@checkstack/healthcheck-ping-backend 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @checkstack/healthcheck-ping-backend
 
+## 0.2.2
+
+### Patch Changes
+
+- 0ebbe56: Security Vulnerability Remediation completed:
+  - Refactored core authorization to Fail-Closed architecture with secure defaults.
+  - Implemented `assertTeamManagementAccess` to resolve BOLA in Teams Management.
+  - Protected internal S2S capabilities via explicit wildcard `serviceScope` definitions.
+  - Disarmed OS Command Injection in DiskCollector via strict regex validation and bash escaping.
+  - Re-architected inline script processing executing scripts in sandboxed Web Worker contexts.
+  - Isolated subprocess environment scopes in PingStrategy limiting variable leakage.
+  - Enforced strict token/API Key parsing with URLSearchParams checking.
+  - Explicitly fail-fast on missing DATABASE_URL configuration across independent backend clusters.
+  - Activated strict HTTP Security Headers (HSTS, CSP, X-Frame-Options) across the API automatically.
+- Updated dependencies [0ebbe56]
+  - @checkstack/backend-api@0.8.1
+  - @checkstack/common@0.6.3
+  - @checkstack/healthcheck-common@0.8.3
+
+## 0.2.1
+
+### Patch Changes
+
+- 869b4ab: ## Health Check Execution Improvements
+
+  ### Breaking Changes (backend-api)
+
+  - `HealthCheckStrategy.createClient()` now accepts `unknown` instead of `TConfig` due to TypeScript contravariance constraints. Implementations should use `this.config.validate(config)` to narrow the type.
+
+  ### Features
+
+  - **Platform-level hard timeout**: The executor now wraps the entire health check execution (connection + all collectors) in a single timeout, ensuring checks never hang indefinitely.
+  - **Parallel collector execution**: Collectors now run in parallel using `Promise.allSettled()`, improving performance while ensuring all collectors complete regardless of individual failures.
+  - **Base strategy config schema**: All strategy configs now extend `baseStrategyConfigSchema` which provides a standardized `timeout` field with sensible defaults (30s, min 100ms).
+
+  ### Fixes
+
+  - Fixed HTTP and Jenkins strategies clearing timeouts before reading the full response body.
+  - Simplified registry type signatures by using default type parameters.
+
+- Updated dependencies [869b4ab]
+  - @checkstack/backend-api@0.8.0
+
 ## 0.2.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-ping-backend",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "type": "module",
   "main": "src/index.ts",
   "scripts": {
@@ -9,9 +9,9 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.5.2",
-    "@checkstack/common": "0.6.1",
-    "@checkstack/healthcheck-common": "0.8.1"
+    "@checkstack/backend-api": "0.8.0",
+    "@checkstack/common": "0.6.2",
+    "@checkstack/healthcheck-common": "0.8.2"
   },
   "devDependencies": {
     "@types/bun": "^1.0.0",

package/src/strategy.test.ts

@@ -202,4 +202,51 @@ describe("PingHealthCheckStrategy", () => {
       expect(aggregated.errorCount.count).toBe(1);
     });
   });
+  describe("Environment Isolation", () => {
+    it("should pass explicit env to Bun.spawn with only PATH, HOME, and LANG", async () => {
+      let spawnOptions: any = null;
+      Bun.spawn = mock((options) => {
+        spawnOptions = options;
+        throw new Error("Command not found");
+      });
+
+      const connectedClient = await strategy.createClient({ timeout: 5000 });
+      await connectedClient.client.exec({
+        host: "8.8.8.8",
+        count: 3,
+        timeout: 5000,
+      });
+
+      expect(spawnOptions).toBeDefined();
+      expect(spawnOptions.env).toBeDefined();
+      expect(spawnOptions.env.PATH).toBeDefined();
+      expect(spawnOptions.env.HOME).toBeDefined();
+      expect(spawnOptions.env.LANG).toBeDefined();
+      expect(spawnOptions.env.DATABASE_URL).toBeUndefined();
+
+      connectedClient.close();
+    });
+
+    it("should not leak parent process environment variables", async () => {
+      let spawnOptions: any = null;
+      Bun.spawn = mock((options) => {
+        spawnOptions = options;
+        throw new Error("Command not found");
+      });
+
+      process.env.SUPER_SECRET = "leaked";
+
+      const connectedClient = await strategy.createClient({ timeout: 5000 });
+      await connectedClient.client.exec({
+        host: "8.8.8.8",
+        count: 3,
+        timeout: 5000,
+      });
+
+      expect(spawnOptions.env.SUPER_SECRET).toBeUndefined();
+      delete process.env.SUPER_SECRET;
+
+      connectedClient.close();
+    });
+  });
 });

package/src/strategy.ts

@@ -12,6 +12,7 @@ import {
   z,
   type ConnectedClient,
   type InferAggregatedResult,
+  baseStrategyConfigSchema,
 } from "@checkstack/backend-api";
 import {
   healthResultNumber,
@@ -32,13 +33,7 @@ import type {
  * Configuration schema for Ping health checks.
  * Global defaults only - action params moved to PingCollector.
  */
-export const pingConfigSchema = z.object({
-  timeout: z
-    .number()
-    .min(100)
-    .default(5000)
-    .describe("Default timeout in milliseconds"),
-});
+export const pingConfigSchema = baseStrategyConfigSchema.extend({});
 
 export type PingConfig = z.infer<typeof pingConfigSchema>;
 
@@ -220,6 +215,12 @@ export class PingHealthCheckStrategy implements HealthCheckStrategy<
         cmd: ["ping", ...args],
         stdout: "pipe",
         stderr: "pipe",
+        env: {
+          // SECURITY: Only pass necessary env vars to subprocess
+          PATH: process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin",
+          HOME: process.env.HOME ?? "/tmp",
+          LANG: process.env.LANG ?? "en_US.UTF-8",
+        },
       });
 
       const output = await new Response(proc.stdout).text();