@oneuptime/common 12.0.13 → 12.0.15

package/Server/Utils/StatusPageContentSecurityPolicy.ts

@@ -0,0 +1,56 @@
+import { ExpressRequest, ExpressResponse } from "./Express";
+
+export const STATUS_PAGE_CONTENT_SECURITY_POLICY_HEADER_NAME: string =
+  "Content-Security-Policy";
+
+/*
+ * Fallback status pages share the authenticated application's origin. Custom
+ * domains do not, so this policy is deliberately limited to documents served
+ * below /status-page on the application host/path.
+ *
+ * The status-page template currently contains inline script elements for its
+ * Tailwind configuration and optional Google Tag Manager bootstrap. Keeping
+ * 'unsafe-inline' in script-src lets those elements continue to run, while
+ * script-src-attr 'none' uses CSP3's more-specific directive to block inline
+ * event handlers such as <img onerror>. Omitting 'unsafe-eval' separately
+ * blocks eval/new Function, which is the custom-JavaScript execution sink.
+ * HTTPS script sources remain available for Tag Manager and the tags it loads.
+ */
+export const STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY: string = [
+  "script-src 'self' 'unsafe-inline' https:",
+  "script-src-attr 'none'",
+  "object-src 'none'",
+  "base-uri 'none'",
+].join("; ");
+
+export const isStatusPageFallbackDocumentPath: (path: string) => boolean = (
+  path: string,
+): boolean => {
+  const normalizedPath: string = (path || "").split("?")[0] || "";
+
+  return (
+    normalizedPath === "/status-page" ||
+    normalizedPath === "/status-page/" ||
+    normalizedPath.startsWith("/status-page/")
+  );
+};
+
+/**
+ * Adds the fallback status page's CSP before its HTML document is rendered.
+ * Custom-domain documents (normally served from "/") are intentionally left
+ * alone because arbitrary customization remains a supported isolated-origin
+ * feature there.
+ */
+export default function applyStatusPageContentSecurityPolicy(
+  req: ExpressRequest,
+  res: ExpressResponse,
+): void {
+  if (!isStatusPageFallbackDocumentPath(req.path || "") || res.headersSent) {
+    return;
+  }
+
+  res.set(
+    STATUS_PAGE_CONTENT_SECURITY_POLICY_HEADER_NAME,
+    STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY,
+  );
+}

package/Server/Utils/StatusPageCustomizationAccess.ts

@@ -0,0 +1,117 @@
+import Domain from "../../Models/DatabaseModels/Domain";
+import StatusPageDomain from "../../Models/DatabaseModels/StatusPageDomain";
+import Hostname from "../../Types/API/Hostname";
+import ObjectID from "../../Types/ObjectID";
+import StatusPageDomainService from "../Services/StatusPageDomainService";
+import { ExpressRequest } from "./Express";
+
+const BUILT_IN_PRIMARY_HOSTS: Set<string> = new Set<string>([
+  "localhost",
+  "ingress",
+]);
+
+const INVALID_HOST_AUTHORITY_CHARACTER: RegExp = /[\s/?#]/;
+
+/**
+ * Parse the HTTP Host authority without consulting Express' `req.hostname`.
+ *
+ * Express may derive `req.hostname` from X-Forwarded-Host when `trust proxy`
+ * is enabled. That header is caller-controlled on several of the Nginx routes
+ * in this repository, so it cannot decide whether tenant-controlled code is
+ * returned. Nginx overwrites the actual Host header with `$host`, which makes
+ * the raw Host the appropriate input to this security boundary.
+ */
+export const normalizeStatusPageRequestHost: (
+  rawHost: string | undefined,
+) => string | null = (rawHost: string | undefined): string | null => {
+  const authority: string = rawHost?.trim() || "";
+
+  if (
+    !authority ||
+    authority.includes("@") ||
+    authority.includes(",") ||
+    INVALID_HOST_AUTHORITY_CHARACTER.test(authority) ||
+    !Hostname.isValid(authority)
+  ) {
+    return null;
+  }
+
+  try {
+    let hostname: string = Hostname.fromAuthority(authority)
+      .hostname.trim()
+      .toLowerCase();
+
+    // Treat the fully-qualified spelling of a DNS name as the same host.
+    if (hostname.endsWith(".")) {
+      hostname = hostname.slice(0, -1);
+    }
+
+    return hostname || null;
+  } catch {
+    return null;
+  }
+};
+
+export const isPrimaryStatusPageHost: (hostname: string) => boolean = (
+  hostname: string,
+): boolean => {
+  if (BUILT_IN_PRIMARY_HOSTS.has(hostname)) {
+    return true;
+  }
+
+  const configuredHostValue: string = process.env["HOST"] || "localhost";
+  const configuredHost: string | null =
+    normalizeStatusPageRequestHost(configuredHostValue);
+
+  /*
+   * A malformed deployment HOST means we cannot prove that any incoming host
+   * is isolated from the authenticated application. Disable customizations
+   * globally until the configuration is corrected.
+   */
+  if (!configuredHost) {
+    return true;
+  }
+
+  return hostname === configuredHost;
+};
+
+export const canServeStatusPageCustomizations: (data: {
+  req: ExpressRequest;
+  statusPageId: ObjectID;
+}) => Promise<boolean> = async (data: {
+  req: ExpressRequest;
+  statusPageId: ObjectID;
+}): Promise<boolean> => {
+  const requestHost: string | null = normalizeStatusPageRequestHost(
+    data.req.get("host"),
+  );
+
+  if (!requestHost || isPrimaryStatusPageHost(requestHost)) {
+    return false;
+  }
+
+  try {
+    const statusPageDomain: StatusPageDomain | null =
+      await StatusPageDomainService.findOneBy({
+        query: {
+          fullDomain: requestHost,
+          statusPageId: data.statusPageId,
+          isCnameVerified: true,
+          domain: {
+            isVerified: true,
+          } as Domain,
+        },
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    return Boolean(statusPageDomain);
+  } catch {
+    // A lookup failure must never fall back to serving tenant-controlled code.
+    return false;
+  }
+};

package/Server/Utils/TotpAuth.ts

@@ -2,6 +2,63 @@ import Email from "../../Types/Email";
 import * as OTPAuth from "otpauth";
 import CaptureSpan from "./Telemetry/CaptureSpan";
 
+/**
+ * The HMAC algorithm every new enrolment is issued with.
+ *
+ * RFC 6238 fixes SHA1 as the default and every authenticator implements it.
+ * The `algorithm` parameter in an otpauth:// URI is, in practice, advisory:
+ * Google Authenticator and Microsoft Authenticator parse the URI, ignore the
+ * parameter, and compute SHA1 anyway. A server that issues `algorithm=SHA256`
+ * therefore hands those apps a QR code they will silently mis-implement — the
+ * app shows a confident six digits, the server computes a completely different
+ * six digits, and enrolment can never succeed no matter how many codes the
+ * user tries. That is the failure this constant exists to prevent.
+ *
+ * SHA1 is not a weakness here. HMAC-SHA1 is unaffected by the collision
+ * attacks that retired SHA1 for signatures (RFC 6234 / RFC 2104), and the
+ * output is truncated to six digits over a 30 second window regardless — the
+ * brute-force surface is the 10^6 code space, not the hash.
+ */
+export const DefaultTotpAlgorithm: string = "SHA1";
+
+/**
+ * Algorithms a submitted token is checked against, in order.
+ *
+ * OneUptime issued `SHA256` enrolments before this was understood. Those
+ * secrets are still in the database and still work in the minority of apps
+ * that do honour the parameter (1Password, Bitwarden, Aegis, FreeOTP), so
+ * dropping SHA256 from verification would lock those accounts out of their
+ * own logins.
+ *
+ * The cost is exactly one bit: two algorithms across the validation window
+ * means twice as many six-digit strings are accepted at any instant. Against
+ * a 10^6 code space that is still a vanishing fraction, and the tests pin the
+ * bound so it cannot quietly grow.
+ *
+ * Retiring SHA256 needs more than time passing. Nothing on the row records
+ * which algorithm the user's app actually computes, so "no legacy rows remain"
+ * is not a question the database can answer today — removing it means either
+ * storing the algorithm that verified, or accepting that some long-dormant
+ * account re-enrols instead of logging in.
+ */
+export const SupportedTotpAlgorithms: Array<string> = ["SHA1", "SHA256"];
+
+/**
+ * Number of 30 second steps either side of now that a token is accepted for.
+ *
+ * Three steps is +/- 90 seconds, which absorbs ordinary phone/server clock
+ * drift and the user typing the last digit as the code rolls over.
+ */
+export const TotpValidationWindow: number = 3;
+
+/**
+ * Number of digits in a token, and the length of the time step in seconds.
+ * Both are the values Google Authenticator assumes, and — like `algorithm` —
+ * both are parameters it ignores when told anything else.
+ */
+export const TotpDigits: number = 6;
+export const TotpPeriodInSeconds: number = 30;
+
 /**
  * Utility class for handling TOTP authentication.
  */
@@ -21,7 +78,11 @@ export default class TotpAuth {
   }
 
   @CaptureSpan()
-  public static getTotp(data: { secret: string; email: Email }): OTPAuth.TOTP {
+  public static getTotp(data: {
+    secret: string;
+    email: Email;
+    algorithm?: string | undefined;
+  }): OTPAuth.TOTP {
     const totp: OTPAuth.TOTP = new OTPAuth.TOTP({
       // Provider or service the account is associated with.
       issuer: "OneUptime",
@@ -30,11 +91,11 @@ export default class TotpAuth {
         email: data.email,
       }),
       // Algorithm used for the HMAC function.
-      algorithm: "SHA256",
+      algorithm: data.algorithm || DefaultTotpAlgorithm,
       // Length of the generated tokens.
-      digits: 6,
+      digits: TotpDigits,
       // Interval of time for which a token is valid, in seconds.
-      period: 30,
+      period: TotpPeriodInSeconds,
       // Arbitrary key encoded in Base32 or OTPAuth.Secret instance.
       secret: data.secret,
     });
@@ -42,6 +103,33 @@ export default class TotpAuth {
     return totp;
   }
 
+  /**
+   * Strips the formatting authenticator apps add for readability.
+   *
+   * Google Authenticator renders a code as "123 456" and both the iOS and
+   * Android clipboards keep that space when the user copies it. Rejecting the
+   * paste is a self-inflicted "Invalid code" for a user who supplied exactly
+   * the right secret material, so the separators are removed before the token
+   * is compared. Anything that is not a digit is dropped, which also covers
+   * the hyphen some apps use and stray whitespace from a trimmed paste.
+   *
+   * @param token - The raw token as submitted.
+   * @returns The token reduced to its digits.
+   */
+  @CaptureSpan()
+  public static normalizeToken(token: string): string {
+    /*
+     * The token arrives straight off a JSON body, so it is only a string
+     * because the client chose to send one. A number or an object here must
+     * fail verification, not throw out of `.replace` and surface as a 500.
+     */
+    if (typeof token !== "string" || !token) {
+      return "";
+    }
+
+    return token.replace(/\D/g, "");
+  }
+
   /**
    * Verifies if a given token matches the provided secret key.
    * @param data - The data object containing the secret key and token.
@@ -53,13 +141,49 @@ export default class TotpAuth {
     token: string;
     email: Email;
   }): boolean {
-    const { secret, token, email } = data;
+    const { secret, email } = data;
 
-    const totp: OTPAuth.TOTP = this.getTotp({ secret, email });
+    if (!secret) {
+      return false;
+    }
 
-    const delta: number | null = totp.validate({ token, window: 3 });
+    const token: string = this.normalizeToken(data.token);
 
-    return delta !== null;
+    /*
+     * otpauth compares the submitted string against the codes it generates,
+     * so a token of the wrong length can never match — but it would still be
+     * run through one HMAC per algorithm per window step first. Reject it up
+     * front instead.
+     */
+    if (token.length !== TotpDigits) {
+      return false;
+    }
+
+    for (const algorithm of SupportedTotpAlgorithms) {
+      let totp: OTPAuth.TOTP;
+
+      try {
+        totp = this.getTotp({ secret, email, algorithm });
+      } catch {
+        /*
+         * A secret that is not valid base32 throws in the OTPAuth.Secret
+         * constructor. That is a corrupt row, not a wrong code, and it fails
+         * identically for every algorithm — so stop rather than repeat it.
+         */
+        return false;
+      }
+
+      const delta: number | null = totp.validate({
+        token,
+        window: TotpValidationWindow,
+      });
+
+      if (delta !== null) {
+        return true;
+      }
+    }
+
+    return false;
   }
 
   /**
@@ -74,7 +198,11 @@ export default class TotpAuth {
   }): string {
     const { secret, userEmail } = data;
 
-    const totp: OTPAuth.TOTP = this.getTotp({ secret, email: userEmail });
+    const totp: OTPAuth.TOTP = this.getTotp({
+      secret,
+      email: userEmail,
+      algorithm: DefaultTotpAlgorithm,
+    });
 
     return totp.toString();
   }

package/Server/Utils/UserRegistrationToken.ts

@@ -0,0 +1,182 @@
+import { AccountsRoute } from "../../ServiceRoute";
+import Hostname from "../../Types/API/Hostname";
+import Protocol from "../../Types/API/Protocol";
+import Route from "../../Types/API/Route";
+import URL from "../../Types/API/URL";
+import OneUptimeDate from "../../Types/Date";
+import Email from "../../Types/Email";
+import ObjectID from "../../Types/ObjectID";
+import EmailVerificationToken from "../../Models/DatabaseModels/EmailVerificationToken";
+import DatabaseConfig from "../DatabaseConfig";
+import EmailVerificationTokenService from "../Services/EmailVerificationTokenService";
+import CaptureSpan from "./Telemetry/CaptureSpan";
+
+/*
+ * An invited user exists in the database before they have ever authenticated.
+ * TeamMemberService creates the row so the membership has something to point
+ * at, and that row carries no password until the person registers.
+ *
+ * /signup is what hands that unclaimed row over, so the hand-over has to be
+ * gated on something only the mailbox owner can hold. Knowing the address is
+ * not enough: addresses at a company are guessable by construction, which is
+ * exactly how GHSA-qg84-6hrg-mr5g turned a pending invitation into an account
+ * takeover -- the guard there was `if (alreadySavedUser.password)`, and an
+ * unclaimed row's password is null, which is falsy.
+ *
+ * This token is that gate. It is minted when the invitation is sent, travels
+ * only inside the invitation email, and is spent the first time it is used.
+ *
+ * It reuses EmailVerificationToken rather than adding a table of its own: the
+ * shape is identical (user, email, opaque token, expiry) and the semantics are
+ * the same claim -- "the holder of this controls this mailbox". Spending one is
+ * therefore also proof of address ownership, which is why the signup path marks
+ * the account verified on the way through.
+ */
+
+/*
+ * Invitations are read when the person gets round to them, not when they are
+ * sent, so these live longer than the 24 hours an email-verification link gets.
+ * Expiring in a week still bounds how long a leaked invite mail stays useful.
+ */
+export const REGISTRATION_TOKEN_EXPIRY_IN_DAYS: number = 7;
+
+export default class UserRegistrationToken {
+  /*
+   * Mint a token for `email` and return it. The caller is responsible for
+   * putting it somewhere only the mailbox owner will see -- which in practice
+   * means a link in an email addressed to that same mailbox, and nowhere else.
+   * It must never be written into an API response.
+   */
+  @CaptureSpan()
+  public static async generateRegistrationToken(data: {
+    userId: ObjectID;
+    email: Email;
+  }): Promise<ObjectID> {
+    const token: ObjectID = ObjectID.generate();
+
+    const emailVerificationToken: EmailVerificationToken =
+      new EmailVerificationToken();
+    emailVerificationToken.userId = data.userId;
+    emailVerificationToken.email = data.email;
+    emailVerificationToken.token = token;
+    emailVerificationToken.expires = OneUptimeDate.getSomeDaysAfter(
+      REGISTRATION_TOKEN_EXPIRY_IN_DAYS,
+    );
+
+    await EmailVerificationTokenService.create({
+      data: emailVerificationToken,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return token;
+  }
+
+  /*
+   * The /accounts/register link an invited person follows. The email is carried
+   * alongside the token only to prefill (and lock) the form field; the token is
+   * the part that authorizes anything.
+   */
+  @CaptureSpan()
+  public static async getRegistrationLink(data: {
+    email: Email;
+    token: ObjectID;
+  }): Promise<URL> {
+    const host: Hostname = await DatabaseConfig.getHost();
+    const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
+
+    return URL.fromString(
+      new URL(
+        httpProtocol,
+        host,
+        new Route(AccountsRoute.toString()),
+      ).toString(),
+    )
+      .addRoute("/register")
+      .addQueryParam("email", data.email.toString(), true)
+      .addQueryParam("token", data.token.toString(), true);
+  }
+
+  // Mint a token and build the link that carries it, in one step.
+  @CaptureSpan()
+  public static async generateRegistrationLink(data: {
+    userId: ObjectID;
+    email: Email;
+  }): Promise<URL> {
+    const token: ObjectID = await this.generateRegistrationToken({
+      userId: data.userId,
+      email: data.email,
+    });
+
+    return await this.getRegistrationLink({
+      email: data.email,
+      token: token,
+    });
+  }
+
+  /*
+   * Spend a token. Returns true only if it exists, was minted for this exact
+   * address, has not expired, and had not already been spent.
+   *
+   * The delete is what makes it single-use, and it is deliberately the last
+   * word: `deleteOneBy` reports how many rows it removed, so two requests
+   * racing on the same token produce exactly one winner (the loser deletes
+   * nothing and gets false back) rather than two callers who both read a live
+   * token and both proceed.
+   *
+   * Every failure returns the same `false`. The caller must not report which
+   * check failed -- "expired" and "no such token" would tell someone probing
+   * with guessed tokens which of them had ever been real.
+   */
+  @CaptureSpan()
+  public static async consumeRegistrationToken(data: {
+    token: ObjectID;
+    email: Email;
+  }): Promise<boolean> {
+    const savedToken: EmailVerificationToken | null =
+      await EmailVerificationTokenService.findOneBy({
+        query: {
+          token: data.token,
+        },
+        select: {
+          _id: true,
+          email: true,
+          expires: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!savedToken || !savedToken.email || !savedToken.expires) {
+      return false;
+    }
+
+    /*
+     * A token is bound to the address it was mailed to. Without this, a token
+     * from any invitation the attacker had legitimately received would claim
+     * any other unclaimed account. Email lowercases on construction, so the
+     * string comparison is already case-insensitive.
+     */
+    if (savedToken.email.toString() !== data.email.toString()) {
+      return false;
+    }
+
+    if (OneUptimeDate.hasExpired(savedToken.expires)) {
+      return false;
+    }
+
+    const deletedCount: number =
+      await EmailVerificationTokenService.deleteOneBy({
+        query: {
+          _id: savedToken._id!,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    return deletedCount === 1;
+  }
+}

package/Server/Utils/VerificationCode.ts

@@ -0,0 +1,134 @@
+import { EncryptionSecret } from "../EnvironmentConfig";
+import ObjectID from "../../Types/ObjectID";
+import crypto from "crypto";
+
+/*
+ * The cryptography behind notification-channel ownership checks: the codes
+ * mailed/texted/read out to a user to prove they hold the address or number
+ * they just added.
+ *
+ * This is deliberately server-only. Common/Types/Text is bundled into the
+ * dashboard and therefore has to tolerate a runtime with no CSPRNG; a code
+ * minted here has no such excuse, so nothing in this file falls back to
+ * Math.random. If the platform cannot produce secure randomness, generation
+ * throws and the channel simply cannot be added.
+ *
+ * WHY THE STORED VALUE IS A DIGEST
+ *
+ * A six-digit code is only a secret for as long as it is in flight. Storing
+ * the plaintext puts a live account-takeover token in a database column, a
+ * backup, a replica and every log line that ever dumps the row - and the
+ * column sits on a table (UserEmail and friends) whose entire access-control
+ * design exists because reading somebody else's row IS the attack. Keeping a
+ * keyed digest means a database dump alone yields nothing: the attacker also
+ * needs the deployment's EncryptionSecret, and even holding both, recovering
+ * the code means re-running the HMAC over the code space per row, because...
+ *
+ * WHY THE ROW ID IS IN THE MESSAGE
+ *
+ * ...the digest is domain-separated by the row it belongs to. Without that,
+ * one HMAC table of all 10^6 codes inverts every row in the table at once,
+ * and two rows that happened to draw the same code would be visibly equal.
+ * With it, the same code on two rows produces two unrelated digests.
+ *
+ * A fast hash is right here, unlike a password: the input is a value the
+ * server minted at random, so there is nothing to guess offline that the
+ * attempt counter is not already bounding online. The scheme version prefix
+ * is there so a future change of construction can be told apart from this one
+ * rather than silently invalidating or, worse, colliding with it.
+ */
+
+const HASH_SCHEME_VERSION: string = "v1";
+
+/*
+ * Six digits, matching what the notification templates and the dashboard's
+ * code input already expect. The code space is small on purpose - it has to
+ * be readable off a phone screen - which is exactly why every control around
+ * it (expiry, attempt counter, lockout, rate limit) is load-bearing rather
+ * than defence in depth.
+ */
+export const VERIFICATION_CODE_LENGTH: number = 6;
+
+export default class VerificationCode {
+  /*
+   * A fresh code, drawn uniformly from the whole code space.
+   *
+   * crypto.randomInt does the rejection sampling itself, so there is no modulo
+   * bias here and no need to hand-roll one. Leading zeros are kept: "000123"
+   * is a perfectly good code, and dropping them would quietly shrink the
+   * space by 10%.
+   */
+  public static generate(length: number = VERIFICATION_CODE_LENGTH): string {
+    let code: string = "";
+
+    for (let i: number = 0; i < length; i++) {
+      code += crypto.randomInt(0, 10).toString();
+    }
+
+    return code;
+  }
+
+  /*
+   * The digest to store for `code` on the row identified by `channelId`.
+   *
+   * Both inputs are length-prefixed into the message rather than merely
+   * concatenated, so no pair of (id, code) values can be rearranged into the
+   * same byte string as another pair.
+   */
+  public static hashCode(data: { code: string; channelId: ObjectID }): string {
+    const message: string = [
+      HASH_SCHEME_VERSION,
+      data.channelId.toString(),
+      data.code,
+    ]
+      .map((part: string) => {
+        return `${part.length}:${part}`;
+      })
+      .join("");
+
+    return crypto
+      .createHmac("sha256", EncryptionSecret.toString())
+      .update(message)
+      .digest("hex");
+  }
+
+  /*
+   * Compare two digests without leaking, through timing, how many leading
+   * bytes matched.
+   *
+   * `===` on strings short-circuits at the first differing character, and the
+   * attacker here controls the plaintext that produces one side of the
+   * comparison. That is a much weaker oracle than it is for a password check -
+   * they would be recovering a digest of a value that expires in minutes - but
+   * a constant-time compare costs nothing and removes the question.
+   *
+   * Lengths are compared first. Both digests are always 64 hex characters, so
+   * an early return only happens on malformed input, where the length is not
+   * the secret.
+   */
+  public static isHashEqual(a: string, b: string): boolean {
+    if (!a || !b || a.length !== b.length) {
+      return false;
+    }
+
+    return crypto.timingSafeEqual(
+      Buffer.from(a, "utf8"),
+      Buffer.from(b, "utf8"),
+    );
+  }
+
+  /*
+   * A digest that no code can ever produce, for burning the outstanding
+   * challenge.
+   *
+   * Used when a row is locked out or successfully verified. The column is NOT
+   * NULL, so "there is no live code" cannot be expressed as null; it is
+   * expressed as a digest drawn at random from a 256-bit space, which the
+   * 10^6 possible codes cannot hit. Rotating rather than leaving the old
+   * digest in place matters: it means a lockout is not merely a pause an
+   * attacker can wait out with the same target still valid behind it.
+   */
+  public static generateUnusableHash(): string {
+    return crypto.randomBytes(32).toString("hex");
+  }
+}