@oneuptime/common 10.0.93 → 10.0.96

package/Server/Utils/VM/VMRunner.ts

@@ -17,6 +17,67 @@ import vm, { Context } from "vm";
  */
 const PROXY_TARGET_SYMBOL: unique symbol = Symbol("sandboxProxyTarget");
 
+/**
+ * Hardening prelude injected before user code in `runCodeInNodeVM`.
+ *
+ * Node's `vm` module is not a security boundary. The published PoC for
+ * GHSA-g9cp-35m2-fjv6 forces a stack-overflow `RangeError`, walks
+ * `e.__proto__.__proto__.__proto__` to `Object.prototype`, then reads
+ * `.toString.constructor` to obtain a `Function` constructor that compiles
+ * code in a realm where `process.binding('spawn_sync')` is reachable.
+ *
+ * This prelude closes that path by:
+ *  - severing `Error.prototype`'s link to `Object.prototype` so the 3-level
+ *    walk lands on `null` instead of `Object.prototype`;
+ *  - deleting `.constructor` from every built-in prototype, so even a
+ *    different walk (e.g. `(0).constructor.constructor`) cannot resolve to a
+ *    function constructor;
+ *  - clearing `Function` / `eval` from the sandbox global;
+ *  - freezing the affected prototypes so user code cannot reattach them.
+ *
+ * This is a hotfix for the public PoC. The durable fix is to drop
+ * `runCodeInNodeVM` in favor of running synthetic monitor scripts in an
+ * out-of-process sandbox (tracked on the `probe-runner` branch).
+ */
+const VM_HARDENING_PRELUDE: string = `(() => {
+  const _ctors = [
+    Object, Function, Array, String, Number, Boolean, RegExp,
+    Error, RangeError, TypeError, SyntaxError, ReferenceError, EvalError, URIError,
+    Symbol, Date, Map, Set, WeakMap, WeakSet, Promise, Proxy,
+    ArrayBuffer, DataView,
+    Int8Array, Uint8Array, Uint8ClampedArray,
+    Int16Array, Uint16Array, Int32Array, Uint32Array,
+    Float32Array, Float64Array,
+  ];
+  if (typeof BigInt !== 'undefined') _ctors.push(BigInt);
+
+  for (const C of _ctors) {
+    try { if (C && C.prototype) delete C.prototype.constructor; } catch (_) {}
+  }
+
+  // Generator / async-function prototypes have no named global — reach via syntax.
+  try { delete Object.getPrototypeOf(function*(){}).constructor; } catch (_) {}
+  try { delete Object.getPrototypeOf(async function(){}).constructor; } catch (_) {}
+  try { delete Object.getPrototypeOf(async function*(){}).constructor; } catch (_) {}
+
+  try { Object.setPrototypeOf(Error.prototype, null); } catch (_) {}
+
+  try {
+    Object.defineProperty(globalThis, 'Function', {
+      value: undefined, writable: false, configurable: false,
+    });
+  } catch (_) {}
+  try {
+    Object.defineProperty(globalThis, 'eval', {
+      value: undefined, writable: false, configurable: false,
+    });
+  } catch (_) {}
+
+  for (const C of _ctors) {
+    try { if (C && C.prototype) Object.freeze(C.prototype); } catch (_) {}
+  }
+})();`;
+
 /** Properties blocked on every host-realm object exposed to the sandbox. */
 const BLOCKED_SANDBOX_PROPERTIES: ReadonlySet<string> = new Set([
   "constructor",
@@ -465,6 +526,7 @@ export default class VMRunner {
     });
 
     const script: string = `(async()=>{
+        ${VM_HARDENING_PRELUDE}
         ${code}
       })()`;
 

package/Types/Dashboard/DashboardComponentType.ts

@@ -9,6 +9,19 @@ enum DashboardComponentType {
   IncidentList = `IncidentList`,
   AlertList = `AlertList`,
   MonitorList = `MonitorList`,
+  KubernetesPodList = `KubernetesPodList`,
+  KubernetesNodeList = `KubernetesNodeList`,
+  KubernetesNamespaceList = `KubernetesNamespaceList`,
+  KubernetesDeploymentList = `KubernetesDeploymentList`,
+  KubernetesStatefulSetList = `KubernetesStatefulSetList`,
+  KubernetesDaemonSetList = `KubernetesDaemonSetList`,
+  KubernetesJobList = `KubernetesJobList`,
+  KubernetesCronJobList = `KubernetesCronJobList`,
+  DockerHostList = `DockerHostList`,
+  DockerContainerList = `DockerContainerList`,
+  DockerImageList = `DockerImageList`,
+  DockerNetworkList = `DockerNetworkList`,
+  DockerVolumeList = `DockerVolumeList`,
 }
 
 export default DashboardComponentType;

package/Types/Dashboard/DashboardComponents/ComponentArgument.ts

@@ -12,6 +12,21 @@ export enum ComponentInputType {
   MetricsQueryConfigs = "MetricsQueryConfigs",
   LongText = "Long Text",
   Dropdown = "Dropdown",
+  MultiSelectDropdown = "MultiSelectDropdown",
+  EntityDropdown = "EntityDropdown",
+  EntityMultiSelectDropdown = "EntityMultiSelectDropdown",
+}
+
+export enum EntityFilterModelType {
+  IncidentSeverity = "IncidentSeverity",
+  AlertSeverity = "AlertSeverity",
+  IncidentState = "IncidentState",
+  AlertState = "AlertState",
+  MonitorStatus = "MonitorStatus",
+  Monitor = "Monitor",
+  Label = "Label",
+  KubernetesCluster = "KubernetesCluster",
+  DockerHost = "DockerHost",
 }
 
 export interface ComponentArgumentSection {
@@ -32,4 +47,5 @@ export interface ComponentArgument<T extends DashboardBaseComponent> {
   placeholder?: string | undefined;
   dropdownOptions?: Array<DropdownOption> | undefined;
   section?: ComponentArgumentSection | undefined;
+  entityFilterModelType?: EntityFilterModelType | undefined;
 }

package/Types/Dashboard/DashboardComponents/DashboardAlertListComponent.ts

@@ -9,5 +9,9 @@ export default interface DashboardAlertListComponent extends BaseComponent {
     title?: string | undefined;
     maxRows?: number | undefined;
     stateFilter?: string | undefined;
+    severityIds?: Array<string> | undefined;
+    stateIds?: Array<string> | undefined;
+    monitorIds?: Array<string> | undefined;
+    labelIds?: Array<string> | undefined;
   };
 }

package/Types/Dashboard/DashboardComponents/DashboardDockerContainerListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerContainerListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerContainerList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+    imageName?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerHostListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerHostListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerHostList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    statusFilter?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerImageListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerImageListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerImageList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+    nameSearch?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerNetworkListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerNetworkListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerNetworkList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerVolumeListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerVolumeListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerVolumeList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardIncidentListComponent.ts

@@ -9,5 +9,9 @@ export default interface DashboardIncidentListComponent extends BaseComponent {
     title?: string | undefined;
     maxRows?: number | undefined;
     stateFilter?: string | undefined;
+    severityIds?: Array<string> | undefined;
+    stateIds?: Array<string> | undefined;
+    monitorIds?: Array<string> | undefined;
+    labelIds?: Array<string> | undefined;
   };
 }

package/Types/Dashboard/DashboardComponents/DashboardKubernetesCronJobListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesCronJobListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesCronJobList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesDaemonSetListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesDaemonSetListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesDaemonSetList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesDeploymentListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesDeploymentListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesDeploymentList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesJobListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesJobListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesJobList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesNamespaceListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesNamespaceListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesNamespaceList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesNodeListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesNodeListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesNodeList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    readinessFilter?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesPodListComponent.ts

@@ -0,0 +1,16 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesPodListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesPodList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+    podPhases?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesStatefulSetListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesStatefulSetListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesStatefulSetList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardMonitorListComponent.ts

@@ -9,5 +9,8 @@ export default interface DashboardMonitorListComponent extends BaseComponent {
     title?: string | undefined;
     maxRows?: number | undefined;
     statusFilter?: string | undefined;
+    monitorStatusIds?: Array<string> | undefined;
+    monitorTypes?: Array<string> | undefined;
+    labelIds?: Array<string> | undefined;
   };
 }