@oneuptime/common 12.0.2 → 12.0.4

package/Tests/Server/Utils/AnalyticsDatabase/StatementGenerator.test.ts

@@ -24,6 +24,7 @@ import IncludesNone from "../../../../Types/BaseDatabase/IncludesNone";
 import MultiSearch from "../../../../Types/BaseDatabase/MultiSearch";
 import Search from "../../../../Types/BaseDatabase/Search";
 import StartsWith from "../../../../Types/BaseDatabase/StartsWith";
+import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 
 function expectStatement(actual: Statement, expected: Statement): void {
@@ -1431,6 +1432,125 @@ describe("StatementGenerator", () => {
     });
   });
 
+  /*
+   * The separator here is load-bearing for pagination. `toSortStatement`
+   * used to append sort keys with no delimiter, so anything past the first
+   * key produced a malformed term (`col_1 DESCcol_2 ASC`) — which meant a
+   * multi-key ORDER BY was unusable and, in practice, every paginated read
+   * ran on a single, non-unique sort column. See the pagination-stability
+   * suite in Tests/Server/Services/AnalyticsDatabasePaginationStability.
+   */
+  describe("toSortStatement", () => {
+    /*
+     * TestModel declares its columns through `tableColumns`, not as TS
+     * properties, so a `Sort<TestModel>` literal would fail excess-property
+     * checking on every key. Funnelling through one helper keeps the cast
+     * in a single place instead of on each call.
+     */
+    const sortStatementFor: (sort: Record<string, SortOrder>) => Statement = (
+      sort: Record<string, SortOrder>,
+    ): Statement => {
+      return generator.toSortStatement(sort as any);
+    };
+
+    test("renders a single ascending key with no trailing separator", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Ascending,
+      });
+
+      expect(statement.query).toBe("{p0:Identifier} ASC");
+      expect(statement.query_params).toStrictEqual({ p0: "column_1" });
+    });
+
+    test("renders a single descending key", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Descending,
+      });
+
+      expect(statement.query).toBe("{p0:Identifier} DESC");
+      expect(statement.query_params).toStrictEqual({ p0: "column_1" });
+    });
+
+    test("comma separates two keys", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Descending,
+        column_2: SortOrder.Ascending,
+      });
+
+      expect(statement.query).toBe("{p0:Identifier} DESC, {p1:Identifier} ASC");
+      expect(statement.query_params).toStrictEqual({
+        p0: "column_1",
+        p1: "column_2",
+      });
+    });
+
+    test("comma separates three keys and preserves declaration order", () => {
+      const statement: Statement = sortStatementFor({
+        column_2: SortOrder.Ascending,
+        column_1: SortOrder.Descending,
+        column_ObjectID: SortOrder.Ascending,
+      });
+
+      expect(statement.query).toBe(
+        "{p0:Identifier} ASC, {p1:Identifier} DESC, {p2:Identifier} ASC",
+      );
+      expect(statement.query_params).toStrictEqual({
+        p0: "column_2",
+        p1: "column_1",
+        p2: "column_ObjectID",
+      });
+    });
+
+    /*
+     * Regression guard for the exact malformed shape. Asserting on the
+     * rendered text rather than the param map is deliberate: the old bug
+     * produced correct PARAMS and broken SQL, so a params-only assertion
+     * would have passed straight through it.
+     */
+    test("never concatenates a direction into the next identifier", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Descending,
+        column_2: SortOrder.Ascending,
+      });
+
+      expect(statement.query).not.toContain("DESC{");
+      expect(statement.query).not.toContain("ASC{");
+      expect(statement.query).toContain(", ");
+    });
+
+    test("separator count is always one fewer than the key count", () => {
+      const statement: Statement = sortStatementFor({
+        column_ObjectID: SortOrder.Ascending,
+        column_1: SortOrder.Ascending,
+        column_2: SortOrder.Ascending,
+      });
+
+      expect(statement.query.split(", ")).toHaveLength(3);
+    });
+
+    test("an empty sort produces an empty statement", () => {
+      const statement: Statement = sortStatementFor({});
+
+      expect(statement.query).toBe("");
+      expect(statement.query_params).toStrictEqual({});
+    });
+
+    test("still rejects an unknown column", () => {
+      expect(() => {
+        return sortStatementFor({ not_a_column: SortOrder.Ascending });
+      }).toThrow(BadDataException);
+    });
+
+    test("rejects an unknown column that appears after a valid one", () => {
+      expect(() => {
+        return sortStatementFor({
+          column_1: SortOrder.Ascending,
+          not_a_column: SortOrder.Descending,
+        });
+      }).toThrow(BadDataException);
+    });
+  });
+
   describe("toColumnsCreateStatement", () => {
     test("should return the columns of a CREATE TABLE statement", () => {
       const statement: Statement = generator.toColumnsCreateStatement([

package/Tests/Server/Utils/CodeRepository/GitHubInstallationBinding.test.ts

@@ -0,0 +1,292 @@
+import GitHubInstallationBinding from "../../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import ProjectService from "../../../../Server/Services/ProjectService";
+import Project from "../../../../Models/DatabaseModels/Project";
+import CodeRepository from "../../../../Models/DatabaseModels/CodeRepository";
+import ObjectID from "../../../../Types/ObjectID";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { getColumnAccessControl } from "../../../../Types/Database/AccessControl/ColumnAccessControl";
+import { ColumnAccessControl } from "../../../../Types/BaseDatabase/AccessControl";
+import Permission from "../../../../Types/Permission";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * GHSA-xx95-gmcf-7q86. A GitHub App installation ID is a small integer, and
+ * the single GitHub App JWT this instance holds mints a write-scoped `ghs_`
+ * token for whichever installation it is handed. So "which project owns this
+ * installation?" has to be answered from a record only the verified install
+ * callback can write — never from the request, and never from a row the
+ * caller was able to create in a project they happen to own.
+ */
+
+describe("GitHubInstallationBinding", () => {
+  let projectId: ObjectID;
+  let findOneBySpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    projectId = ObjectID.generate();
+    findOneBySpy = jest.spyOn(ProjectService, "findOneBy");
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function mockBoundProject(project: Project | null): void {
+    findOneBySpy.mockResolvedValue(project);
+  }
+
+  function boundProject(): Project {
+    const project: Project = new Project();
+    project.id = projectId;
+    return project;
+  }
+
+  describe("isInstallationBoundToProject", () => {
+    test("returns true when the project owns the installation", async () => {
+      mockBoundProject(boundProject());
+
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "12345678",
+        }),
+      ).resolves.toBe(true);
+    });
+
+    test("returns false when no project row matches project + installation", async () => {
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "99999999",
+        }),
+      ).resolves.toBe(false);
+    });
+
+    /*
+     * The whole point: the query must be AND-ed on both the project and the
+     * installation. Matching on the project alone would return true for any
+     * installation ID the caller invented.
+     */
+    test("queries on BOTH the project id and the installation id", async () => {
+      mockBoundProject(boundProject());
+
+      await GitHubInstallationBinding.isInstallationBoundToProject({
+        projectId: projectId,
+        installationId: "12345678",
+      });
+
+      expect(findOneBySpy).toHaveBeenCalledTimes(1);
+
+      const findArgs: {
+        query: { _id?: string; gitHubAppInstallationId?: string };
+        props: { isRoot?: boolean };
+      } = findOneBySpy.mock.calls[0]![0] as {
+        query: { _id?: string; gitHubAppInstallationId?: string };
+        props: { isRoot?: boolean };
+      };
+
+      expect(findArgs.query._id).toBe(projectId.toString());
+      expect(findArgs.query.gitHubAppInstallationId).toBe("12345678");
+      expect(findArgs.props.isRoot).toBe(true);
+    });
+
+    /*
+     * An empty installation ID must never be treated as "bound" — otherwise a
+     * project with no GitHub connection at all would match every repository
+     * row whose installation ID had been cleared.
+     */
+    test("returns false for an empty installation id without querying", async () => {
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "",
+        }),
+      ).resolves.toBe(false);
+
+      expect(findOneBySpy).not.toHaveBeenCalled();
+    });
+
+    test("does not treat a different project's installation as bound", async () => {
+      // The service query is what enforces this; simulate the DB finding nothing.
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: ObjectID.generate(),
+          installationId: "12345678",
+        }),
+      ).resolves.toBe(false);
+    });
+  });
+
+  /*
+   * The bulk-filter path. Callers listing a whole project's repositories read
+   * the binding once and compare in memory — every row in such a list is in
+   * the same project, so a per-row query would ask the same question N times.
+   */
+  describe("getBoundInstallationId", () => {
+    test("returns the installation the project owns", async () => {
+      const project: Project = boundProject();
+      project.gitHubAppInstallationId = "12345678";
+      mockBoundProject(project);
+
+      await expect(
+        GitHubInstallationBinding.getBoundInstallationId(projectId),
+      ).resolves.toBe("12345678");
+    });
+
+    /*
+     * Null, never "" or undefined: callers compare a row's installation ID
+     * against this, and an empty string would match a row whose ID had been
+     * cleared.
+     */
+    test("returns null for a project with no GitHub connection", async () => {
+      mockBoundProject(boundProject());
+
+      await expect(
+        GitHubInstallationBinding.getBoundInstallationId(projectId),
+      ).resolves.toBeNull();
+    });
+
+    test("returns null when the project does not exist", async () => {
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.getBoundInstallationId(projectId),
+      ).resolves.toBeNull();
+    });
+
+    test("reads as root, so a caller's permissions cannot blind the check", async () => {
+      mockBoundProject(boundProject());
+
+      await GitHubInstallationBinding.getBoundInstallationId(projectId);
+
+      const findArgs: {
+        query: { _id?: string };
+        props: { isRoot?: boolean };
+      } = findOneBySpy.mock.calls[0]![0] as {
+        query: { _id?: string };
+        props: { isRoot?: boolean };
+      };
+
+      expect(findArgs.query._id).toBe(projectId.toString());
+      expect(findArgs.props.isRoot).toBe(true);
+    });
+  });
+
+  describe("assertInstallationBoundToProject", () => {
+    test("resolves quietly when the binding exists", async () => {
+      mockBoundProject(boundProject());
+
+      await expect(
+        GitHubInstallationBinding.assertInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "12345678",
+        }),
+      ).resolves.toBeUndefined();
+    });
+
+    test("throws BadDataException when the binding is missing", async () => {
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.assertInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "99999999",
+        }),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    /*
+     * The error must not confirm that the installation exists elsewhere, or
+     * the failure message becomes the enumeration oracle the fix removed.
+     */
+    test("does not leak the installation id or another tenant's existence", async () => {
+      mockBoundProject(null);
+
+      let thrown: Error | null = null;
+
+      try {
+        await GitHubInstallationBinding.assertInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "99999999",
+        });
+      } catch (err) {
+        thrown = err as Error;
+      }
+
+      expect(thrown).toBeInstanceOf(BadDataException);
+      expect(thrown!.message).not.toContain("99999999");
+      expect(thrown!.message.toLowerCase()).not.toContain("another");
+    });
+  });
+});
+
+/*
+ * The binding is only trustworthy if nothing outside the verified install
+ * callback can write it. These assertions pin the column ACLs that make that
+ * true — a future permission tidy-up that re-opens either column silently
+ * reopens the vulnerability, so it should fail here first.
+ */
+describe("Installation-id columns are not client-writable", () => {
+  test("CodeRepository.gitHubAppInstallationId cannot be created or updated by any API caller", () => {
+    const accessControl: ColumnAccessControl = getColumnAccessControl(
+      new CodeRepository(),
+      "gitHubAppInstallationId",
+    );
+
+    expect(accessControl.create).toEqual([]);
+    expect(accessControl.update).toEqual([]);
+  });
+
+  test("Project.gitHubAppInstallationId cannot be created or updated by any API caller", () => {
+    const accessControl: ColumnAccessControl = getColumnAccessControl(
+      new Project(),
+      "gitHubAppInstallationId",
+    );
+
+    expect(accessControl.create).toEqual([]);
+    expect(accessControl.update).toEqual([]);
+  });
+
+  /*
+   * Specifically the permissions an attacker gets for free by creating their
+   * own project. Being able to write either column from one of these is the
+   * whole exploit.
+   */
+  test.each([
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.CreateCodeRepository,
+    Permission.EditCodeRepository,
+    Permission.EditProject,
+  ])(
+    "%s cannot write either installation-id column",
+    (permission: Permission) => {
+      const repositoryAccessControl: ColumnAccessControl =
+        getColumnAccessControl(new CodeRepository(), "gitHubAppInstallationId");
+      const projectAccessControl: ColumnAccessControl = getColumnAccessControl(
+        new Project(),
+        "gitHubAppInstallationId",
+      );
+
+      expect(repositoryAccessControl.create).not.toContain(permission);
+      expect(repositoryAccessControl.update).not.toContain(permission);
+      expect(projectAccessControl.create).not.toContain(permission);
+      expect(projectAccessControl.update).not.toContain(permission);
+    },
+  );
+
+  // Reading it stays available — the dashboard shows connection status from it.
+  test("the column remains readable so the dashboard can show connection status", () => {
+    const accessControl: ColumnAccessControl = getColumnAccessControl(
+      new CodeRepository(),
+      "gitHubAppInstallationId",
+    );
+
+    expect(accessControl.read.length).toBeGreaterThan(0);
+  });
+});