@oneuptime/common 12.0.2 → 12.0.4

package/Tests/Server/Services/CodeRepositoryInstallationBinding.test.ts

@@ -0,0 +1,305 @@
+import CodeRepositoryService from "../../../Server/Services/CodeRepositoryService";
+import GitHubInstallationBinding from "../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import CodeRepository from "../../../Models/DatabaseModels/CodeRepository";
+import CodeRepositoryType from "../../../Types/CodeRepository/CodeRepositoryType";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import ObjectID from "../../../Types/ObjectID";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * GHSA-xx95-gmcf-7q86, defence in depth.
+ *
+ * Closing the column ACL stops requests that go through permission checks,
+ * but every writer of this column writes with `props: { isRoot: true }`, which
+ * skips those checks entirely. These hooks run regardless of isRoot, so a
+ * route that writes a repository row carrying an installation ID its project
+ * does not own is refused at the service boundary — before the row exists to
+ * be traded for a token.
+ */
+
+type ServiceInternals = {
+  onBeforeCreate: (createBy: CreateBy<CodeRepository>) => Promise<unknown>;
+  onBeforeUpdate: (updateBy: UpdateBy<CodeRepository>) => Promise<unknown>;
+};
+
+const service: ServiceInternals =
+  CodeRepositoryService as unknown as ServiceInternals;
+
+describe("CodeRepositoryService installation-to-project binding", () => {
+  let ownProjectId: ObjectID;
+  let victimInstallationId: string;
+  let ownInstallationId: string;
+  let bindingSpy: jest.SpyInstance;
+  let findBySpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    ownProjectId = ObjectID.generate();
+    ownInstallationId = "11111111";
+    victimInstallationId = "99999999";
+
+    /*
+     * Model the real helper: bound only for (ownProjectId, ownInstallationId).
+     */
+    bindingSpy = jest
+      .spyOn(GitHubInstallationBinding, "isInstallationBoundToProject")
+      .mockImplementation(
+        async (data: {
+          projectId: ObjectID;
+          installationId: string;
+        }): Promise<boolean> => {
+          return (
+            data.projectId.toString() === ownProjectId.toString() &&
+            data.installationId === ownInstallationId
+          );
+        },
+      );
+
+    findBySpy = jest.spyOn(CodeRepositoryService, "findBy");
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function buildCreateBy(data: {
+    projectId?: ObjectID | undefined;
+    installationId?: string | undefined;
+    tenantId?: ObjectID | undefined;
+  }): CreateBy<CodeRepository> {
+    const repository: CodeRepository = new CodeRepository();
+    repository.name = "my-service";
+    repository.repositoryHostedAt = CodeRepositoryType.GitHub;
+    repository.organizationName = "my-org";
+    repository.repositoryName = "my-service";
+
+    if (data.projectId) {
+      repository.projectId = data.projectId;
+    }
+
+    if (data.installationId !== undefined) {
+      repository.gitHubAppInstallationId = data.installationId;
+    }
+
+    return {
+      data: repository,
+      props: {
+        isRoot: true,
+        tenantId: data.tenantId,
+      },
+    };
+  }
+
+  describe("onBeforeCreate", () => {
+    /*
+     * The exploit's step 2: a row in the attacker's OWN project naming the
+     * victim's installation. Every later authorization check compares the
+     * row's projectId to the caller's tenant and passes, so this is the last
+     * place the lie can be caught.
+     */
+    test("rejects a row in your own project that names another tenant's installation", async () => {
+      await expect(
+        service.onBeforeCreate(
+          buildCreateBy({
+            projectId: ownProjectId,
+            installationId: victimInstallationId,
+          }),
+        ),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    test("rejects even when the write is made as root", async () => {
+      const createBy: CreateBy<CodeRepository> = buildCreateBy({
+        projectId: ownProjectId,
+        installationId: victimInstallationId,
+      });
+
+      expect(createBy.props.isRoot).toBe(true);
+
+      await expect(service.onBeforeCreate(createBy)).rejects.toBeInstanceOf(
+        BadDataException,
+      );
+    });
+
+    test("allows the legitimate import: an installation the project owns", async () => {
+      await expect(
+        service.onBeforeCreate(
+          buildCreateBy({
+            projectId: ownProjectId,
+            installationId: ownInstallationId,
+          }),
+        ),
+      ).resolves.toBeDefined();
+    });
+
+    // Repositories connected by other means (GitLab, manual) are unaffected.
+    test("allows a row with no installation id at all and never checks a binding", async () => {
+      await expect(
+        service.onBeforeCreate(buildCreateBy({ projectId: ownProjectId })),
+      ).resolves.toBeDefined();
+
+      expect(bindingSpy).not.toHaveBeenCalled();
+    });
+
+    test("checks the binding against the row's own project", async () => {
+      await service.onBeforeCreate(
+        buildCreateBy({
+          projectId: ownProjectId,
+          installationId: ownInstallationId,
+        }),
+      );
+
+      expect(bindingSpy).toHaveBeenCalledTimes(1);
+
+      const args: { projectId: ObjectID; installationId: string } = bindingSpy
+        .mock.calls[0]![0] as {
+        projectId: ObjectID;
+        installationId: string;
+      };
+
+      expect(args.projectId.toString()).toBe(ownProjectId.toString());
+      expect(args.installationId).toBe(ownInstallationId);
+    });
+
+    // Falls back to the tenant when the row does not carry its project inline.
+    test("uses props.tenantId when the row has no projectId", async () => {
+      await expect(
+        service.onBeforeCreate(
+          buildCreateBy({
+            tenantId: ownProjectId,
+            installationId: ownInstallationId,
+          }),
+        ),
+      ).resolves.toBeDefined();
+
+      const args: { projectId: ObjectID } = bindingSpy.mock.calls[0]![0] as {
+        projectId: ObjectID;
+      };
+      expect(args.projectId.toString()).toBe(ownProjectId.toString());
+    });
+
+    /*
+     * A projectless row would otherwise skip the check entirely and leave an
+     * unattributable installation ID in the table.
+     */
+    test("rejects an installation id with no project to check it against", async () => {
+      await expect(
+        service.onBeforeCreate(
+          buildCreateBy({ installationId: ownInstallationId }),
+        ),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+  });
+
+  describe("onBeforeUpdate", () => {
+    function buildUpdateBy(
+      installationId: string | null,
+    ): UpdateBy<CodeRepository> {
+      return {
+        query: { projectId: ownProjectId },
+        data: {
+          gitHubAppInstallationId: installationId,
+        } as unknown as CodeRepository,
+        limit: 100,
+        skip: 0,
+        props: { isRoot: true },
+      } as unknown as UpdateBy<CodeRepository>;
+    }
+
+    function mockAffectedRows(projectIds: Array<ObjectID | undefined>): void {
+      findBySpy.mockResolvedValue(
+        projectIds.map((projectId: ObjectID | undefined) => {
+          const repository: CodeRepository = new CodeRepository();
+          repository.id = ObjectID.generate();
+          if (projectId) {
+            repository.projectId = projectId;
+          }
+          return repository;
+        }),
+      );
+    }
+
+    test("rejects repointing an existing row at another tenant's installation", async () => {
+      mockAffectedRows([ownProjectId]);
+
+      await expect(
+        service.onBeforeUpdate(buildUpdateBy(victimInstallationId)),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    test("allows setting the installation the row's project owns", async () => {
+      mockAffectedRows([ownProjectId]);
+
+      await expect(
+        service.onBeforeUpdate(buildUpdateBy(ownInstallationId)),
+      ).resolves.toBeDefined();
+    });
+
+    /*
+     * This is how the `installation.deleted` webhook tears a disconnected
+     * installation out of the database — it must never be blocked.
+     */
+    test("always allows clearing the installation id", async () => {
+      await expect(
+        service.onBeforeUpdate(buildUpdateBy(null)),
+      ).resolves.toBeDefined();
+
+      expect(bindingSpy).not.toHaveBeenCalled();
+      expect(findBySpy).not.toHaveBeenCalled();
+    });
+
+    /*
+     * updateBy matches by query, so a single write can span rows in several
+     * projects. One unbound row is enough to leak a token, so the whole write
+     * must fail — not just the offending row.
+     */
+    test("rejects a multi-row update when any affected row's project is unbound", async () => {
+      mockAffectedRows([ownProjectId, ObjectID.generate()]);
+
+      await expect(
+        service.onBeforeUpdate(buildUpdateBy(ownInstallationId)),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    test("checks every affected row, not just the first", async () => {
+      const secondProjectId: ObjectID = ObjectID.generate();
+      mockAffectedRows([ownProjectId, secondProjectId]);
+
+      try {
+        await service.onBeforeUpdate(buildUpdateBy(ownInstallationId));
+      } catch {
+        // expected — the second row is unbound
+      }
+
+      const checkedProjectIds: Array<string> = bindingSpy.mock.calls.map(
+        (call: Array<unknown>) => {
+          return (call[0] as { projectId: ObjectID }).projectId.toString();
+        },
+      );
+
+      expect(checkedProjectIds).toContain(ownProjectId.toString());
+      expect(checkedProjectIds).toContain(secondProjectId.toString());
+    });
+
+    test("rejects when an affected row has no project", async () => {
+      mockAffectedRows([undefined]);
+
+      await expect(
+        service.onBeforeUpdate(buildUpdateBy(ownInstallationId)),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    test("reads the affected rows as root so the check cannot be blinded by permissions", async () => {
+      mockAffectedRows([ownProjectId]);
+
+      await service.onBeforeUpdate(buildUpdateBy(ownInstallationId));
+
+      const findArgs: { props: { isRoot?: boolean } } = findBySpy.mock
+        .calls[0]![0] as {
+        props: { isRoot?: boolean };
+      };
+      expect(findArgs.props.isRoot).toBe(true);
+    });
+  });
+});

package/Tests/Server/Services/CodeRepositoryResolutionBinding.test.ts

@@ -0,0 +1,147 @@
+import CodeRepositoryService from "../../../Server/Services/CodeRepositoryService";
+import GitHubInstallationBinding from "../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import GitHubUtil from "../../../Server/Utils/CodeRepository/GitHub/GitHub";
+import CodeRepository from "../../../Models/DatabaseModels/CodeRepository";
+import CodeRepositoryType from "../../../Types/CodeRepository/CodeRepositoryType";
+import ObjectID from "../../../Types/ObjectID";
+import { RepoResolution } from "../../../Server/Utils/CodeRepository/StackTraceRepoResolver";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * GHSA-xx95-gmcf-7q86, downstream guard.
+ *
+ * resolveRepositoryForException runs server-side, as root, and probes the file
+ * tree of EVERY candidate repository in a project to work out which one an
+ * exception came from. A row carrying an installation its project does not own
+ * would therefore have OneUptime read another tenant's private repository on
+ * its own initiative — no attacker request needed at the time it happens.
+ *
+ * The write boundary is closed and the quarantine migration clears rows that
+ * predate it, so on a healthy database nothing is filtered here. It stays
+ * because a database exploited before the fix would otherwise keep leaking.
+ */
+
+describe("resolveRepositoryForException only considers bound installations", () => {
+  let projectId: ObjectID;
+  let boundRepositoryId: ObjectID;
+  let unboundRepositoryId: ObjectID;
+  let treePathsSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    projectId = ObjectID.generate();
+    boundRepositoryId = ObjectID.generate();
+    unboundRepositoryId = ObjectID.generate();
+
+    treePathsSpy = jest.spyOn(GitHubUtil, "getRepositoryTreePaths");
+    treePathsSpy.mockResolvedValue(["src/app.ts"]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function repository(data: {
+    id: ObjectID;
+    installationId: string;
+  }): CodeRepository {
+    const codeRepository: CodeRepository = new CodeRepository();
+    codeRepository.id = data.id;
+    codeRepository.projectId = projectId;
+    codeRepository.name = "service";
+    codeRepository.organizationName = "org";
+    codeRepository.repositoryName = `repo-${data.id.toString()}`;
+    codeRepository.mainBranchName = "main";
+    codeRepository.repositoryHostedAt = CodeRepositoryType.GitHub;
+    codeRepository.gitHubAppInstallationId = data.installationId;
+    return codeRepository;
+  }
+
+  function mockRepositories(repositories: Array<CodeRepository>): void {
+    const findBySpy: jest.SpyInstance = jest.spyOn(
+      CodeRepositoryService,
+      "findBy",
+    );
+    findBySpy.mockResolvedValue(repositories);
+  }
+
+  // Only "11111111" genuinely belongs to this project.
+  function mockBinding(): void {
+    jest
+      .spyOn(GitHubInstallationBinding, "getBoundInstallationId")
+      .mockResolvedValue("11111111");
+  }
+
+  test("never fetches the tree of a repository whose installation is unbound", async () => {
+    mockRepositories([
+      repository({ id: unboundRepositoryId, installationId: "99999999" }),
+    ]);
+    mockBinding();
+
+    await CodeRepositoryService.resolveRepositoryForException({
+      projectId: projectId,
+      stackTrace: "at /src/app.ts:10:5",
+      serviceName: "api",
+    });
+
+    expect(treePathsSpy).not.toHaveBeenCalled();
+  });
+
+  test("returns null when every candidate is unbound", async () => {
+    mockRepositories([
+      repository({ id: unboundRepositoryId, installationId: "99999999" }),
+    ]);
+    mockBinding();
+
+    const resolution: RepoResolution | null =
+      await CodeRepositoryService.resolveRepositoryForException({
+        projectId: projectId,
+        stackTrace: "at /src/app.ts:10:5",
+        serviceName: "api",
+      });
+
+    expect(resolution).toBeNull();
+  });
+
+  test("still resolves against a repository whose installation is bound", async () => {
+    mockRepositories([
+      repository({ id: boundRepositoryId, installationId: "11111111" }),
+    ]);
+    mockBinding();
+
+    const resolution: RepoResolution | null =
+      await CodeRepositoryService.resolveRepositoryForException({
+        projectId: projectId,
+        stackTrace: "at /src/app.ts:10:5",
+        serviceName: "api",
+      });
+
+    expect(resolution).not.toBeNull();
+  });
+
+  /*
+   * The dangerous shape: one legitimate row plus one planted row. Resolution
+   * fans out across every candidate, so the planted one must be dropped
+   * without the legitimate one being disturbed.
+   */
+  test("drops only the unbound row when both are present", async () => {
+    mockRepositories([
+      repository({ id: boundRepositoryId, installationId: "11111111" }),
+      repository({ id: unboundRepositoryId, installationId: "99999999" }),
+    ]);
+    mockBinding();
+
+    await CodeRepositoryService.resolveRepositoryForException({
+      projectId: projectId,
+      stackTrace: "at /src/app.ts:10:5",
+      serviceName: "api",
+    });
+
+    const probedInstallationIds: Array<string> = treePathsSpy.mock.calls.map(
+      (call: Array<unknown>) => {
+        return (call[0] as { installationId: string }).installationId;
+      },
+    );
+
+    expect(probedInstallationIds).not.toContain("99999999");
+  });
+});