{"action":"created","comment":{"url":"https://api.github.com/repos/avanier/knowngithub/pulls/comments/153776638","pull_request_review_id":79833425,"id":153776638,"diff_hunk":"@@ -1,5 +1,52 @@\n+require 'ipaddr'\n+require 'json'\n+require 'net/http'\n+require 'net/ssh'\n+require 'nokogiri'\n+require 'open-uri'\n require \"knowngithub/version\"\n \n module Knowngithub\n-  # Your code goes here...\n+  def self.fingerprints\n+    output = Nokogiri::HTML(open(\"https://help.github.com/articles/github-s-ssh-key-fingerprints/\"))\n+    fields = output.xpath(\"//code\")\n+    return fields.children.map(&:content)\n+  end\n+\n+  def self.session\n+    s = Net::SSH::Transport::Session.new('github.com', { :verify_host_key => true })\n+    s.close\n+    s\n+  end\n+\n+  def self.host\n+    s = self.session\n+    if self.fingerprints.any?{|f| f == s.host_keys.first.fingerprint}\n+      base64_key = [Net::SSH::Buffer.from(:key, s.host_keys.first).to_s].pack(\"m*\").gsub(/\\s/, \"\")","path":"lib/knowngithub.rb","position":40,"original_position":26,"commit_id":"50fe41fddafd7821622034d0d326094401b42bda","original_commit_id":"94564f2915f0e3ff9d0dc8f5e2bcba702765b937","user":{"login":"avanier","id":4009658,"avatar_url":"https://avatars2.githubusercontent.com/u/4009658?v=4","gravatar_id":"","url":"https://api.github.com/users/avanier","html_url":"https://github.com/avanier","followers_url":"https://api.github.com/users/avanier/followers","following_url":"https://api.github.com/users/avanier/following{/other_user}","gists_url":"https://api.github.com/users/avanier/gists{/gist_id}","starred_url":"https://api.github.com/users/avanier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avanier/subscriptions","organizations_url":"https://api.github.com/users/avanier/orgs","repos_url":"https://api.github.com/users/avanier/repos","events_url":"https://api.github.com/users/avanier/events{/privacy}","received_events_url":"https://api.github.com/users/avanier/received_events","type":"User","site_admin":false},"body":"@emkll  In this case, `s.host_keys` defers to a bunlded version `OpenSSL::Pkey` within `Net:SSH`, which defers to the wrapped OpenSSL C library. I honestly can't trace where validation is happening at this point, but the object type for `s.host_keys` values is definitely `Net::SSH::HostKeys` which should prevent most evilness.\r\n\r\nI'm under the impression [this](https://github.com/net-ssh/net-ssh/blob/master/lib/net/ssh/known_hosts.rb#L43) bit makes sure the keys are proper.","created_at":"2017-11-29T12:45:41Z","updated_at":"2017-11-29T12:45:41Z","html_url":"https://github.com/avanier/knowngithub/pull/1#discussion_r153776638","pull_request_url":"https://api.github.com/repos/avanier/knowngithub/pulls/1","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/avanier/knowngithub/pulls/comments/153776638"},"html":{"href":"https://github.com/avanier/knowngithub/pull/1#discussion_r153776638"},"pull_request":{"href":"https://api.github.com/repos/avanier/knowngithub/pulls/1"}},"in_reply_to_id":153675491},"pull_request":{"url":"https://api.github.com/repos/avanier/knowngithub/pulls/1","id":155226091,"html_url":"https://github.com/avanier/knowngithub/pull/1","diff_url":"https://github.com/avanier/knowngithub/pull/1.diff","patch_url":"https://github.com/avanier/knowngithub/pull/1.patch","issue_url":"https://api.github.com/repos/avanier/knowngithub/issues/1","number":1,"state":"open","locked":false,"title":"Towards a first release","user":{"login":"avanier","id":4009658,"avatar_url":"https://avatars2.githubusercontent.com/u/4009658?v=4","gravatar_id":"","url":"https://api.github.com/users/avanier","html_url":"https://github.com/avanier","followers_url":"https://api.github.com/users/avanier/followers","following_url":"https://api.github.com/users/avanier/following{/other_user}","gists_url":"https://api.github.com/users/avanier/gists{/gist_id}","starred_url":"https://api.github.com/users/avanier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avanier/subscriptions","organizations_url":"https://api.github.com/users/avanier/orgs","repos_url":"https://api.github.com/users/avanier/repos","events_url":"https://api.github.com/users/avanier/events{/privacy}","received_events_url":"https://api.github.com/users/avanier/received_events","type":"User","site_admin":false},"body":"Right now, this doesn't have tests or API documentation, but the basic idea is there, and _\"it works on my machine\"_ :tm: .","created_at":"2017-11-29T01:16:27Z","updated_at":"2017-11-29T12:45:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"63915ed4142646622a142554af781e4f23c56d20","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/avanier/knowngithub/pulls/1/commits","review_comments_url":"https://api.github.com/repos/avanier/knowngithub/pulls/1/comments","review_comment_url":"https://api.github.com/repos/avanier/knowngithub/pulls/comments{/number}","comments_url":"https://api.github.com/repos/avanier/knowngithub/issues/1/comments","statuses_url":"https://api.github.com/repos/avanier/knowngithub/statuses/50fe41fddafd7821622034d0d326094401b42bda","head":{"label":"avanier:do_the_needful","ref":"do_the_needful","sha":"50fe41fddafd7821622034d0d326094401b42bda","user":{"login":"avanier","id":4009658,"avatar_url":"https://avatars2.githubusercontent.com/u/4009658?v=4","gravatar_id":"","url":"https://api.github.com/users/avanier","html_url":"https://github.com/avanier","followers_url":"https://api.github.com/users/avanier/followers","following_url":"https://api.github.com/users/avanier/following{/other_user}","gists_url":"https://api.github.com/users/avanier/gists{/gist_id}","starred_url":"https://api.github.com/users/avanier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avanier/subscriptions","organizations_url":"https://api.github.com/users/avanier/orgs","repos_url":"https://api.github.com/users/avanier/repos","events_url":"https://api.github.com/users/avanier/events{/privacy}","received_events_url":"https://api.github.com/users/avanier/received_events","type":"User","site_admin":false},"repo":{"id":112409135,"name":"knowngithub","full_name":"avanier/knowngithub","owner":{"login":"avanier","id":4009658,"avatar_url":"https://avatars2.githubusercontent.com/u/4009658?v=4","gravatar_id":"","url":"https://api.github.com/users/avanier","html_url":"https://github.com/avanier","followers_url":"https://api.github.com/users/avanier/followers","following_url":"https://api.github.com/users/avanier/following{/other_user}","gists_url":"https://api.github.com/users/avanier/gists{/gist_id}","starred_url":"https://api.github.com/users/avanier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avanier/subscriptions","organizations_url":"https://api.github.com/users/avanier/orgs","repos_url":"https://api.github.com/users/avanier/repos","events_url":"https://api.github.com/users/avanier/events{/privacy}","received_events_url":"https://api.github.com/users/avanier/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/avanier/knowngithub","description":"Don't blindly trust GitHub SSH hosts","fork":false,"url":"https://api.github.com/repos/avanier/knowngithub","forks_url":"https://api.github.com/repos/avanier/knowngithub/forks","keys_url":"https://api.github.com/repos/avanier/knowngithub/keys{/key_id}","collaborators_url":"https://api.github.com/repos/avanier/knowngithub/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/avanier/knowngithub/teams","hooks_url":"https://api.github.com/repos/avanier/knowngithub/hooks","issue_events_url":"https://api.github.com/repos/avanier/knowngithub/issues/events{/number}","events_url":"https://api.github.com/repos/avanier/knowngithub/events","assignees_url":"https://api.github.com/repos/avanier/knowngithub/assignees{/user}","branches_url":"https://api.github.com/repos/avanier/knowngithub/branches{/branch}","tags_url":"https://api.github.com/repos/avanier/knowngithub/tags","blobs_url":"https://api.github.com/repos/avanier/knowngithub/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/avanier/knowngithub/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/avanier/knowngithub/git/refs{/sha}","trees_url":"https://api.github.com/repos/avanier/knowngithub/git/trees{/sha}","statuses_url":"https://api.github.com/repos/avanier/knowngithub/statuses/{sha}","languages_url":"https://api.github.com/repos/avanier/knowngithub/languages","stargazers_url":"https://api.github.com/repos/avanier/knowngithub/stargazers","contributors_url":"https://api.github.com/repos/avanier/knowngithub/contributors","subscribers_url":"https://api.github.com/repos/avanier/knowngithub/subscribers","subscription_url":"https://api.github.com/repos/avanier/knowngithub/subscription","commits_url":"https://api.github.com/repos/avanier/knowngithub/commits{/sha}","git_commits_url":"https://api.github.com/repos/avanier/knowngithub/git/commits{/sha}","comments_url":"https://api.github.com/repos/avanier/knowngithub/comments{/number}","issue_comment_url":"https://api.github.com/repos/avanier/knowngithub/issues/comments{/number}","contents_url":"https://api.github.com/repos/avanier/knowngithub/contents/{+path}","compare_url":"https://api.github.com/repos/avanier/knowngithub/compare/{base}...{head}","merges_url":"https://api.github.com/repos/avanier/knowngithub/merges","archive_url":"https://api.github.com/repos/avanier/knowngithub/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/avanier/knowngithub/downloads","issues_url":"https://api.github.com/repos/avanier/knowngithub/issues{/number}","pulls_url":"https://api.github.com/repos/avanier/knowngithub/pulls{/number}","milestones_url":"https://api.github.com/repos/avanier/knowngithub/milestones{/number}","notifications_url":"https://api.github.com/repos/avanier/knowngithub/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/avanier/knowngithub/labels{/name}","releases_url":"https://api.github.com/repos/avanier/knowngithub/releases{/id}","deployments_url":"https://api.github.com/repos/avanier/knowngithub/deployments","created_at":"2017-11-29T01:15:19Z","updated_at":"2017-11-29T01:15:44Z","pushed_at":"2017-11-29T12:34:43Z","git_url":"git://github.com/avanier/knowngithub.git","ssh_url":"git@github.com:avanier/knowngithub.git","clone_url":"https://github.com/avanier/knowngithub.git","svn_url":"https://github.com/avanier/knowngithub","homepage":null,"size":10,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":1,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit"},"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"base":{"label":"avanier:master","ref":"master","sha":"d0a42054c3e87ab04f2c4980152895d724be2799","user":{"login":"avanier","id":4009658,"avatar_url":"https://avatars2.githubusercontent.com/u/4009658?v=4","gravatar_id":"","url":"https://api.github.com/users/avanier","html_url":"https://github.com/avanier","followers_url":"https://api.github.com/users/avanier/followers","following_url":"https://api.github.com/users/avanier/following{/other_user}","gists_url":"https://api.github.com/users/avanier/gists{/gist_id}","starred_url":"https://api.github.com/users/avanier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avanier/subscriptions","organizations_url":"https://api.github.com/users/avanier/orgs","repos_url":"https://api.github.com/users/avanier/repos","events_url":"https://api.github.com/users/avanier/events{/privacy}","received_events_url":"https://api.github.com/users/avanier/received_events","type":"User","site_admin":false},"repo":{"id":112409135,"name":"knowngithub","full_name":"avanier/knowngithub","owner":{"login":"avanier","id":4009658,"avatar_url":"https://avatars2.githubusercontent.com/u/4009658?v=4","gravatar_id":"","url":"https://api.github.com/users/avanier","html_url":"https://github.com/avanier","followers_url":"https://api.github.com/users/avanier/followers","following_url":"https://api.github.com/users/avanier/following{/other_user}","gists_url":"https://api.github.com/users/avanier/gists{/gist_id}","starred_url":"https://api.github.com/users/avanier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/avanier/subscriptions","organizations_url":"https://api.github.com/users/avanier/orgs","repos_url":"https://api.github.com/users/avanier/repos","events_url":"https://api.github.com/users/avanier/events{/privacy}","received_events_url":"https://api.github.com/users/avanier/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/avanier/knowngithub","description":"Don't blindly trust GitHub SSH hosts","fork":false,"url":"https://api.github.com/repos/avanier/knowngithub","forks_url":"https://api.github.com/repos/avanier/knowngithub/forks","keys_url":"https://api.github.com/repos/avanier/knowngithub/keys{/key_id}","collaborators_url":"https://api.github.com/repos/avanier/knowngithub/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/avanier/knowngithub/teams","hooks_url":"https://api.github.com/repos/avanier/knowngithub/hooks","issue_events_url":"https://api.github.com/repos/avanier/knowngithub/issues/events{/number}","events_url":"https://api.github.com/repos/avanier/knowngithub/events","assignees_url":"https://api.github.com/repos/avanier/knowngithub/assignees{/user}","branches_url":"https://api.github.com/repos/avanier/knowngithub/branches{/branch}","tags_url":"https://api.github.com/repos/avanier/knowngithub/tags","blobs_url":"https://api.github.com/repos/avanier/knowngithub/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/avanier/knowngithub/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/avanier/knowngithub/git/refs{/sha}","trees_url":"https://api.github.com/repos/avanier/knowngithub/git/trees{/sha}","statuses_url":"https://api.github.com/repos/avanier/knowngithub/statuses/{sha}","languages_url":"https://api.github.com/repos/avanier/knowngithub/languages","stargazers_url":"https://api.github.com/repos/avanier/knowngithub/stargazers","contributors_url":"https://api.github.com/repos/avanier/knowngithub/contributors","subscribers_url":"https://api.github.com/repos/avanier/knowngithub/subscribers","subscription_url":"https://api.github.com/repos/avanier/knowngithub/subscription","commits_url":"https://api.github.com/repos/avanier/knowngithub/commits{/sha}","git_commits_url":"https://api.github.com/repos/avanier/knowngithub/git/commits{/sha}","comments_url":"https://api.github.com/repos/avanier/knowngithub/comments{/number}","issue_comment_url":"https://api.github.com/repos/avanier/knowngithub/issues/comments{/number}","contents_url":"https://api.github.com/repos/avanier/knowngithub/contents/{+path}","compare_url":"https://api.github.com/repos/avanier/knowngithub/compare/{base}...{head}","merges_url":"https://api.github.com/repos/avanier/knowngithub/merges","archive_url":"https://api.github.com/repos/avanier/knowngithub/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/avanier/knowngithub/downloads","issues_url":"https://api.github.com/repos/avanier/knowngithub/issues{/number}","pulls_url":"https://api.github.com/repos/avanier/knowngithub/pulls{/number}","milestones_url":"https://api.github.com/repos/avanier/knowngithub/milestones{/number}","notifications_url":"https://api.github.com/repos/avanier/knowngithub/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/avanier/knowngithub/labels{/name}","releases_url":"https://api.github.com/repos/avanier/knowngithub/releases{/id}","deployments_url":"https://api.github.com/repos/avanier/knowngithub/deployments","created_at":"2017-11-29T01:15:19Z","updated_at":"2017-11-29T01:15:44Z","pushed_at":"2017-11-29T12:34:43Z","git_url":"git://github.com/avanier/knowngithub.git","ssh_url":"git@github.com:avanier/knowngithub.git","clone_url":"https://github.com/avanier/knowngithub.git","svn_url":"https://github.com/avanier/knowngithub","homepage":null,"size":10,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":1,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit"},"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/avanier/knowngithub/pulls/1"},"html":{"href":"https://github.com/avanier/knowngithub/pull/1"},"issue":{"href":"https://api.github.com/repos/avanier/knowngithub/issues/1"},"comments":{"href":"https://api.github.com/repos/avanier/knowngithub/issues/1/comments"},"review_comments":{"href":"https://api.github.com/repos/avanier/knowngithub/pulls/1/comments"},"review_comment":{"href":"https://api.github.com/repos/avanier/knowngithub/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/avanier/knowngithub/pulls/1/commits"},"statuses":{"href":"https://api.github.com/repos/avanier/knowngithub/statuses/50fe41fddafd7821622034d0d326094401b42bda"}},"author_association":"OWNER"}}
{"actor":{"display_login":"avanier"}}