zendesk_apps_support 4.29.4

data/lib/zendesk_apps_support/validations/marketplace.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module ZendeskAppsSupport
+  module Validations
+    module Marketplace
+      WHITELISTED_EXPERIMENTS = %w[hashParams newCssCompiler].freeze
+
+      class << self
+        def call(package)
+          [no_symlinks(package.root), *no_experiments(package.manifest)].compact
+        end
+
+        private
+
+        def no_symlinks(path)
+          if Dir["#{path}/**/{*,.*}"].any? { |f| File.symlink?(f) }
+            return ValidationError.new(:symlink_in_zip)
+          end
+          nil
+        end
+
+        def no_experiments(manifest)
+          invalid_experiments = manifest.enabled_experiments - WHITELISTED_EXPERIMENTS
+          invalid_experiments.map do |experiment|
+            ValidationError.new(:invalid_experiment, experiment: experiment)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/zendesk_apps_support/validations/mime.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'mimemagic'
+
+module ZendeskAppsSupport
+  module Validations
+    module Mime
+      UNSUPPORTED_MIME_TYPES = %w[
+        vnd.rar rar zip gzip pdf doc docx avi bin bz bz2 csh sh jar mp3 mpeg odt pptx ppt xls xlsx 7z
+      ].freeze
+
+      class << self
+        def call(package)
+          unsupported_files =
+            package.files.find_all { |app_file| block_listed?(app_file) }.map(&:relative_path)
+
+          [mime_type_warning(unsupported_files)] if unsupported_files.any?
+        end
+
+        private
+
+        def block_listed?(app_file)
+          mime_type = MimeMagic.by_magic(app_file.read)
+
+          content_subtype = mime_type.subtype if mime_type
+          extension_name = app_file.extension.delete('.')
+
+          ([content_subtype, extension_name] & UNSUPPORTED_MIME_TYPES).any?
+        end
+
+        def mime_type_warning(file_names)
+          ValidationError.new(
+            :unsupported_mime_type_detected,
+            file_names: file_names.join(', '),
+            count: file_names.count
+          )
+        end
+      end
+    end
+  end
+end

data/lib/zendesk_apps_support/validations/requests.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'ipaddress_2'
+require 'uri'
+
+module ZendeskAppsSupport
+  module Validations
+    module Requests
+      class << self
+        def call(package)
+          files = package.js_files + package.html_files
+
+          files.each do |file|
+            file_content = file.read
+
+            http_protocol_urls = find_address_containing_http(file_content)
+            next unless http_protocol_urls.any?
+            package.warnings << insecure_http_requests_warning(
+              http_protocol_urls,
+              file.relative_path
+            )
+          end
+
+          package.warnings.flatten!
+        end
+
+        private
+
+        def insecure_http_requests_warning(http_protocol_urls, relative_path)
+          http_protocol_urls = http_protocol_urls.join(
+            I18n.t('txt.apps.admin.error.app_build.listing_comma')
+          )
+
+          I18n.t(
+            'txt.apps.admin.warning.app_build.insecure_http_request',
+            uri: http_protocol_urls,
+            file: relative_path
+          )
+        end
+
+        def find_address_containing_http(file_content)
+          file_content.scan(URI.regexp(['http'])).map(&:compact).map(&:last)
+        end
+      end
+    end
+  end
+end

data/lib/zendesk_apps_support/validations/requirements.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+module ZendeskAppsSupport
+  module Validations
+    module Requirements
+      MAX_REQUIREMENTS = 5000
+      MAX_CUSTOM_OBJECTS_REQUIREMENTS = 50
+
+      class << self
+        def call(package)
+          if package.manifest.requirements_only? && !package.has_requirements?
+            return [ValidationError.new(:missing_requirements)]
+          elsif !supports_requirements(package) && package.has_requirements?
+            return [ValidationError.new(:requirements_not_supported)]
+          elsif !package.has_requirements?
+            return []
+          end
+
+          begin
+            requirements = package.requirements_json
+          rescue ZendeskAppsSupport::Manifest::OverrideError => e
+            return [ValidationError.new(:duplicate_requirements, duplicate_keys: e.key, count: 1)]
+          end
+
+          [].tap do |errors|
+            errors << invalid_requirements_types(requirements)
+            errors << excessive_requirements(requirements)
+            errors << excessive_custom_objects_requirements(requirements)
+            errors << invalid_channel_integrations(requirements)
+            errors << invalid_custom_fields(requirements)
+            errors << invalid_custom_objects(requirements)
+            errors << missing_required_fields(requirements)
+            errors.flatten!
+            errors.compact!
+          end
+        rescue JSON::ParserError => e
+          return [ValidationError.new(:requirements_not_json, errors: e)]
+        end
+
+        private
+
+        def supports_requirements(package)
+          !package.manifest.marketing_only? && package.manifest.products_ignore_locations != [Product::CHAT]
+        end
+
+        def missing_required_fields(requirements)
+          [].tap do |errors|
+            requirements.each do |requirement_type, requirement|
+              next if %w[channel_integrations custom_objects].include? requirement_type
+              requirement.each do |identifier, fields|
+                next if fields.nil? || fields.include?('title')
+                errors << ValidationError.new(:missing_required_fields,
+                                              field: 'title',
+                                              identifier: identifier)
+              end
+            end
+          end
+        end
+
+        def excessive_requirements(requirements)
+          count = requirements.values.map do |req|
+            req.is_a?(Hash) ? req.values : req
+          end.flatten.size
+          ValidationError.new(:excessive_requirements, max: MAX_REQUIREMENTS, count: count) if count > MAX_REQUIREMENTS
+        end
+
+        def excessive_custom_objects_requirements(requirements)
+          custom_objects = requirements[AppRequirement::CUSTOM_OBJECTS_KEY]
+          return unless custom_objects
+
+          count = custom_objects.values.flatten.size
+          if count > MAX_CUSTOM_OBJECTS_REQUIREMENTS
+            ValidationError.new(:excessive_custom_objects_requirements, max: MAX_CUSTOM_OBJECTS_REQUIREMENTS,
+                                                                        count: count)
+          end
+        end
+
+        def invalid_custom_fields(requirements)
+          user_fields = requirements['user_fields']
+          organization_fields = requirements['organization_fields']
+          return if user_fields.nil? && organization_fields.nil?
+          [].tap do |errors|
+            [user_fields, organization_fields].compact.each do |field_group|
+              field_group.each do |identifier, fields|
+                next if fields.include? 'key'
+                errors << ValidationError.new(:missing_required_fields,
+                                              field: 'key',
+                                              identifier: identifier)
+              end
+            end
+          end
+        end
+
+        def invalid_channel_integrations(requirements)
+          channel_integrations = requirements['channel_integrations']
+          return unless channel_integrations
+          [].tap do |errors|
+            if channel_integrations.size > 1
+              errors << ValidationError.new(:multiple_channel_integrations)
+            end
+            channel_integrations.each do |identifier, fields|
+              next if fields.include? 'manifest_url'
+              errors << ValidationError.new(:missing_required_fields,
+                                            field: 'manifest_url',
+                                            identifier: identifier)
+            end
+          end
+        end
+
+        def invalid_custom_objects(requirements)
+          custom_objects = requirements[AppRequirement::CUSTOM_OBJECTS_KEY]
+          return if custom_objects.nil?
+
+          [].tap do |errors|
+            unless custom_objects.key?(AppRequirement::CUSTOM_OBJECTS_TYPE_KEY)
+              errors << ValidationError.new(:missing_required_fields,
+                                            field: AppRequirement::CUSTOM_OBJECTS_TYPE_KEY,
+                                            identifier: AppRequirement::CUSTOM_OBJECTS_KEY)
+            end
+
+            valid_schema = {
+              AppRequirement::CUSTOM_OBJECTS_TYPE_KEY => %w[key schema],
+              AppRequirement::CUSTOM_OBJECTS_RELATIONSHIP_TYPE_KEY => %w[key source target]
+            }
+
+            valid_schema.keys.each do |requirement_type|
+              (custom_objects[requirement_type] || []).each do |requirement|
+                validate_custom_objects_keys(requirement.keys, valid_schema[requirement_type], requirement_type, errors)
+              end
+            end
+          end
+        end
+
+        def invalid_requirements_types(requirements)
+          invalid_types = requirements.keys - ZendeskAppsSupport::AppRequirement::TYPES
+          unless invalid_types.empty?
+            ValidationError.new(:invalid_requirements_types,
+                                invalid_types: invalid_types.join(', '),
+                                count: invalid_types.length)
+          end
+        end
+
+        def validate_custom_objects_keys(keys, expected_keys, identifier, errors = [])
+          missing_keys = expected_keys - keys
+          missing_keys.each do |key|
+            errors << ValidationError.new(:missing_required_fields,
+                                          field: key,
+                                          identifier: identifier)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/zendesk_apps_support/validations/secrets.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module ZendeskAppsSupport
+  module Validations
+    module Secrets
+      SECRET_KEYWORDS = %w[
+        password secret secretToken secret_token auth_key
+        authKey auth_pass authPass auth_user AuthUser api_key
+      ].freeze
+
+      APPLICATION_SECRETS = {
+        # rubocop:disable Metrics/LineLength
+        'Slack Token' => /(xox[p|b|o|a]-*.[a-z0-9])/,
+        'RSA Private Key' => /-----BEGIN RSA PRIVATE KEY-----/,
+        'SSH Private Key (OpenSSH)' => /-----BEGIN OPENSSH PRIVATE KEY-----/,
+        'SSH Private Key (DSA)' => /-----BEGIN DSA PRIVATE KEY-----/,
+        'SSH Private Key (EC)' => /-----BEGIN EC PRIVATE KEY-----/,
+        'PGP Private Key Block' => /-----BEGIN PGP PRIVATE KEY BLOCK-----/,
+        'Facebook OAuth Token' => /([f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K]( [|:\"=-]|[:\"=-|]).*.[0-9a-f]{24,36})/,
+        'Twitter OAuth Token' => /([t|T][w|W][i|I][t|T][t|T][e|E][r|R]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z]{30,45})/,
+        'Github Token' => /([g|G][i|I][t|T][h|H][u|U][b|B]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z]{30,45})/,
+        'Google OAuth Token' => /([c|C][l|L][i|I][e|E][n|N][t|T][\-_][s|S][e|E][c|C][r|R][e|E][t|T]( [:\"=-]|[:\"=-]).*[a-zA-Z0-9\-_]{16,32})/,
+        'AWS Access Key ID' => /(AKIA[0-9A-Z]{8,24})/,
+        'AWS Secret Access Key' => /([a|A][w|W][s|S][_-][s|S][e|E][c|C][r|R][e|E][t|T][_-][a|A][c|C][c|C][e|E][s|S][s|S][_-][k|K][e|E][y|Y].*.[0-9a-zA-Z]{24,48})/,
+        'Heroku API Key' => /([h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{6,18})/,
+        'Quickpay Secret' => /(quickpay_secret:.*.[0-9a-zA-Z]{24,72})/,
+        'Doorman Secret' => /([d|D][o|O][o|O][r|R][m|M][a|A][n|N][-_][s|S][e|E][c|C][r|R][e|E][t|T].*.[0-9a-f]{16,132})/,
+        'Shared Session Secret' => /(shared_session_secret.*.[0-9a-f]{4,132})/,
+        'Permanent Cookie Secret' => /(permanent_cookie_secret.*.[0-9a-f]{120,156})/,
+        'Scarlett AWS Secret Key' => /([sS][cC][aA][rR][lL][eE][tT][tT][_-][aA][wW][sS][_-][sS][eE][cC][rR][eE][tT][_-][kK][eE][yY].*.[0-9a-zA-Z+.]{35,45})/,
+        'Braintree Key' => /(braintree_key.*.[0-9a-zA-Z]{16,36})/,
+        'Ticket Validation Key' => /(ticket_validation_key.*.[0-9a-zA-Z]{15,25})/,
+        'App Key' => /([aA][pP][pP][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'App Secret' => /([aA][pP][pP][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Consumer Key' => /([cC][oO][nN][sS][uU][mM][eE][rR][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Consumer Secret' => /([cC][oO][nN][sS][uU][mM][eE][rR][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Generic Secret' => /(?m)^([sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Master Key' => /([mM][aA][sS][tT][eE][rR][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Master Secret' => /([mM][aA][sS][tT][eE][rR][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Token Key' => /([tT][oO][kK][eE][nN][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Token Secret' => /([tT][oO][kK][eE][nN][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Zendesk Zopim Mobile SSO Key' => /(zendesk_zopim_mobile_sso_key.*.[0-9a-f]{58,68})/,
+        'Help Center Private Key' => /([pP][rR][iI][vV][aA][tT][eE][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
+        'X-Outbound-Key' => /([xX][-][oO][uU][tT][bB][oO][uU][nN][dD][-][kK][eE][yY][:\" \t=-].*.[0-9a-z-]{32,36})/,
+        'Attachment Token Key' => /(attachment_token_key.*.[0-9a-f]{24,72})/,
+        'Password' => /([pP][aA][sS][sS][wW][oO][rR][dD].*.[0-9a-zA-Z+_.-]{4,156})/,
+        'Token' => /([tT][oO][kK][eE][nN]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/
+        # rubocop:enable Metrics/LineLength
+      }.freeze
+
+      class << self
+        def call(package)
+          compromised_files = package.text_files.map do |file|
+            contents = file.read
+
+            APPLICATION_SECRETS.each do |secret_type, regex_str|
+              next unless contents =~ Regexp.new(regex_str)
+              package.warnings << I18n.t('txt.apps.admin.warning.app_build.application_secret',
+                                         file: file.relative_path,
+                                         secret_type: secret_type)
+            end
+
+            match = Regexp.union(SECRET_KEYWORDS).match(contents)
+            "#{file.relative_path} ('#{match[0]}...')" if match
+          end.compact
+
+          return unless compromised_files.any?
+          package.warnings << I18n.t('txt.apps.admin.warning.app_build.generic_secrets',
+                                     files: compromised_files.join(
+                                       I18n.t('txt.apps.admin.error.app_build.listing_comma')
+                                     ),
+                                     count: compromised_files.count)
+        end
+      end
+    end
+  end
+end

data/lib/zendesk_apps_support/validations/secure_settings.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module ZendeskAppsSupport
+  module Validations
+    module SecureSettings
+      SECURABLE_KEYWORDS = %w[token key pwd password].freeze
+      SECURABLE_KEYWORDS_REGEXP = Regexp.new(SECURABLE_KEYWORDS.join('|'), Regexp::IGNORECASE)
+
+      class << self
+        def call(package)
+          manifest_params = package.manifest.parameters
+
+          insecure_params_found = manifest_params.any? { |param| insecure_param?(param) }
+
+          package.warnings << secure_settings_warning if insecure_params_found
+        end
+
+        private
+
+        def insecure_param?(parameter)
+          parameter.name =~ SECURABLE_KEYWORDS_REGEXP && type_password_or_text?(parameter.type) && !parameter.secure
+        end
+
+        def type_password_or_text?(parameter_type)
+          parameter_type == 'text' || parameter_type == 'password'
+        end
+
+        def secure_settings_warning
+          I18n.t(
+            'txt.apps.admin.error.app_build.translation.insecure_token_parameter_in_manifest',
+            link: 'https://developer.zendesk.com/apps/docs/developer-guide/using_sdk#using-secure-settings'
+          )
+        end
+      end
+    end
+  end
+end

data/lib/zendesk_apps_support/validations/source.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module ZendeskAppsSupport
+  module Validations
+    module Source
+      class << self
+        def call(package)
+          if app_doesnt_require_source?(package.manifest) && contain_source_files?(package)
+            ValidationError.new(:no_source_required_apps)
+          end
+        end
+
+        private
+
+        def contain_source_files?(package)
+          package.js_files.any? || package.template_files.any? || !package.app_css.empty?
+        end
+
+        def app_doesnt_require_source?(manifest)
+          manifest.requirements_only? || manifest.marketing_only?
+        end
+      end
+    end
+  end
+end

data/lib/zendesk_apps_support/validations/stylesheets.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'zendesk_apps_support/stylesheet_compiler'
+
+module ZendeskAppsSupport
+  module Validations
+    module Stylesheets
+      class << self
+        def call(package)
+          css_error = validate_styles(package.app_css)
+          css_error ? [css_error] : []
+        end
+
+        private
+
+        def validate_styles(css)
+          compiler = ZendeskAppsSupport::StylesheetCompiler.new(css, nil, nil)
+          begin
+            compiler.compile
+          rescue SassC::SyntaxError, Sass::SyntaxError => e
+            return ValidationError.new(:stylesheet_error, sass_error: e.message)
+          end
+          nil
+        end
+      end
+    end
+  end
+end