effect dependencies exhaustive-deps

core/components/issues/issue-layouts/quick-action-dropdowns/issue-detail.tsx

⚠️ L152 Chained array iterations js-combine-iterations

core/components/issues/issue-layouts/quick-add/root.tsx

⚠️ L20 Import from a barrel file no-barrel-import

core/components/issues/issue-layouts/spreadsheet/columns/label-column.tsx

⚠️ L14 Import from a barrel file no-barrel-import

core/components/issues/issue-layouts/spreadsheet/spreadsheet-view.tsx

⚠️ L22 Import from a barrel file no-barrel-import

core/components/issues/peek-overview/issue-detail.tsx

⚠️ L29 Import from a barrel file no-barrel-import

core/components/issues/peek-overview/properties.tsx

⚠️ L42 Import from a barrel file no-barrel-import

core/components/issues/workspace-draft/draft-issue-properties.tsx

⚠️ L31 Import from a barrel file no-barrel-import

core/components/license/modal/upgrade-modal.tsx

⚠️ L40 Pure function rebuilt every render prefer-module-scope-pure-function

core/components/navigation/tab-navigation-root.tsx

⚠️ L118 Array lookup inside a loop js-set-map-lookups
⚠️ L121 Array lookup inside a loop js-set-map-lookups

core/components/onboarding/tour/sidebar.tsx

⚠️ L61 Click handler missing keyboard handler click-events-have-key-events

core/components/pages/editor/page-root.tsx

⚠️ L26 Import from a barrel file no-barrel-import

core/components/pages/header/actions.tsx

⚠️ L13 Import from a barrel file no-barrel-import

core/store/issue/root.store.ts

⚠️ L19 Import from a barrel file no-barrel-import

core/store/state.store.ts

⚠️ L128 Accumulator spread in reduce is quadratic no-spread-accumulator-in-reduce

_{Reviewed by React Doctor for commit 3401236. See inline comments for fixes.}

Explanations kept unchanged; only the IDs are removed. Co-authored-by: Plane AI <noreply@plane.so>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Copilot AI lite review requested due to automatic review settings July 9, 2026 10:45

mguptahub requested review from dheeru0198 and pablohashescobar as code owners July 9, 2026 10:45

Copilot started reviewing on behalf of mguptahub July 9, 2026 10:47 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

sriramveeraghanta reviewed Jul 18, 2026

View reviewed changes

Comment thread apps/api/plane/app/serializers/webhook.py Outdated

Comment thread apps/api/plane/tests/contract/app/test_webhook_secret_key_scope_app.py Outdated

Comment thread apps/api/plane/tests/contract/app/test_webhook_secret_key_scope_app.py

coderabbitai Bot mentioned this pull request Jul 23, 2026

feat(api): manage workspace webhooks via the public token API #9398

Open

6 tasks

Copilot AI review requested due to automatic review settings July 31, 2026 11:43

Copilot AI reviewed Jul 31, 2026

mguptahub changed the title ~~[WEB-8103] fix: stop leaking webhook HMAC secret_key on reads (GHSA-83rj)~~ [WEB-8103] fix: stop leaking webhook HMAC secret_key on reads Aug 7, 2026

chore(security): drop advisory identifiers from code comments

3401236

Explanations kept unchanged; only the IDs are removed. Co-authored-by: Plane AI <noreply@plane.so>

Copilot AI review requested due to automatic review settings August 7, 2026 10:34

Copilot started reviewing on behalf of mguptahub August 7, 2026 10:36 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

[WEB-8103] fix: stop leaking webhook HMAC secret_key on reads - #9382

[WEB-8103] fix: stop leaking webhook HMAC secret_key on reads#9382
mguptahub wants to merge 4 commits into
previewfrom
web-8103/webhook-secret-key-scope

mguptahub commented Jul 9, 2026 •

edited

Loading

Uh oh!

makeplane Bot commented Jul 9, 2026

Uh oh!

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Copilot AI left a comment

Uh oh!

sriramveeraghanta left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mguptahub commented Jul 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mguptahub commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Tests

Follow-up

Summary by CodeRabbit

Uh oh!

makeplane Bot commented Jul 9, 2026

Uh oh!

coderabbitai Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

sriramveeraghanta left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mguptahub commented Jul 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mguptahub commented Jul 9, 2026 •

edited

Loading

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading