@oneuptime/common 12.0.13 → 12.0.15

package/Tests/Server/API/StatusPageCustomizationOrigin.test.ts

@@ -0,0 +1,348 @@
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import StatusPageDomain from "../../../Models/DatabaseModels/StatusPageDomain";
+import StatusPageAPI from "../../../Server/API/StatusPageAPI";
+import StatusPageDomainService from "../../../Server/Services/StatusPageDomainService";
+import StatusPageFooterLinkService from "../../../Server/Services/StatusPageFooterLinkService";
+import StatusPageHeaderLinkService from "../../../Server/Services/StatusPageHeaderLinkService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import StatusPageSsoService from "../../../Server/Services/StatusPageSsoService";
+import Select from "../../../Server/Types/Database/Select";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+const MASTER_PAGE_ROUTE: string = "/status-page/master-page/:statusPageId";
+
+const CUSTOM_CSS: string = "body { background: url(https://evil.example); }";
+const CUSTOM_JAVASCRIPT: string =
+  "fetch('/api/project/get-list', { credentials: 'include' });";
+const HEADER_HTML: string =
+  '<img src="x" onerror="window.headerExecuted = true">';
+const FOOTER_HTML: string = '<svg onload="window.footerExecuted = true"></svg>';
+
+type InvocationResult = {
+  payload: JSONObject;
+  request: ExpressRequest;
+  response: ExpressResponse;
+  next: NextFunction;
+};
+
+describe("StatusPageAPI master-page customization origin boundary", () => {
+  const originalHost: string | undefined = process.env["HOST"];
+  let statusPageId: ObjectID;
+  let statusPage: StatusPage;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new StatusPageAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env["HOST"] = "app.example.com";
+
+    statusPageId = ObjectID.generate();
+    statusPage = new StatusPage();
+    statusPage.id = statusPageId;
+    statusPage.pageTitle = "Customer Status";
+    statusPage.pageDescription = "Everything is operational.";
+    statusPage.customCSS = CUSTOM_CSS;
+    statusPage.customJavaScript = CUSTOM_JAVASCRIPT;
+    statusPage.headerHTML = HEADER_HTML;
+    statusPage.footerHTML = FOOTER_HTML;
+
+    jest.spyOn(StatusPageService, "findOneById").mockResolvedValue(statusPage);
+    jest
+      .spyOn(StatusPageSsoService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    jest.spyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
+    jest.spyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
+    jest.spyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(null);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+
+    if (originalHost === undefined) {
+      delete process.env["HOST"];
+    } else {
+      process.env["HOST"] = originalHost;
+    }
+  });
+
+  const invokeMasterPage: (data: {
+    host?: string | undefined;
+    forwardedHost?: string | undefined;
+    origin?: string | undefined;
+    referer?: string | undefined;
+    bodyDomain?: string | undefined;
+  }) => Promise<InvocationResult> = async (data: {
+    host?: string | undefined;
+    forwardedHost?: string | undefined;
+    origin?: string | undefined;
+    referer?: string | undefined;
+    bodyDomain?: string | undefined;
+  }): Promise<InvocationResult> => {
+    const headers: Record<string, string> = {};
+
+    if (data.host !== undefined) {
+      headers["host"] = data.host;
+    }
+
+    if (data.forwardedHost !== undefined) {
+      headers["x-forwarded-host"] = data.forwardedHost;
+    }
+
+    if (data.origin !== undefined) {
+      headers["origin"] = data.origin;
+    }
+
+    if (data.referer !== undefined) {
+      headers["referer"] = data.referer;
+    }
+
+    const request: ExpressRequest = {
+      params: {
+        statusPageId: statusPageId.toString(),
+      },
+      body: data.bodyDomain ? { domain: data.bodyDomain } : {},
+      query: {},
+      cookies: {},
+      headers,
+      get: (name: string): string | undefined => {
+        return headers[name.toLowerCase()];
+      },
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    const response: ExpressResponse = {
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+    const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+    await mockRouter
+      .match("post", MASTER_PAGE_ROUTE)
+      .handlerFunction(request, response, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(Response.sendJsonObjectResponse).toHaveBeenCalledTimes(1);
+
+    const responseCall: Array<unknown> = (
+      Response.sendJsonObjectResponse as jest.Mock
+    ).mock.calls[0] as Array<unknown>;
+
+    return {
+      payload: responseCall[2] as JSONObject,
+      request,
+      response,
+      next,
+    };
+  };
+
+  const expectCustomizationsDenied: (payload: JSONObject) => void = (
+    payload: JSONObject,
+  ): void => {
+    expect(payload["allowStatusPageCustomizations"]).toBe(false);
+
+    const serializedStatusPage: JSONObject = payload[
+      "statusPage"
+    ] as JSONObject;
+
+    expect(serializedStatusPage).not.toHaveProperty("customCSS");
+    expect(serializedStatusPage).not.toHaveProperty("customJavaScript");
+    expect(serializedStatusPage).not.toHaveProperty("headerHTML");
+    expect(serializedStatusPage).not.toHaveProperty("footerHTML");
+  };
+
+  it.each([
+    ["the configured primary host", "app.example.com"],
+    ["a normalized primary host", " APP.EXAMPLE.COM.:443 "],
+    ["localhost", "localhost:3000"],
+    ["the internal ingress name", "ingress"],
+    ["a missing Host", undefined],
+    ["a malformed Host", "app.example.com/path"],
+    ["an unknown custom host", "unknown.customer.example"],
+  ])(
+    "omits executable customization fields for %s",
+    async (_label: string, host: string | undefined) => {
+      const result: InvocationResult = await invokeMasterPage({ host });
+
+      expectCustomizationsDenied(result.payload);
+
+      const findPageCall: Array<unknown> = (
+        StatusPageService.findOneById as jest.Mock
+      ).mock.calls[0] as Array<unknown>;
+      const select: Select<StatusPage> = (
+        findPageCall[0] as { select: Select<StatusPage> }
+      ).select;
+
+      expect(select).not.toHaveProperty("customCSS");
+      expect(select).not.toHaveProperty("customJavaScript");
+      expect(select).not.toHaveProperty("headerHTML");
+      expect(select).not.toHaveProperty("footerHTML");
+    },
+  );
+
+  it("returns all customization fields for a verified domain bound to this status page", async () => {
+    const statusPageDomain: StatusPageDomain = new StatusPageDomain();
+    statusPageDomain.id = ObjectID.generate();
+    (StatusPageDomainService.findOneBy as jest.Mock).mockResolvedValue(
+      statusPageDomain as never,
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "STATUS.Customer.Example.:443",
+    });
+
+    expect(result.payload["allowStatusPageCustomizations"]).toBe(true);
+    expect(result.payload["statusPage"]).toMatchObject({
+      customCSS: CUSTOM_CSS,
+      customJavaScript: CUSTOM_JAVASCRIPT,
+      headerHTML: HEADER_HTML,
+      footerHTML: FOOTER_HTML,
+    });
+
+    const findPageCall: Array<unknown> = (
+      StatusPageService.findOneById as jest.Mock
+    ).mock.calls[0] as Array<unknown>;
+    const select: Select<StatusPage> = (
+      findPageCall[0] as { select: Select<StatusPage> }
+    ).select;
+
+    expect(select).toEqual(
+      expect.objectContaining({
+        customCSS: true,
+        customJavaScript: true,
+        headerHTML: true,
+        footerHTML: true,
+      }),
+    );
+
+    expect(StatusPageDomainService.findOneBy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        query: {
+          fullDomain: "status.customer.example",
+          statusPageId,
+          isCnameVerified: true,
+          domain: {
+            isVerified: true,
+          },
+        },
+      }),
+    );
+  });
+
+  it("denies a domain record bound to a different status page", async () => {
+    const otherStatusPageId: ObjectID = ObjectID.generate();
+    const statusPageDomain: StatusPageDomain = new StatusPageDomain();
+    statusPageDomain.id = ObjectID.generate();
+
+    (StatusPageDomainService.findOneBy as jest.Mock).mockImplementation(
+      (args: unknown) => {
+        const queryStatusPageId: ObjectID = (
+          args as { query: { statusPageId: ObjectID } }
+        ).query.statusPageId;
+
+        return Promise.resolve(
+          queryStatusPageId.toString() === otherStatusPageId.toString()
+            ? statusPageDomain
+            : null,
+        );
+      },
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "status.customer.example",
+    });
+
+    expectCustomizationsDenied(result.payload);
+  });
+
+  it("ignores forwarded-host, origin, referer, and body attempts to opt in", async () => {
+    const statusPageDomain: StatusPageDomain = new StatusPageDomain();
+    statusPageDomain.id = ObjectID.generate();
+    (StatusPageDomainService.findOneBy as jest.Mock).mockResolvedValue(
+      statusPageDomain as never,
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "app.example.com",
+      forwardedHost: "status.customer.example",
+      origin: "https://status.customer.example",
+      referer: "https://status.customer.example/",
+      bodyDomain: "status.customer.example",
+    });
+
+    expectCustomizationsDenied(result.payload);
+    expect(StatusPageDomainService.findOneBy).not.toHaveBeenCalled();
+  });
+
+  it("fails closed but still serves safe master-page data when domain lookup fails", async () => {
+    (StatusPageDomainService.findOneBy as jest.Mock).mockRejectedValue(
+      new Error("database unavailable") as never,
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "status.customer.example",
+    });
+
+    expectCustomizationsDenied(result.payload);
+    expect(result.payload["statusPage"]).toMatchObject({
+      _id: statusPageId.toString(),
+      pageTitle: "Customer Status",
+      pageDescription: "Everything is operational.",
+    });
+    expect(result.payload["footerLinks"]).toEqual([]);
+    expect(result.payload["headerLinks"]).toEqual([]);
+    expect(result.payload["hasEnabledSSO"]).toBe(0);
+  });
+
+  it("explicitly redacts over-populated service results on denied origins", async () => {
+    const result: InvocationResult = await invokeMasterPage({
+      host: "app.example.com",
+    });
+
+    expectCustomizationsDenied(result.payload);
+    expect(statusPage.customCSS).toBeUndefined();
+    expect(statusPage.customJavaScript).toBeUndefined();
+    expect(statusPage.headerHTML).toBeUndefined();
+    expect(statusPage.footerHTML).toBeUndefined();
+  });
+});

package/Tests/Server/API/UserIncomingCallNumberApi.test.ts

@@ -1,5 +1,7 @@
 import UserIncomingCallNumberAPI from "../../../Server/API/UserIncomingCallNumberAPI";
 import UserIncomingCallNumberService from "../../../Server/Services/UserIncomingCallNumberService";
+import ChannelVerification from "../../../Server/Utils/ChannelVerification";
+import VerificationCode from "../../../Server/Utils/VerificationCode";
 import {
   NextFunction,
   OneUptimeRequest,
@@ -76,6 +78,11 @@ describe("UserIncomingCallNumberAPI", () => {
     UserIncomingCallNumberService.updateOneById = jest
       .fn()
       .mockResolvedValue(undefined);
+    UserIncomingCallNumberService.atomicIncrementColumnValueByOneAndGetValue =
+      jest.fn().mockResolvedValue(1);
+    UserIncomingCallNumberService.getModel = jest
+      .fn()
+      .mockReturnValue({ tableName: "UserIncomingCallNumber" });
     UserIncomingCallNumberService.resendVerificationCode = jest
       .fn()
       .mockResolvedValue(undefined);
@@ -361,13 +368,38 @@ describe("UserIncomingCallNumberAPI", () => {
       );
     });
 
+    /*
+     * GHSA-5cr8-vph4-3hrf: the row no longer stores the code. It stores a
+     * keyed digest that is only accepted while its expiry is in the future,
+     * so a live row has to be built rather than hand-written.
+     */
+    const liveItemOwnedBy: (
+      userId: string,
+      overrides?: Partial<UserIncomingCallNumber>,
+    ) => UserIncomingCallNumber = (
+      userId: string,
+      overrides: Partial<UserIncomingCallNumber> = {},
+    ) => {
+      return {
+        ...itemOwnedBy(userId),
+        projectId: new ObjectID("5f8d0d55b54764421b7156e0"),
+        isVerified: false,
+        verificationCode: VerificationCode.hashCode({
+          code: "123456",
+          channelId: new ObjectID(ITEM_ID),
+        }),
+        verificationCodeExpiresAt: ChannelVerification.getExpiresAt(),
+        verificationFailedAttempts: 0,
+        ...overrides,
+      } as UserIncomingCallNumber;
+    };
+
     it("should reject verifying an item that belongs to another user", async () => {
       mockRequest.body = { itemId: ITEM_ID, code: "123456" };
       authenticateAs(ATTACKER_USER_ID);
-      UserIncomingCallNumberService.findOneById = jest.fn().mockResolvedValue({
-        ...itemOwnedBy(CALLER_USER_ID),
-        verificationCode: "123456",
-      });
+      UserIncomingCallNumberService.findOneById = jest
+        .fn()
+        .mockResolvedValue(liveItemOwnedBy(CALLER_USER_ID));
 
       await callRoute(VERIFY_ROUTE);
 
@@ -382,12 +414,11 @@ describe("UserIncomingCallNumberAPI", () => {
     });
 
     it("should reject an incorrect verification code", async () => {
-      mockRequest.body = { itemId: ITEM_ID, code: "123456" };
+      mockRequest.body = { itemId: ITEM_ID, code: "654321" };
       authenticateAs(CALLER_USER_ID);
-      UserIncomingCallNumberService.findOneById = jest.fn().mockResolvedValue({
-        ...itemOwnedBy(CALLER_USER_ID),
-        verificationCode: "654321",
-      });
+      UserIncomingCallNumberService.findOneById = jest
+        .fn()
+        .mockResolvedValue(liveItemOwnedBy(CALLER_USER_ID));
 
       await callRoute(VERIFY_ROUTE);
 
@@ -401,21 +432,80 @@ describe("UserIncomingCallNumberAPI", () => {
       ).not.toHaveBeenCalled();
     });
 
+    /* The case that fails if the plaintext comparison ever comes back. */
+    it("should reject the stored verification column replayed as a code", async () => {
+      const item: UserIncomingCallNumber = liveItemOwnedBy(CALLER_USER_ID);
+
+      mockRequest.body = { itemId: ITEM_ID, code: item.verificationCode };
+      authenticateAs(CALLER_USER_ID);
+      UserIncomingCallNumberService.findOneById = jest
+        .fn()
+        .mockResolvedValue(item);
+
+      await callRoute(VERIFY_ROUTE);
+
+      expect(Response.sendErrorResponse).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+        new BadDataException("Invalid code"),
+      );
+    });
+
+    it("should reject a code whose expiry has passed", async () => {
+      mockRequest.body = { itemId: ITEM_ID, code: "123456" };
+      authenticateAs(CALLER_USER_ID);
+      UserIncomingCallNumberService.findOneById = jest.fn().mockResolvedValue(
+        liveItemOwnedBy(CALLER_USER_ID, {
+          verificationCodeExpiresAt: new Date(Date.now() - 1000),
+        }),
+      );
+
+      await callRoute(VERIFY_ROUTE);
+
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+      expect(
+        UserIncomingCallNumberService.updateOneById,
+      ).not.toHaveBeenCalled();
+    });
+
+    it("should reject once the attempt budget for the code is spent", async () => {
+      mockRequest.body = { itemId: ITEM_ID, code: "123456" };
+      authenticateAs(CALLER_USER_ID);
+      UserIncomingCallNumberService.findOneById = jest.fn().mockResolvedValue(
+        liveItemOwnedBy(CALLER_USER_ID, {
+          verificationFailedAttempts: 5,
+        }),
+      );
+
+      await callRoute(VERIFY_ROUTE);
+
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+      expect(
+        UserIncomingCallNumberService.updateOneById,
+      ).not.toHaveBeenCalled();
+    });
+
     it("should mark the number verified on a correct code", async () => {
       mockRequest.body = { itemId: ITEM_ID, code: "123456" };
       authenticateAs(CALLER_USER_ID);
-      UserIncomingCallNumberService.findOneById = jest.fn().mockResolvedValue({
-        ...itemOwnedBy(CALLER_USER_ID),
-        verificationCode: "123456",
-      });
+      UserIncomingCallNumberService.findOneById = jest
+        .fn()
+        .mockResolvedValue(liveItemOwnedBy(CALLER_USER_ID));
 
       await callRoute(VERIFY_ROUTE);
 
-      expect(UserIncomingCallNumberService.updateOneById).toHaveBeenCalledWith({
-        id: new ObjectID(ITEM_ID),
-        props: { isRoot: true },
-        data: { isVerified: true },
-      });
+      /* Verified AND the used code cleared, in the same write. */
+      expect(UserIncomingCallNumberService.updateOneById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: new ObjectID(ITEM_ID),
+          props: { isRoot: true },
+          data: expect.objectContaining({
+            isVerified: true,
+            verificationFailedAttempts: 0,
+            verificationCodeExpiresAt: null,
+          }),
+        }),
+      );
       expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
         mockRequest,
         mockResponse,