@oneuptime/common 12.0.2 → 12.0.4

package/Server/Utils/AI/Toolbox/CodeTools.ts

@@ -17,6 +17,7 @@ import {
   RepoResolution,
 } from "../../CodeRepository/StackTraceRepoResolver";
 import logger from "../../Logger";
+import GitHubInstallationBinding from "../../CodeRepository/GitHub/GitHubInstallationBinding";
 import StackTraceParser, {
   ParsedStackTrace,
   StackFrame,
@@ -121,6 +122,7 @@ export async function findReadableRepositories(
       query: query as never,
       select: {
         _id: true,
+        projectId: true,
         name: true,
         organizationName: true,
         repositoryName: true,
@@ -134,11 +136,50 @@ export async function findReadableRepositories(
       props: ctx.props,
     });
 
-  return repositories.filter((repository: CodeRepository) => {
-    return (
-      repository.repositoryHostedAt === CodeRepositoryType.GitHub &&
-      Boolean(repository.gitHubAppInstallationId)
+  const gitHubRepositories: Array<CodeRepository> = repositories.filter(
+    (repository: CodeRepository) => {
+      return (
+        repository.repositoryHostedAt === CodeRepositoryType.GitHub &&
+        Boolean(repository.gitHubAppInstallationId)
+      );
+    },
+  );
+
+  /*
+   * Every code tool — read and write — resolves its target through here, so
+   * this is the one place that has to prove the row's installation really
+   * belongs to the row's project (GHSA-xx95-gmcf-7q86). "The row is in your
+   * project" is not that proof: before the fix a caller could put any
+   * installation ID on a row in a project they owned, and these tools would
+   * then read source, commit and open pull requests in another tenant's
+   * private repositories.
+   *
+   * Writing an unbound installation ID is closed off now and the quarantine
+   * migration clears the rows that already existed, so this filter should
+   * never drop anything on a healthy database. It stays because the cost of
+   * being wrong here is another tenant's source code.
+   */
+  if (gitHubRepositories.length === 0) {
+    return gitHubRepositories;
+  }
+
+  // Every row here is in ctx.projectId, so one lookup answers for all of them.
+  const boundInstallationId: string | null =
+    await GitHubInstallationBinding.getBoundInstallationId(ctx.projectId);
+
+  return gitHubRepositories.filter((repository: CodeRepository) => {
+    if (
+      boundInstallationId &&
+      repository.gitHubAppInstallationId === boundInstallationId
+    ) {
+      return true;
+    }
+
+    logger.error(
+      `Excluding code repository ${repository.id?.toString()} from AI code tools: its GitHub App installation is not bound to project ${ctx.projectId.toString()}.`,
     );
+
+    return false;
   });
 }
 

package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

@@ -1169,11 +1169,24 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
   public toSortStatement(sort: Sort<TBaseModel>): Statement {
     const sortStatement: Statement = new Statement();
 
+    /*
+     * Keys must be comma separated. Without the separator a multi-key sort
+     * concatenates into a single malformed term (`time DESCseverity ASC`),
+     * so every ORDER BY beyond the first key was unusable. Mirrors
+     * toGroupByStatement above.
+     */
+    let first: boolean = true;
     for (const key in sort) {
       if (!this.model.getTableColumn(key)) {
         throw new BadDataException(`Unknown column: ${key}`);
       }
 
+      if (first) {
+        first = false;
+      } else {
+        sortStatement.append(SQL`, `);
+      }
+
       const value: SortOrder = sort[key]!;
       sortStatement.append(SQL`${key} `).append(
         {

package/Server/Utils/CodeRepository/GitHub/GitHub.ts

@@ -16,6 +16,8 @@ import { JSONArray, JSONObject } from "../../../../Types/JSON";
 import API from "../../../../Utils/API";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 import {
+  GitHubAppClientId,
+  GitHubAppClientSecret,
   GitHubAppId,
   GitHubAppPrivateKey,
   GitHubAppWebhookSecret,
@@ -686,6 +688,140 @@ export default class GitHubUtil extends HostedCodeRepository {
     return GitHubUtil.summarizeCheckRuns(allCheckRuns);
   }
 
+  /*
+   * Exchanges the short-lived OAuth `code` GitHub appends to the install
+   * redirect for a user-to-server access token.
+   *
+   * This is the ONLY thing that ties a redirect back to the human who
+   * actually performed the install: `installation_id` is just a number in a
+   * query string that anyone can type, but `code` is minted by GitHub for one
+   * specific GitHub user and is single-use. Pair it with
+   * listInstallationIdsForUserAccessToken below to answer "does this person
+   * really control this installation?".
+   */
+  @CaptureSpan()
+  public static async exchangeOAuthCodeForUserAccessToken(
+    code: string,
+  ): Promise<string> {
+    if (!GitHubAppClientId || !GitHubAppClientSecret) {
+      throw new BadDataException(
+        'GitHub App OAuth is not configured on this OneUptime instance. Set GITHUB_APP_CLIENT_ID and GITHUB_APP_CLIENT_SECRET, and enable "Request user authorization (OAuth) during installation" in the GitHub App settings.',
+      );
+    }
+
+    const result: HTTPErrorResponse | HTTPResponse<JSONObject> = await API.post(
+      {
+        url: URL.fromString("https://github.com/login/oauth/access_token"),
+        data: {
+          client_id: GitHubAppClientId,
+          client_secret: GitHubAppClientSecret,
+          code: code,
+        },
+        headers: {
+          Accept: "application/json",
+        },
+      },
+    );
+
+    if (result instanceof HTTPErrorResponse) {
+      throw new BadDataException(
+        "Could not verify the GitHub App installation with GitHub. Please restart the installation from OneUptime.",
+      );
+    }
+
+    const accessToken: string | undefined =
+      result.data["access_token"]?.toString();
+
+    /*
+     * GitHub answers a bad / expired / already-redeemed code with HTTP 200 and
+     * an `error` body, so a non-error status is not enough on its own.
+     */
+    if (!accessToken) {
+      throw new BadDataException(
+        "The GitHub authorization code is invalid or has already been used. Please restart the installation from OneUptime.",
+      );
+    }
+
+    return accessToken;
+  }
+
+  /*
+   * Lists the IDs of every installation of THIS GitHub App that the user
+   * behind `userAccessToken` can administer. GitHub scopes this endpoint to
+   * the app the token was issued for, so a token minted by another app cannot
+   * widen it.
+   */
+  @CaptureSpan()
+  public static async listInstallationIdsForUserAccessToken(
+    userAccessToken: string,
+  ): Promise<Array<string>> {
+    const installationIds: Array<string> = [];
+    let page: number = 1;
+    let hasMore: boolean = true;
+
+    while (hasMore) {
+      const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
+        await API.get({
+          url: URL.fromString(
+            `https://api.github.com/user/installations?per_page=100&page=${page}`,
+          ),
+          headers: {
+            Authorization: `Bearer ${userAccessToken}`,
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+          },
+        });
+
+      if (result instanceof HTTPErrorResponse) {
+        throw new BadDataException(
+          "Could not read your GitHub App installations from GitHub. Please restart the installation from OneUptime.",
+        );
+      }
+
+      const installations: JSONArray =
+        (result.data["installations"] as JSONArray) || [];
+
+      for (const installation of installations) {
+        const installationId: string | undefined = (
+          installation as JSONObject
+        )?.["id"]?.toString();
+
+        if (installationId) {
+          installationIds.push(installationId);
+        }
+      }
+
+      hasMore = installations.length === 100;
+      page++;
+    }
+
+    return installationIds;
+  }
+
+  /*
+   * Proves that the person completing the install redirect actually controls
+   * the installation they claim, by round-tripping the OAuth code through
+   * GitHub. Throws (never returns false) so no caller can accidentally treat
+   * a verification failure as a pass.
+   */
+  @CaptureSpan()
+  public static async assertUserControlsInstallation(data: {
+    oauthCode: string;
+    installationId: string;
+  }): Promise<void> {
+    const userAccessToken: string =
+      await GitHubUtil.exchangeOAuthCodeForUserAccessToken(data.oauthCode);
+
+    const installationIds: Array<string> =
+      await GitHubUtil.listInstallationIdsForUserAccessToken(userAccessToken);
+
+    if (!installationIds.includes(data.installationId.toString())) {
+      throw new BadDataException(
+        "The GitHub account you authorized does not have access to this GitHub App installation. Please restart the installation from OneUptime.",
+      );
+    }
+  }
+
   /**
    * Lists repositories accessible to a GitHub App installation
    * @param installationId - The GitHub App installation ID
@@ -767,7 +903,15 @@ export default class GitHubUtil extends HostedCodeRepository {
     branchName: string;
   }): Promise<Array<string>> {
     const cacheNamespace: string = "github-repo-tree";
-    const cacheKey: string = `${data.organizationName}/${data.repositoryName}@${data.branchName}`;
+
+    /*
+     * The installation is part of the key because this cache is read BEFORE a
+     * token is minted — so the key is doing the access control for a cache
+     * hit. Keyed on org/repo/branch alone, any caller who could name someone
+     * else's repository would be served that repository's cached private file
+     * listing without ever proving access to it.
+     */
+    const cacheKey: string = `${data.installationId}:${data.organizationName}/${data.repositoryName}@${data.branchName}`;
 
     try {
       const cachedPaths: Array<string> | null =
@@ -1415,11 +1559,20 @@ export default class GitHubUtil extends HostedCodeRepository {
     payload: string,
     signature: string,
   ): boolean {
+    /*
+     * Fail closed. This used to return true when the secret was unset, which
+     * made the webhook endpoint fully unauthenticated on any instance that had
+     * not configured one — and the handler acts on what it is sent: the
+     * `installation.deleted` branch clears installation IDs across every
+     * tenant, and `installation_repositories` triggers repository imports. An
+     * unconfigured secret is a misconfiguration to surface, not a check to
+     * skip.
+     */
     if (!GitHubAppWebhookSecret) {
-      logger.warn(
-        "GITHUB_APP_WEBHOOK_SECRET is not set, skipping verification",
+      logger.error(
+        "Rejecting GitHub webhook: GITHUB_APP_WEBHOOK_SECRET is not set, so the payload's signature cannot be verified. Set it to the webhook secret configured in the GitHub App settings.",
       );
-      return true;
+      return false;
     }
 
     const expectedSignature: string = `sha256=${crypto

package/Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding.ts

@@ -0,0 +1,130 @@
+import ProjectService from "../../../Services/ProjectService";
+import Project from "../../../../Models/DatabaseModels/Project";
+import ObjectID from "../../../../Types/ObjectID";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+
+/*
+ * A GitHub App installation ID is a small, guessable integer, and the single
+ * GitHub App JWT this instance holds will mint a `ghs_` token for ANY of them
+ * (GitHubUtil.getInstallationAccessToken does not — and cannot — know which
+ * tenant asked). So the installation ID alone is not a capability: on its own
+ * it is just an attacker-supplied number.
+ *
+ * Project.gitHubAppInstallationId is the ONE authoritative record of which
+ * project an installation belongs to. It is written only by the GitHub App
+ * install callback, and only after GitHub itself has confirmed — via the
+ * OAuth user-to-server round trip — that the person completing the install
+ * controls that installation. Both `create` and `update` on that column are
+ * closed to API callers, so nothing outside that callback can assert a
+ * binding.
+ *
+ * Every path that turns an installation ID into GitHub access must therefore
+ * re-derive the binding from here rather than trusting the ID it was handed.
+ * Checking that a CodeRepository row is in the caller's project is NOT enough
+ * on its own: the attacker owns their own project, so they control both sides
+ * of that comparison.
+ */
+export default class GitHubInstallationBinding {
+  /*
+   * The installation this project owns, or null if it has none. Callers
+   * filtering a whole project's repositories should read it once and compare
+   * in memory rather than asking per row — every row in such a list shares
+   * the same project, so the answer cannot differ between them.
+   */
+  @CaptureSpan()
+  public static async getBoundInstallationId(
+    projectId: ObjectID,
+  ): Promise<string | null> {
+    const project: Project | null = await ProjectService.findOneBy({
+      query: {
+        _id: projectId.toString(),
+      },
+      select: {
+        _id: true,
+        gitHubAppInstallationId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return project?.gitHubAppInstallationId || null;
+  }
+
+  // True only if `installationId` is the installation bound to `projectId`.
+  @CaptureSpan()
+  public static async isInstallationBoundToProject(data: {
+    projectId: ObjectID;
+    installationId: string;
+  }): Promise<boolean> {
+    if (!data.installationId) {
+      return false;
+    }
+
+    const project: Project | null = await ProjectService.findOneBy({
+      query: {
+        _id: data.projectId.toString(),
+        gitHubAppInstallationId: data.installationId.toString(),
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return Boolean(project);
+  }
+
+  /*
+   * Convenience for the many callers that hold a CodeRepository row and are
+   * about to use its installation ID against GitHub. Returns false for a row
+   * that carries no project or no installation, so a half-populated row can
+   * never be mistaken for a permitted one.
+   *
+   * Row-level checks like this stay necessary even with the write boundary
+   * closed, because a database that was exploited before the fix can still
+   * hold rows whose installation ID never belonged to their project.
+   */
+  @CaptureSpan()
+  public static async isRepositoryInstallationBound(repository: {
+    projectId?: ObjectID | undefined;
+    gitHubAppInstallationId?: string | undefined;
+  }): Promise<boolean> {
+    if (!repository.projectId || !repository.gitHubAppInstallationId) {
+      return false;
+    }
+
+    return GitHubInstallationBinding.isInstallationBoundToProject({
+      projectId: repository.projectId,
+      installationId: repository.gitHubAppInstallationId,
+    });
+  }
+
+  /*
+   * Fail-closed variant for the places where continuing without a binding
+   * would hand out cross-tenant access.
+   */
+  @CaptureSpan()
+  public static async assertInstallationBoundToProject(data: {
+    projectId: ObjectID;
+    installationId: string;
+  }): Promise<void> {
+    const isBound: boolean =
+      await GitHubInstallationBinding.isInstallationBoundToProject(data);
+
+    if (!isBound) {
+      /*
+       * Deliberately vague: a probing caller must not be able to tell
+       * "this installation belongs to someone else" from "no such
+       * installation", or the error itself becomes the enumeration oracle
+       * this check exists to close.
+       */
+      throw new BadDataException(
+        "This GitHub App installation is not connected to this project. Please connect the repository from Project Settings using the GitHub App.",
+      );
+    }
+  }
+}