@oneuptime/common 12.0.14 → 12.0.15

package/Server/Utils/Monitor/MonitorResource.ts

@@ -24,6 +24,7 @@ import MonitorType, {
 } from "../../../Types/Monitor/MonitorType";
 import ServerMonitorResponse from "../../../Types/Monitor/ServerMonitor/ServerMonitorResponse";
 import ObjectID from "../../../Types/ObjectID";
+import { JSONObject } from "../../../Types/JSON";
 import ProbeApiIngestResponse from "../../../Types/Probe/ProbeApiIngestResponse";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
@@ -141,6 +142,13 @@ export default class MonitorResourceUtil {
         _id: true,
         name: true,
         minimumProbeAgreement: true,
+        /*
+         * How often this monitor is checked. Over-time criteria filters need
+         * it to work out how many samples a fully covered evaluation window
+         * should hold - without it a monitor that has only just started
+         * looks the same as one whose whole window is breaching.
+         */
+        monitoringInterval: true,
         /*
          * Recorded as oneuptime.label.* / oneuptime.customField.* attributes on
          * every monitor metric this result produces, so response time and
@@ -737,6 +745,7 @@ export default class MonitorResourceUtil {
             monitorStep: monitorStep,
             currentCriteriaMetId: response.criteriaMetId || null,
             currentRootCause: response.rootCause || null,
+            currentProbeId: (dataToProcess as ProbeMonitorResponse).probeId,
             monitorProbes: monitorProbesForMonitor || undefined,
           });
 
@@ -1238,12 +1247,115 @@ export default class MonitorResourceUtil {
     }
   }
 
+  /**
+   * Turn a probe response read back out of MonitorProbe.lastMonitoringLog
+   * into one the criteria evaluators can actually use.
+   *
+   * The column stores `JSON.parse(JSON.stringify(response))`, which turns
+   * every ObjectID into a plain `{ _type: "ObjectID", value: "..." }` object
+   * and every Date into a string. Those plain objects are not `instanceof
+   * ObjectID`, so the analytics query builder binds them as-is and the
+   * "evaluate over time" lookup silently matches zero rows - which used to
+   * be indistinguishable from "this monitor has no history" and sent the
+   * evaluator down its instantaneous-value fallback. The result was a
+   * decision that disagreed with the evaluation summary shown beside it.
+   */
+  public static hydrateStoredProbeResponse(
+    probeResponse: ProbeMonitorResponse,
+  ): ProbeMonitorResponse {
+    const hydrated: ProbeMonitorResponse = {
+      ...probeResponse,
+    };
+
+    const toObjectID: (value: unknown) => ObjectID | undefined = (
+      value: unknown,
+    ): ObjectID | undefined => {
+      if (!value) {
+        return undefined;
+      }
+
+      if (value instanceof ObjectID) {
+        return value;
+      }
+
+      if (typeof value === "string") {
+        return new ObjectID(value);
+      }
+
+      if (typeof value === "object") {
+        const asJson: JSONObject = value as JSONObject;
+
+        if (asJson["value"]) {
+          return new ObjectID(asJson["value"].toString());
+        }
+      }
+
+      return undefined;
+    };
+
+    const toDate: (value: unknown) => Date | undefined = (
+      value: unknown,
+    ): Date | undefined => {
+      if (!value) {
+        return undefined;
+      }
+
+      if (value instanceof Date) {
+        return value;
+      }
+
+      const parsed: Date = new Date(value as string);
+
+      return isNaN(parsed.getTime()) ? undefined : parsed;
+    };
+
+    const projectId: ObjectID | undefined = toObjectID(probeResponse.projectId);
+    if (projectId) {
+      hydrated.projectId = projectId;
+    }
+
+    const monitorId: ObjectID | undefined = toObjectID(probeResponse.monitorId);
+    if (monitorId) {
+      hydrated.monitorId = monitorId;
+    }
+
+    const monitorStepId: ObjectID | undefined = toObjectID(
+      probeResponse.monitorStepId,
+    );
+    if (monitorStepId) {
+      hydrated.monitorStepId = monitorStepId;
+    }
+
+    const probeId: ObjectID | undefined = toObjectID(probeResponse.probeId);
+    if (probeId) {
+      hydrated.probeId = probeId;
+    }
+
+    const monitoredAt: Date | undefined = toDate(probeResponse.monitoredAt);
+    if (monitoredAt) {
+      hydrated.monitoredAt = monitoredAt;
+    }
+
+    const ingestedAt: Date | undefined = toDate(probeResponse.ingestedAt);
+    if (ingestedAt) {
+      hydrated.ingestedAt = ingestedAt;
+    }
+
+    return hydrated;
+  }
+
   @CaptureSpan()
   private static async checkProbeAgreement(input: {
     monitor: Monitor;
     monitorStep: MonitorStep;
     currentCriteriaMetId: string | null;
     currentRootCause: string | null;
+    /*
+     * Probe that produced the result being handled right now. Its verdict is
+     * already in currentCriteriaMetId / currentRootCause, so it is reused
+     * rather than recomputed - see the loop below.
+     */
+    currentProbeId?: ObjectID | undefined;
     /*
      * Pre-fetched MonitorProbe rows for this monitor (probeId, isEnabled,
      * lastMonitoringLog, probe.name/connectionStatus). The probe-result hot
@@ -1342,30 +1454,58 @@ export default class MonitorResourceUtil {
         continue;
       }
 
-      // Evaluate this probe's response against criteria
-      const tempResponse: ProbeApiIngestResponse = {
-        monitorId: monitor.id!,
-        criteriaMetId: undefined,
-        rootCause: null,
-      };
+      let evaluatedCriteriaMetId: string | undefined = undefined;
+      let evaluatedRootCause: string | null = null;
 
-      const tempEvaluationSummary: MonitorEvaluationSummary = {
-        evaluatedAt: OneUptimeDate.getCurrentDate(),
-        criteriaResults: [],
-        events: [],
-      };
+      const isCurrentProbe: boolean = Boolean(
+        input.currentProbeId &&
+          monitorProbe.probeId?.toString() === input.currentProbeId.toString(),
+      );
 
-      const evaluatedResponse: ProbeApiIngestResponse =
-        await MonitorCriteriaEvaluator.processMonitorStep({
-          dataToProcess: probeResponse as DataToProcess,
-          monitorStep: monitorStep,
-          monitor: monitor,
-          probeApiIngestResponse: tempResponse,
-          evaluationSummary: tempEvaluationSummary,
-        });
+      if (isCurrentProbe) {
+        /*
+         * The probe whose result we are handling right now was already
+         * evaluated by the caller, and that evaluation is the one the user
+         * sees in the evaluation summary. Re-running it here would evaluate
+         * a *different* window for any "evaluate over time" filter - seconds
+         * have passed, and this pass reads the payload back out of
+         * lastMonitoringLog rather than using the live object. That is how
+         * an incident could be created citing a criteria the summary right
+         * next to it reported as not met.
+         */
+        evaluatedCriteriaMetId = currentCriteriaMetId || undefined;
+        evaluatedRootCause = currentRootCause;
+      } else {
+        // Evaluate this probe's response against criteria
+        const tempResponse: ProbeApiIngestResponse = {
+          monitorId: monitor.id!,
+          criteriaMetId: undefined,
+          rootCause: null,
+        };
+
+        const tempEvaluationSummary: MonitorEvaluationSummary = {
+          evaluatedAt: OneUptimeDate.getCurrentDate(),
+          criteriaResults: [],
+          events: [],
+        };
+
+        const evaluatedResponse: ProbeApiIngestResponse =
+          await MonitorCriteriaEvaluator.processMonitorStep({
+            dataToProcess: MonitorResourceUtil.hydrateStoredProbeResponse(
+              probeResponse,
+            ) as DataToProcess,
+            monitorStep: monitorStep,
+            monitor: monitor,
+            probeApiIngestResponse: tempResponse,
+            evaluationSummary: tempEvaluationSummary,
+          });
+
+        evaluatedCriteriaMetId = evaluatedResponse.criteriaMetId;
+        evaluatedRootCause = evaluatedResponse.rootCause;
+      }
 
       // Record the result
-      const criteriaKey: string = evaluatedResponse.criteriaMetId || "none";
+      const criteriaKey: string = evaluatedCriteriaMetId || "none";
       const existing:
         | { count: number; rootCause: string | null; probeNames: Array<string> }
         | undefined = criteriaAgreements.get(criteriaKey);
@@ -1379,7 +1519,7 @@ export default class MonitorResourceUtil {
       } else {
         criteriaAgreements.set(criteriaKey, {
           count: 1,
-          rootCause: evaluatedResponse.rootCause,
+          rootCause: evaluatedRootCause,
           probeNames: [probeName],
         });
       }

package/Server/Utils/StatusPageContentSecurityPolicy.ts

@@ -0,0 +1,56 @@
+import { ExpressRequest, ExpressResponse } from "./Express";
+
+export const STATUS_PAGE_CONTENT_SECURITY_POLICY_HEADER_NAME: string =
+  "Content-Security-Policy";
+
+/*
+ * Fallback status pages share the authenticated application's origin. Custom
+ * domains do not, so this policy is deliberately limited to documents served
+ * below /status-page on the application host/path.
+ *
+ * The status-page template currently contains inline script elements for its
+ * Tailwind configuration and optional Google Tag Manager bootstrap. Keeping
+ * 'unsafe-inline' in script-src lets those elements continue to run, while
+ * script-src-attr 'none' uses CSP3's more-specific directive to block inline
+ * event handlers such as <img onerror>. Omitting 'unsafe-eval' separately
+ * blocks eval/new Function, which is the custom-JavaScript execution sink.
+ * HTTPS script sources remain available for Tag Manager and the tags it loads.
+ */
+export const STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY: string = [
+  "script-src 'self' 'unsafe-inline' https:",
+  "script-src-attr 'none'",
+  "object-src 'none'",
+  "base-uri 'none'",
+].join("; ");
+
+export const isStatusPageFallbackDocumentPath: (path: string) => boolean = (
+  path: string,
+): boolean => {
+  const normalizedPath: string = (path || "").split("?")[0] || "";
+
+  return (
+    normalizedPath === "/status-page" ||
+    normalizedPath === "/status-page/" ||
+    normalizedPath.startsWith("/status-page/")
+  );
+};
+
+/**
+ * Adds the fallback status page's CSP before its HTML document is rendered.
+ * Custom-domain documents (normally served from "/") are intentionally left
+ * alone because arbitrary customization remains a supported isolated-origin
+ * feature there.
+ */
+export default function applyStatusPageContentSecurityPolicy(
+  req: ExpressRequest,
+  res: ExpressResponse,
+): void {
+  if (!isStatusPageFallbackDocumentPath(req.path || "") || res.headersSent) {
+    return;
+  }
+
+  res.set(
+    STATUS_PAGE_CONTENT_SECURITY_POLICY_HEADER_NAME,
+    STATUS_PAGE_FALLBACK_CONTENT_SECURITY_POLICY,
+  );
+}

package/Server/Utils/StatusPageCustomizationAccess.ts

@@ -0,0 +1,117 @@
+import Domain from "../../Models/DatabaseModels/Domain";
+import StatusPageDomain from "../../Models/DatabaseModels/StatusPageDomain";
+import Hostname from "../../Types/API/Hostname";
+import ObjectID from "../../Types/ObjectID";
+import StatusPageDomainService from "../Services/StatusPageDomainService";
+import { ExpressRequest } from "./Express";
+
+const BUILT_IN_PRIMARY_HOSTS: Set<string> = new Set<string>([
+  "localhost",
+  "ingress",
+]);
+
+const INVALID_HOST_AUTHORITY_CHARACTER: RegExp = /[\s/?#]/;
+
+/**
+ * Parse the HTTP Host authority without consulting Express' `req.hostname`.
+ *
+ * Express may derive `req.hostname` from X-Forwarded-Host when `trust proxy`
+ * is enabled. That header is caller-controlled on several of the Nginx routes
+ * in this repository, so it cannot decide whether tenant-controlled code is
+ * returned. Nginx overwrites the actual Host header with `$host`, which makes
+ * the raw Host the appropriate input to this security boundary.
+ */
+export const normalizeStatusPageRequestHost: (
+  rawHost: string | undefined,
+) => string | null = (rawHost: string | undefined): string | null => {
+  const authority: string = rawHost?.trim() || "";
+
+  if (
+    !authority ||
+    authority.includes("@") ||
+    authority.includes(",") ||
+    INVALID_HOST_AUTHORITY_CHARACTER.test(authority) ||
+    !Hostname.isValid(authority)
+  ) {
+    return null;
+  }
+
+  try {
+    let hostname: string = Hostname.fromAuthority(authority)
+      .hostname.trim()
+      .toLowerCase();
+
+    // Treat the fully-qualified spelling of a DNS name as the same host.
+    if (hostname.endsWith(".")) {
+      hostname = hostname.slice(0, -1);
+    }
+
+    return hostname || null;
+  } catch {
+    return null;
+  }
+};
+
+export const isPrimaryStatusPageHost: (hostname: string) => boolean = (
+  hostname: string,
+): boolean => {
+  if (BUILT_IN_PRIMARY_HOSTS.has(hostname)) {
+    return true;
+  }
+
+  const configuredHostValue: string = process.env["HOST"] || "localhost";
+  const configuredHost: string | null =
+    normalizeStatusPageRequestHost(configuredHostValue);
+
+  /*
+   * A malformed deployment HOST means we cannot prove that any incoming host
+   * is isolated from the authenticated application. Disable customizations
+   * globally until the configuration is corrected.
+   */
+  if (!configuredHost) {
+    return true;
+  }
+
+  return hostname === configuredHost;
+};
+
+export const canServeStatusPageCustomizations: (data: {
+  req: ExpressRequest;
+  statusPageId: ObjectID;
+}) => Promise<boolean> = async (data: {
+  req: ExpressRequest;
+  statusPageId: ObjectID;
+}): Promise<boolean> => {
+  const requestHost: string | null = normalizeStatusPageRequestHost(
+    data.req.get("host"),
+  );
+
+  if (!requestHost || isPrimaryStatusPageHost(requestHost)) {
+    return false;
+  }
+
+  try {
+    const statusPageDomain: StatusPageDomain | null =
+      await StatusPageDomainService.findOneBy({
+        query: {
+          fullDomain: requestHost,
+          statusPageId: data.statusPageId,
+          isCnameVerified: true,
+          domain: {
+            isVerified: true,
+          } as Domain,
+        },
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    return Boolean(statusPageDomain);
+  } catch {
+    // A lookup failure must never fall back to serving tenant-controlled code.
+    return false;
+  }
+};