@oneuptime/common 10.0.19 → 10.0.21

package/Server/Services/LogAggregationService.ts

@@ -0,0 +1,251 @@
+import { SQL, Statement } from "../Utils/AnalyticsDatabase/Statement";
+import LogDatabaseService from "./LogService";
+import TableColumnType from "../../Types/AnalyticsDatabase/TableColumnType";
+import { JSONObject } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
+
+export interface HistogramBucket {
+  time: string;
+  severity: string;
+  count: number;
+}
+
+export interface HistogramRequest {
+  projectId: ObjectID;
+  startTime: Date;
+  endTime: Date;
+  bucketSizeInMinutes: number;
+  serviceIds?: Array<ObjectID> | undefined;
+  severityTexts?: Array<string> | undefined;
+  bodySearchText?: string | undefined;
+  traceIds?: Array<string> | undefined;
+  spanIds?: Array<string> | undefined;
+}
+
+export interface FacetValue {
+  value: string;
+  count: number;
+}
+
+export interface FacetRequest {
+  projectId: ObjectID;
+  startTime: Date;
+  endTime: Date;
+  facetKey: string;
+  limit?: number | undefined;
+  serviceIds?: Array<ObjectID> | undefined;
+  severityTexts?: Array<string> | undefined;
+  bodySearchText?: string | undefined;
+  traceIds?: Array<string> | undefined;
+  spanIds?: Array<string> | undefined;
+}
+
+export class LogAggregationService {
+  private static readonly DEFAULT_FACET_LIMIT: number = 10;
+  private static readonly TABLE_NAME: string = "LogItem";
+
+  @CaptureSpan()
+  public static async getHistogram(
+    request: HistogramRequest,
+  ): Promise<Array<HistogramBucket>> {
+    const statement: Statement =
+      LogAggregationService.buildHistogramStatement(request);
+
+    const dbResult: Results = await LogDatabaseService.executeQuery(statement);
+    const response: DbJSONResponse = await dbResult.json<{
+      data?: Array<JSONObject>;
+    }>();
+
+    const rows: Array<JSONObject> = response.data || [];
+
+    return rows.map((row: JSONObject): HistogramBucket => {
+      return {
+        time: String(row["bucket"] || ""),
+        severity: String(row["severityText"] || "Unspecified"),
+        count: Number(row["cnt"] || 0),
+      };
+    });
+  }
+
+  @CaptureSpan()
+  public static async getFacetValues(
+    request: FacetRequest,
+  ): Promise<Array<FacetValue>> {
+    const statement: Statement =
+      LogAggregationService.buildFacetStatement(request);
+
+    const dbResult: Results = await LogDatabaseService.executeQuery(statement);
+    const response: DbJSONResponse = await dbResult.json<{
+      data?: Array<JSONObject>;
+    }>();
+
+    const rows: Array<JSONObject> = response.data || [];
+
+    return rows
+      .map((row: JSONObject): FacetValue => {
+        return {
+          value: String(row["val"] || ""),
+          count: Number(row["cnt"] || 0),
+        };
+      })
+      .filter((facet: FacetValue): boolean => {
+        return facet.value.length > 0;
+      });
+  }
+
+  private static buildHistogramStatement(request: HistogramRequest): Statement {
+    const intervalSeconds: number = request.bucketSizeInMinutes * 60;
+
+    const statement: Statement = SQL`
+      SELECT
+        toStartOfInterval(time, INTERVAL ${{
+          type: TableColumnType.Number,
+          value: intervalSeconds,
+        }} SECOND) AS bucket,
+        severityText,
+        count() AS cnt
+      FROM ${LogAggregationService.TABLE_NAME}
+      WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: request.projectId,
+      }}
+        AND time >= ${{
+          type: TableColumnType.Date,
+          value: request.startTime,
+        }}
+        AND time <= ${{
+          type: TableColumnType.Date,
+          value: request.endTime,
+        }}
+    `;
+
+    LogAggregationService.appendCommonFilters(statement, request);
+
+    statement.append(" GROUP BY bucket, severityText ORDER BY bucket ASC");
+
+    return statement;
+  }
+
+  private static buildFacetStatement(request: FacetRequest): Statement {
+    const limit: number =
+      request.limit ?? LogAggregationService.DEFAULT_FACET_LIMIT;
+
+    const isTopLevelColumn: boolean = LogAggregationService.isTopLevelColumn(
+      request.facetKey,
+    );
+
+    const escapedKey: string = LogAggregationService.escapeSingleQuotes(
+      request.facetKey,
+    );
+
+    const valueExpression: string = isTopLevelColumn
+      ? `toString(${escapedKey})`
+      : `JSONExtractRaw(attributes, '${escapedKey}')`;
+
+    // Build with raw SQL for the expression part, then parameterize WHERE values
+    const statement: Statement = new Statement();
+
+    statement.append(
+      `SELECT ${valueExpression} AS val, count() AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
+    );
+
+    statement.append(
+      SQL` WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: request.projectId,
+      }} AND time >= ${{
+        type: TableColumnType.Date,
+        value: request.startTime,
+      }} AND time <= ${{
+        type: TableColumnType.Date,
+        value: request.endTime,
+      }}`,
+    );
+
+    if (!isTopLevelColumn) {
+      statement.append(` AND JSONHas(attributes, '${escapedKey}') = 1`);
+    }
+
+    LogAggregationService.appendCommonFilters(statement, request);
+
+    statement.append(
+      SQL` GROUP BY val ORDER BY cnt DESC LIMIT ${{
+        type: TableColumnType.Number,
+        value: limit,
+      }}`,
+    );
+
+    return statement;
+  }
+
+  private static appendCommonFilters(
+    statement: Statement,
+    request: Pick<
+      HistogramRequest,
+      "serviceIds" | "severityTexts" | "bodySearchText" | "traceIds" | "spanIds"
+    >,
+  ): void {
+    if (request.serviceIds && request.serviceIds.length > 0) {
+      const idStrings: Array<string> = request.serviceIds.map(
+        (id: ObjectID): string => {
+          return `'${id.toString()}'`;
+        },
+      );
+      statement.append(` AND serviceId IN (${idStrings.join(",")})`);
+    }
+
+    if (request.severityTexts && request.severityTexts.length > 0) {
+      const sevStrings: Array<string> = request.severityTexts.map(
+        (s: string): string => {
+          return `'${LogAggregationService.escapeSingleQuotes(s)}'`;
+        },
+      );
+      statement.append(` AND severityText IN (${sevStrings.join(",")})`);
+    }
+
+    if (request.traceIds && request.traceIds.length > 0) {
+      const traceStrings: Array<string> = request.traceIds.map(
+        (s: string): string => {
+          return `'${LogAggregationService.escapeSingleQuotes(s)}'`;
+        },
+      );
+      statement.append(` AND traceId IN (${traceStrings.join(",")})`);
+    }
+
+    if (request.spanIds && request.spanIds.length > 0) {
+      const spanStrings: Array<string> = request.spanIds.map(
+        (s: string): string => {
+          return `'${LogAggregationService.escapeSingleQuotes(s)}'`;
+        },
+      );
+      statement.append(` AND spanId IN (${spanStrings.join(",")})`);
+    }
+
+    if (request.bodySearchText && request.bodySearchText.trim().length > 0) {
+      statement.append(
+        ` AND body ILIKE ${{
+          type: TableColumnType.Text,
+          value: `%${request.bodySearchText.trim()}%`,
+        }}`,
+      );
+    }
+  }
+
+  private static isTopLevelColumn(key: string): boolean {
+    const topLevelColumns: Set<string> = new Set([
+      "severityText",
+      "serviceId",
+      "traceId",
+      "spanId",
+    ]);
+    return topLevelColumns.has(key);
+  }
+
+  private static escapeSingleQuotes(value: string): string {
+    return value.replace(/'/g, "\\'");
+  }
+}
+
+export default LogAggregationService;

package/Server/Utils/VM/VMRunner.ts

@@ -22,6 +22,16 @@ const BLOCKED_SANDBOX_PROPERTIES: ReadonlySet<string> = new Set([
   "__proto__",
   "prototype",
   "mainModule",
+  /*
+   * Block Playwright methods that can spawn processes or access internals.
+   * Prevents RCE via browser.browserType().launch({executablePath:"/bin/sh"})
+   * and traversal via page.context().browser().browserType().launch(...)
+   */
+  "browserType", // Browser → BrowserType (which has launch/connect)
+  "launch", // BrowserType.launch() spawns a child process
+  "launchPersistentContext", // BrowserType.launchPersistentContext() spawns a child process
+  "connectOverCDP", // BrowserType.connectOverCDP() connects via Chrome DevTools Protocol
+  "newCDPSession", // BrowserContext/Page.newCDPSession() opens raw CDP sessions
 ]);
 
 /**
@@ -123,6 +133,27 @@ function createSandboxProxy(
             );
           });
         },
+        getOwnPropertyDescriptor(
+          fnTarget: (...args: unknown[]) => unknown,
+          prop: string | symbol,
+        ): PropertyDescriptor | undefined {
+          if (
+            typeof prop === "string" &&
+            BLOCKED_SANDBOX_PROPERTIES.has(prop)
+          ) {
+            return undefined;
+          }
+          const desc: PropertyDescriptor | undefined =
+            Reflect.getOwnPropertyDescriptor(fnTarget, prop);
+          if (desc && "value" in desc) {
+            desc.value = createSandboxProxy(
+              desc.value,
+              cache,
+              fnTarget as GenericObject,
+            );
+          }
+          return desc;
+        },
       },
     );
     return fnProxy;
@@ -165,6 +196,20 @@ function createSandboxProxy(
         return !(typeof k === "string" && BLOCKED_SANDBOX_PROPERTIES.has(k));
       });
     },
+    getOwnPropertyDescriptor(
+      objTarget: GenericObject,
+      prop: string | symbol,
+    ): PropertyDescriptor | undefined {
+      if (typeof prop === "string" && BLOCKED_SANDBOX_PROPERTIES.has(prop)) {
+        return undefined;
+      }
+      const desc: PropertyDescriptor | undefined =
+        Reflect.getOwnPropertyDescriptor(objTarget, prop);
+      if (desc && "value" in desc) {
+        desc.value = createSandboxProxy(desc.value, cache, objTarget);
+      }
+      return desc;
+    },
   });
 
   cache.set(target, objProxy);

package/Types/Log/LogQueryParser.ts

@@ -0,0 +1,252 @@
+/**
+ * LogQueryParser
+ *
+ * Parses a Datadog-style log search query string into structured filter tokens.
+ *
+ * Supported syntax:
+ *   - Free text:           `connection refused`       → body ILIKE '%connection refused%'
+ *   - Quoted phrase:       `"connection refused"`     → body ILIKE '%connection refused%'
+ *   - Field-specific:      `severity:error`           → severityText = 'error'
+ *   - Attribute access:    `@http.status_code:500`    → attributes.http.status_code = '500'
+ *   - Negation (prefix):   `-severity:debug`          → severityText != 'debug'
+ *   - Wildcard:            `service:api-*`            → serviceId ILIKE 'api-%'
+ *   - Numeric range:       `@duration:>1000`          → attributes.duration > 1000
+ *   - Boolean:             `severity:error AND service:api` (AND is default between tokens)
+ *
+ * Produces an array of ParsedToken objects consumed by the search bar and query builder.
+ */
+
+export enum TokenType {
+  FreeText = "FreeText",
+  FieldFilter = "FieldFilter",
+  AttributeFilter = "AttributeFilter",
+}
+
+export enum FilterOperator {
+  Equals = "Equals",
+  NotEquals = "NotEquals",
+  Contains = "Contains",
+  NotContains = "NotContains",
+  GreaterThan = "GreaterThan",
+  GreaterThanOrEqual = "GreaterThanOrEqual",
+  LessThan = "LessThan",
+  LessThanOrEqual = "LessThanOrEqual",
+  Wildcard = "Wildcard",
+}
+
+export interface ParsedToken {
+  type: TokenType;
+  field?: string;
+  operator: FilterOperator;
+  value: string;
+  negated: boolean;
+  raw: string;
+}
+
+const FIELD_ALIASES: Record<string, string> = {
+  severity: "severityText",
+  level: "severityText",
+  service: "serviceId",
+  trace: "traceId",
+  span: "spanId",
+  message: "body",
+  msg: "body",
+  log: "body",
+};
+
+const BOOLEAN_KEYWORDS: Set<string> = new Set(["AND", "OR", "NOT"]);
+
+function resolveFieldName(raw: string): string {
+  const lower: string = raw.toLowerCase();
+  return FIELD_ALIASES[lower] || raw;
+}
+
+function detectOperator(value: string): {
+  operator: FilterOperator;
+  cleanValue: string;
+} {
+  if (value.startsWith(">=")) {
+    return {
+      operator: FilterOperator.GreaterThanOrEqual,
+      cleanValue: value.slice(2),
+    };
+  }
+
+  if (value.startsWith("<=")) {
+    return {
+      operator: FilterOperator.LessThanOrEqual,
+      cleanValue: value.slice(2),
+    };
+  }
+
+  if (value.startsWith(">")) {
+    return {
+      operator: FilterOperator.GreaterThan,
+      cleanValue: value.slice(1),
+    };
+  }
+
+  if (value.startsWith("<")) {
+    return {
+      operator: FilterOperator.LessThan,
+      cleanValue: value.slice(1),
+    };
+  }
+
+  if (value.includes("*")) {
+    return {
+      operator: FilterOperator.Wildcard,
+      cleanValue: value,
+    };
+  }
+
+  return {
+    operator: FilterOperator.Equals,
+    cleanValue: value,
+  };
+}
+
+function tokenizeRawInput(input: string): Array<string> {
+  const tokens: Array<string> = [];
+  let current: string = "";
+  let inQuotes: boolean = false;
+
+  for (let i: number = 0; i < input.length; i++) {
+    const char: string = input[i]!;
+
+    if (char === '"') {
+      inQuotes = !inQuotes;
+      current += char;
+      continue;
+    }
+
+    if (char === " " && !inQuotes) {
+      if (current.length > 0) {
+        tokens.push(current);
+        current = "";
+      }
+      continue;
+    }
+
+    current += char;
+  }
+
+  if (current.length > 0) {
+    tokens.push(current);
+  }
+
+  return tokens;
+}
+
+function stripQuotes(value: string): string {
+  if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+
+function parseFieldToken(raw: string): ParsedToken {
+  let workingRaw: string = raw;
+  let negated: boolean = false;
+
+  if (workingRaw.startsWith("-")) {
+    negated = true;
+    workingRaw = workingRaw.slice(1);
+  }
+
+  const isAttribute: boolean = workingRaw.startsWith("@");
+
+  if (isAttribute) {
+    workingRaw = workingRaw.slice(1);
+  }
+
+  const colonIndex: number = workingRaw.indexOf(":");
+
+  if (colonIndex === -1) {
+    return {
+      type: TokenType.FreeText,
+      operator: FilterOperator.Contains,
+      value: stripQuotes(workingRaw),
+      negated,
+      raw,
+    };
+  }
+
+  const rawField: string = workingRaw.slice(0, colonIndex);
+  const rawValue: string = stripQuotes(workingRaw.slice(colonIndex + 1));
+
+  const { operator, cleanValue } = detectOperator(rawValue);
+
+  const field: string = isAttribute ? rawField : resolveFieldName(rawField);
+
+  return {
+    type: isAttribute ? TokenType.AttributeFilter : TokenType.FieldFilter,
+    field,
+    operator:
+      negated && operator === FilterOperator.Equals
+        ? FilterOperator.NotEquals
+        : operator,
+    value: cleanValue,
+    negated,
+    raw,
+  };
+}
+
+export function parseLogQuery(query: string): Array<ParsedToken> {
+  const trimmed: string = query.trim();
+
+  if (trimmed.length === 0) {
+    return [];
+  }
+
+  const rawTokens: Array<string> = tokenizeRawInput(trimmed);
+  const tokens: Array<ParsedToken> = [];
+  const freeTextParts: Array<string> = [];
+
+  const flushFreeText: () => void = (): void => {
+    if (freeTextParts.length > 0) {
+      const combined: string = freeTextParts.join(" ");
+      tokens.push({
+        type: TokenType.FreeText,
+        operator: FilterOperator.Contains,
+        value: combined,
+        negated: false,
+        raw: combined,
+      });
+      freeTextParts.length = 0;
+    }
+  };
+
+  for (const rawToken of rawTokens) {
+    if (BOOLEAN_KEYWORDS.has(rawToken)) {
+      continue;
+    }
+
+    const hasColon: boolean =
+      rawToken.includes(":") && !rawToken.startsWith('"');
+
+    const isNegatedField: boolean =
+      rawToken.startsWith("-") && rawToken.slice(1).includes(":");
+
+    if (hasColon || isNegatedField) {
+      flushFreeText();
+      tokens.push(parseFieldToken(rawToken));
+    } else {
+      freeTextParts.push(stripQuotes(rawToken));
+    }
+  }
+
+  flushFreeText();
+
+  return tokens;
+}
+
+export function tokensToDisplayString(tokens: Array<ParsedToken>): string {
+  return tokens
+    .map((t: ParsedToken) => {
+      return t.raw;
+    })
+    .join(" ");
+}
+
+export default parseLogQuery;

package/Types/Log/LogQueryToFilter.ts

@@ -0,0 +1,131 @@
+/**
+ * Converts parsed log query tokens into a Query<Log> object compatible with
+ * the AnalyticsDatabaseService query system.
+ */
+
+import {
+  ParsedToken,
+  TokenType,
+  FilterOperator,
+  parseLogQuery,
+} from "./LogQueryParser";
+import Search from "../BaseDatabase/Search";
+import GreaterThan from "../BaseDatabase/GreaterThan";
+import GreaterThanOrEqual from "../BaseDatabase/GreaterThanOrEqual";
+import LessThan from "../BaseDatabase/LessThan";
+import LessThanOrEqual from "../BaseDatabase/LessThanOrEqual";
+
+export interface LogFilter {
+  body?: string | Search<string>;
+  severityText?: string;
+  serviceId?: string;
+  traceId?: string;
+  spanId?: string;
+  attributes?: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+const TOP_LEVEL_FIELDS: Set<string> = new Set([
+  "severityText",
+  "serviceId",
+  "traceId",
+  "spanId",
+  "body",
+]);
+
+function applyFieldFilter(filter: LogFilter, token: ParsedToken): void {
+  if (!token.field) {
+    return;
+  }
+
+  const value: string = token.value;
+
+  if (TOP_LEVEL_FIELDS.has(token.field)) {
+    applyTopLevelFilter(filter, token.field, value, token.operator);
+  } else {
+    applyAttributeFilter(filter, token.field, value, token.operator);
+  }
+}
+
+function applyTopLevelFilter(
+  filter: LogFilter,
+  field: string,
+  value: string,
+  operator: FilterOperator,
+): void {
+  switch (operator) {
+    case FilterOperator.Contains:
+    case FilterOperator.Wildcard:
+      filter[field] = new Search(value.replace(/\*/g, ""));
+      break;
+    case FilterOperator.GreaterThan:
+      filter[field] = new GreaterThan(parseNumericOrString(value));
+      break;
+    case FilterOperator.GreaterThanOrEqual:
+      filter[field] = new GreaterThanOrEqual(parseNumericOrString(value));
+      break;
+    case FilterOperator.LessThan:
+      filter[field] = new LessThan(parseNumericOrString(value));
+      break;
+    case FilterOperator.LessThanOrEqual:
+      filter[field] = new LessThanOrEqual(parseNumericOrString(value));
+      break;
+    case FilterOperator.Equals:
+    case FilterOperator.NotEquals:
+    default:
+      filter[field] = value;
+      break;
+  }
+}
+
+function applyAttributeFilter(
+  filter: LogFilter,
+  field: string,
+  value: string,
+  _operator: FilterOperator,
+): void {
+  if (!filter.attributes) {
+    filter.attributes = {};
+  }
+
+  filter.attributes[field] = value;
+}
+
+function applyFreeTextFilter(filter: LogFilter, token: ParsedToken): void {
+  if (filter.body && filter.body instanceof Search) {
+    const existing: string = filter.body.toString();
+    filter.body = new Search(`${existing} ${token.value}`);
+  } else if (filter.body && typeof filter.body === "string") {
+    filter.body = new Search(`${filter.body} ${token.value}`);
+  } else {
+    filter.body = new Search(token.value);
+  }
+}
+
+function parseNumericOrString(value: string): number | string {
+  const num: number = Number(value);
+  return isNaN(num) ? value : num;
+}
+
+export function queryStringToFilter(queryString: string): LogFilter {
+  const tokens: Array<ParsedToken> = parseLogQuery(queryString);
+  const filter: LogFilter = {};
+
+  for (const token of tokens) {
+    switch (token.type) {
+      case TokenType.FreeText:
+        applyFreeTextFilter(filter, token);
+        break;
+      case TokenType.FieldFilter:
+        applyFieldFilter(filter, token);
+        break;
+      case TokenType.AttributeFilter:
+        applyFieldFilter(filter, token);
+        break;
+    }
+  }
+
+  return filter;
+}
+
+export default queryStringToFilter;