verify_signature before adding body to sentry event

src/api.rs

@@ -79,6 +79,12 @@ where
         let type_header = extract_header(GITEA_EVENT_TYPE_HEADER_NAME, headers)?;
         let body_bytes = read_body(req.into_body()).await?;
 
+        verify_signature(
+            app_state.config.webhook_secret.as_bytes(),
+            &sig_header,
+            &body_bytes,
+        )?;
+
         let body_str = String::from_utf8_lossy(&body_bytes).into_owned();
         sentry::configure_scope(|scope| {
             scope.add_event_processor(move |mut event| {
@@ -89,12 +95,6 @@ where
             });
         });
 
-        verify_signature(
-            app_state.config.webhook_secret.as_bytes(),
-            &sig_header,
-            &body_bytes,
-        )?;
-
         let webhook = parse_webhook(&type_header, &app_state.config.bot_name, &body_bytes)?;
         Ok(WebhookExtract(webhook))
     }