@oneuptime/common 12.0.23 → 12.0.25

package/Server/Infrastructure/Postgres/SchemaMigrations/1789512000000-AddDetectionRuleDistinctCountColumns.ts

@@ -0,0 +1,33 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Detection rules gain correlation semantics (issue #3398):
+ * distinctCountField switches what a rule counts — unique values of a
+ * field (distinct usernames, distinct source IPs) instead of raw matching
+ * events — and matchCountThreshold holds a rule back until a group
+ * reaches N in one evaluation window. Threshold defaults to 1 so every
+ * existing rule keeps its fire-on-any-match behavior.
+ */
+export class AddDetectionRuleDistinctCountColumns1789512000000
+  implements MigrationInterface
+{
+  public name: string = "AddDetectionRuleDistinctCountColumns1789512000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "distinctCountField" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "matchCountThreshold" integer NOT NULL DEFAULT '1'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "matchCountThreshold"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "distinctCountField"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -546,7 +546,10 @@ import { AddUserSlackAndMicrosoftTeams1789000000000 } from "./1789000000000-AddU
 import { AddNetworkDeviceAutoImportRule1789100000000 } from "./1789100000000-AddNetworkDeviceAutoImportRule";
 import { AddSysObjectIdPatternToAutoImportRule1789200000000 } from "./1789200000000-AddSysObjectIdPatternToAutoImportRule";
 import { AddAutoApplyVendorHealthTemplate1789300000000 } from "./1789300000000-AddAutoApplyVendorHealthTemplate";
+import { AddCampaignUtmFields1789500000000 } from "./1789500000000-AddCampaignUtmFields";
 import { AddUserTwoFactorBackupCode1789100000000 } from "./1789100000000-AddUserTwoFactorBackupCode";
+import { AddNameToNetworkDeviceDiscoveryScan1789400000000 } from "./1789400000000-AddNameToNetworkDeviceDiscoveryScan";
+import { AddDetectionRuleDistinctCountColumns1789512000000 } from "./1789512000000-AddDetectionRuleDistinctCountColumns";
 import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
 import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
@@ -1102,4 +1105,7 @@ export default [
   AddSysObjectIdPatternToAutoImportRule1789200000000,
   AddAutoApplyVendorHealthTemplate1789300000000,
   AddUserTwoFactorBackupCode1789100000000,
+  AddNameToNetworkDeviceDiscoveryScan1789400000000,
+  AddCampaignUtmFields1789500000000,
+  AddDetectionRuleDistinctCountColumns1789512000000,
 ];

package/Server/Middleware/GzipRequestBody.ts

@@ -0,0 +1,311 @@
+import ServerException from "../../Types/Exception/ServerException";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+  headerValueToString,
+} from "../Utils/Express";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
+import Response from "../Utils/Response";
+import zlib from "zlib";
+
+/*
+ * Ceilings for the global `Content-Encoding: gzip` request path.
+ *
+ * Both are 50 MiB, which is exactly what body-parser is given for the
+ * identity path (`jsonBodyParserOptions.limit` / `urlEncodedBodyParserOptions.limit`,
+ * and `bytes("50mb")` is 1024-based too). Announcing gzip must not buy a
+ * caller more room than sending the same body uncompressed.
+ *
+ * They are two constants because they bound two different things and
+ * neither alone is sufficient:
+ *
+ *   - COMPRESSED bounds what arrives on the socket, so a client cannot
+ *     stream unbounded bytes into the process.
+ *   - DECOMPRESSED bounds what the inflate produces. gzip of repeated
+ *     bytes reaches four figures of amplification: 130,479 bytes of gzip
+ *     inflates to 134,217,728 bytes (1,029x, measured), so the compressed
+ *     cap on its own leaves ~50 GB of expansion on the table.
+ */
+export const MAX_COMPRESSED_REQUEST_BODY_BYTES: number = 50 * 1024 * 1024;
+export const MAX_DECOMPRESSED_REQUEST_BODY_BYTES: number = 50 * 1024 * 1024;
+
+/*
+ * Inflate a `Content-Encoding: gzip` request body under hard limits, and
+ * hand the decompressed bytes on as `req.body` (a Buffer, which is what
+ * this path has always produced).
+ *
+ * This middleware runs BEFORE routing and therefore before authentication,
+ * so every limit here is an unauthenticated-attacker limit.
+ *
+ * Two implementation notes that are easy to get wrong:
+ *
+ *   1. It streams. Buffering the whole compressed body and then calling
+ *      `zlib.gunzip` would hold the compressed cap AND the decompressed cap
+ *      at once, and would not notice a bomb until the last byte arrived.
+ *      Feeding a `createGunzip` stream instead trips the cap after ~64 KiB
+ *      of a 128 MiB bomb (measured), before most of the body is even sent.
+ *
+ *   2. It counts the output itself. `maxOutputLength` looks like the right
+ *      knob but Node only honours it on the convenience methods
+ *      (`zlib.gunzip` / `gunzipSync`); on a `createGunzip` STREAM it is
+ *      silently ignored - a stream with `maxOutputLength: 1 MiB` happily
+ *      emits 128 MiB. Verified against Node 24. Setting it here would read
+ *      as protection while providing none, so the running total below is
+ *      what actually enforces the ceiling.
+ */
+export default class GzipRequestBodyMiddleware {
+  public static parseBody(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): void {
+    /*
+     * Cheap pre-check before a byte is read. Content-Length is advisory (a
+     * chunked request carries none) but when it is present and already over
+     * the cap there is no reason to accept the body at all.
+     */
+    const contentLengthHeader: string | undefined = headerValueToString(
+      req.headers["content-length"],
+    );
+
+    if (contentLengthHeader) {
+      const declaredLength: number = parseInt(contentLengthHeader, 10);
+
+      if (
+        !isNaN(declaredLength) &&
+        declaredLength > MAX_COMPRESSED_REQUEST_BODY_BYTES
+      ) {
+        GzipRequestBodyMiddleware.rejectTooLarge(
+          req,
+          res,
+          "compressed",
+          declaredLength,
+          MAX_COMPRESSED_REQUEST_BODY_BYTES,
+        );
+        return;
+      }
+    }
+
+    const inflate: zlib.Gunzip = zlib.createGunzip();
+
+    const decoded: Array<Buffer> = [];
+
+    let compressedBytes: number = 0;
+    let decompressedBytes: number = 0;
+    let requestEnded: boolean = false;
+    let awaitingDrain: boolean = false;
+    let settled: boolean = false;
+
+    const settle: (finish: () => void) => void = (finish: () => void): void => {
+      if (settled) {
+        return;
+      }
+
+      settled = true;
+
+      req.removeListener("data", onData);
+      req.removeListener("end", onEnd);
+      req.removeListener("error", onRequestError);
+      req.removeListener("close", onClose);
+
+      inflate.removeAllListeners();
+
+      /*
+       * A stream that emits "error" with no listener throws, and an
+       * uncaught throw here would turn a memory-exhaustion fix into a
+       * process-exit one. Nothing can consume a post-teardown error, so
+       * swallow it explicitly rather than leaving the stream bare.
+       */
+      inflate.on("error", (): void => {});
+      inflate.destroy();
+
+      decoded.length = 0;
+
+      finish();
+    };
+
+    /*
+     * Stop reading rather than draining. The session replay middleware
+     * deliberately drains its oversized bodies to keep the keep-alive
+     * connection usable for the next chunk, but that is a cooperative
+     * first-party client sending a 4 MiB cap's worth of bytes. Here the
+     * body we are refusing may be gigabytes from someone who wants us to
+     * read them, so we pause: Node flushes the response we already wrote
+     * and then closes the connection because the request was never
+     * consumed, which is precisely the outcome we want.
+     */
+    const stopReading: () => void = (): void => {
+      if (typeof req.pause === "function") {
+        req.pause();
+      }
+    };
+
+    const onData: (chunk: Buffer | string) => void = (
+      chunk: Buffer | string,
+    ): void => {
+      const asBuffer: Buffer = Buffer.isBuffer(chunk)
+        ? chunk
+        : Buffer.from(chunk, "utf-8");
+
+      compressedBytes += asBuffer.length;
+
+      if (compressedBytes > MAX_COMPRESSED_REQUEST_BODY_BYTES) {
+        settle((): void => {
+          stopReading();
+          GzipRequestBodyMiddleware.rejectTooLarge(
+            req,
+            res,
+            "compressed",
+            compressedBytes,
+            MAX_COMPRESSED_REQUEST_BODY_BYTES,
+          );
+        });
+        return;
+      }
+
+      /*
+       * Honour the inflate's backpressure. zlib does its work on the
+       * threadpool, so a socket that is faster than the inflate will
+       * otherwise pile the whole compressed body into the writable queue -
+       * which is the unbounded buffering this middleware exists to remove,
+       * just one object further down. Pausing also means the caps below get
+       * to see the output before we accept the next chunk, so a bomb is
+       * refused while most of it is still on the wire.
+       */
+      if (!inflate.write(asBuffer) && !awaitingDrain) {
+        awaitingDrain = true;
+
+        if (typeof req.pause === "function") {
+          req.pause();
+        }
+
+        inflate.once("drain", (): void => {
+          awaitingDrain = false;
+
+          if (!settled && typeof req.resume === "function") {
+            req.resume();
+          }
+        });
+      }
+    };
+
+    const onEnd: () => void = (): void => {
+      requestEnded = true;
+
+      /*
+       * A request that announced gzip and then sent nothing. `inflate.end()`
+       * on an empty stream raises "unexpected end of file", which used to
+       * turn every such request - including a bare GET carrying the header -
+       * into a 500 plus an error-level log line. Treat it as the empty body
+       * it is and let the route decide.
+       */
+      if (compressedBytes === 0) {
+        settle((): void => {
+          req.body = Buffer.alloc(0);
+          next();
+        });
+        return;
+      }
+
+      inflate.end();
+    };
+
+    const onRequestError: (err: Error) => void = (err: Error): void => {
+      settle((): void => {
+        next(err);
+      });
+    };
+
+    /*
+     * The client hung up mid-body. There is nobody left to answer, so drop
+     * the inflate and everything it is holding instead of waiting for a
+     * `end` that will never come. `close` also fires on the happy path,
+     * after `end`, which is what `requestEnded` guards.
+     */
+    const onClose: () => void = (): void => {
+      if (requestEnded) {
+        return;
+      }
+
+      settle((): void => {});
+    };
+
+    inflate.on("data", (chunk: Buffer): void => {
+      decompressedBytes += chunk.length;
+
+      if (decompressedBytes > MAX_DECOMPRESSED_REQUEST_BODY_BYTES) {
+        settle((): void => {
+          stopReading();
+          GzipRequestBodyMiddleware.rejectTooLarge(
+            req,
+            res,
+            "decompressed",
+            decompressedBytes,
+            MAX_DECOMPRESSED_REQUEST_BODY_BYTES,
+          );
+        });
+        return;
+      }
+
+      decoded.push(chunk);
+    });
+
+    inflate.on("end", (): void => {
+      const body: Buffer = Buffer.concat(
+        decoded as unknown as Array<Uint8Array>,
+      );
+
+      settle((): void => {
+        req.body = body;
+        next();
+      });
+    });
+
+    inflate.on("error", (err: Error): void => {
+      settle((): void => {
+        logger.error(err, getLogAttributesFromRequest(req as OneUptimeRequest));
+
+        Response.sendErrorResponse(
+          req,
+          res,
+          new ServerException("Error decompressing data"),
+        );
+      });
+    });
+
+    req.on("data", onData);
+    req.on("end", onEnd);
+    req.on("error", onRequestError);
+    req.on("close", onClose);
+  }
+
+  private static rejectTooLarge(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    stage: "compressed" | "decompressed",
+    bytes: number,
+    limit: number,
+  ): void {
+    if (res.headersSent) {
+      return;
+    }
+
+    /*
+     * debug, not warn or error. This path is unauthenticated, so a level
+     * that reaches the log sink by default would hand the same attacker a
+     * log-amplification vector in place of the memory one - while still
+     * leaving an operator something to turn on when a legitimate client
+     * starts getting 413s.
+     */
+    logger.debug(
+      `Rejected a gzip request body: ${stage} size reached ${bytes} bytes, limit is ${limit}.`,
+      getLogAttributesFromRequest(req as OneUptimeRequest),
+    );
+
+    res.status(413).json({
+      message: `Request body too large. The ${stage} body of a gzip-encoded request may not exceed ${limit} bytes.`,
+    });
+  }
+}

package/Server/Middleware/MultipartFormData.ts

@@ -1,17 +1,101 @@
+import BadRequestException from "../../Types/Exception/BadRequestException";
+import PayloadTooLargeException from "../../Types/Exception/PayloadTooLargeException";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
 import multer from "multer";
 import { RequestHandler } from "express";
 
+/*
+ * Ceilings for multipart bodies.
+ *
+ * memoryStorage means every part is buffered in the process, and both
+ * routes that mount this middleware run it BEFORE their auth check -
+ * Pyroscope ingest before isAuthorizedServiceMiddleware, SendGrid inbound
+ * before the webhook secret is verified. So these are the limits an
+ * unauthenticated caller is held to, and multer's defaults leave most of
+ * them at Infinity: file size, file count, field count and part count are
+ * all unbounded out of the box (only fieldSize has a default, 1 MB).
+ *
+ * The sizes match the 50 MiB body-parser limit the rest of the app uses,
+ * and nginx cuts the shipped deployment lower still (50M on
+ * /incoming-email, its 1M default on /pyroscope). The COUNTS are the part
+ * that was genuinely missing: without them a body of ten thousand
+ * one-byte parts costs ten thousand allocations and passes every size
+ * check.
+ */
+export const MAX_MULTIPART_FILE_BYTES: number = 50 * 1024 * 1024;
+export const MAX_MULTIPART_FIELD_BYTES: number = 25 * 1024 * 1024;
+export const MAX_MULTIPART_FILES: number = 50;
+export const MAX_MULTIPART_FIELDS: number = 200;
+
 /*
  * Configure multer for handling multipart/form-data
  * Uses memory storage to store files in memory as Buffer objects
  */
-const upload: multer.Multer = multer({ storage: multer.memoryStorage() });
+const upload: multer.Multer = multer({
+  storage: multer.memoryStorage(),
+  limits: {
+    fileSize: MAX_MULTIPART_FILE_BYTES,
+    fieldSize: MAX_MULTIPART_FIELD_BYTES,
+    files: MAX_MULTIPART_FILES,
+    fields: MAX_MULTIPART_FIELDS,
+    /*
+     * Parts are files + fields, so this has to allow both in full or it
+     * would be the effective limit and the two above would never fire.
+     */
+    parts: MAX_MULTIPART_FILES + MAX_MULTIPART_FIELDS,
+  },
+});
+
+const uploadAny: RequestHandler = upload.any() as unknown as RequestHandler;
+
+/*
+ * The LIMIT_* codes that mean "you sent too much". LIMIT_UNEXPECTED_FILE
+ * is deliberately absent: it means the body named a field the route did
+ * not ask for, which is a malformed request rather than an oversized one.
+ * (`.any()` accepts every field name, so it should not arise here - the
+ * distinction is kept so this stays correct if the mount ever narrows.)
+ */
+const TOO_LARGE_CODES: Set<string> = new Set<string>([
+  "LIMIT_PART_COUNT",
+  "LIMIT_FILE_SIZE",
+  "LIMIT_FILE_COUNT",
+  "LIMIT_FIELD_KEY",
+  "LIMIT_FIELD_VALUE",
+  "LIMIT_FIELD_COUNT",
+]);
 
 /*
  * Middleware for handling any file uploads (multipart/form-data)
  * This is useful for webhooks that send data as multipart/form-data (e.g., SendGrid inbound email)
+ *
+ * Wrapped so a limit breach answers 413 rather than 500. multer signals
+ * every limit with a MulterError whose `code` is one of the LIMIT_*
+ * values, and nothing downstream knows what those mean - the generic
+ * error handler would turn a caller's oversized upload into a server
+ * error and page whoever is on call for it.
  */
-const MultipartFormDataMiddleware: RequestHandler =
-  upload.any() as unknown as RequestHandler;
+const MultipartFormDataMiddleware: RequestHandler = (
+  req: ExpressRequest,
+  res: ExpressResponse,
+  next: NextFunction,
+): void => {
+  uploadAny(req, res, (err: unknown): void => {
+    if (err instanceof multer.MulterError) {
+      const message: string = `Multipart request rejected: ${err.code}.`;
+
+      return next(
+        TOO_LARGE_CODES.has(err.code)
+          ? new PayloadTooLargeException(message)
+          : new BadRequestException(message),
+      );
+    }
+
+    return next(err);
+  });
+};
 
 export default MultipartFormDataMiddleware;

package/Server/Middleware/SlackAuthorization.ts

@@ -1,10 +1,13 @@
 import {
   ExpressResponse,
+  headerValueToString,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import GlobalCache from "../Infrastructure/GlobalCache";
 import Response from "../Utils/Response";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
 import { SlackAppSigningSecret } from "../EnvironmentConfig";
 import crypto from "crypto";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
@@ -21,6 +24,9 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
  */
 const SIGNATURE_PREFIX: string = "v0=";
 const HEX_DIGEST_REGEX: RegExp = /^[a-f0-9]{64}$/i;
+const UNIX_TIMESTAMP_REGEX: RegExp = /^\d+$/;
+const MAX_REQUEST_AGE_IN_SECONDS: number = 5 * 60;
+const REPLAY_CACHE_NAMESPACE: string = "slack-request-replay";
 
 export default class SlackAuthorization {
   @CaptureSpan()
@@ -51,25 +57,41 @@ export default class SlackAuthorization {
     // validate slack signing secret
     const slackSigningSecret: string = SlackAppSigningSecret.toString();
 
-    const slackSignature: string | undefined = req.headers[
-      "x-slack-signature"
-    ] as string | undefined;
-    const timestamp: string = req.headers[
-      "x-slack-request-timestamp"
-    ] as string;
+    const slackSignature: string | undefined = headerValueToString(
+      req.headers["x-slack-signature"],
+    );
+    const timestamp: string =
+      headerValueToString(req.headers["x-slack-request-timestamp"]) || "";
     // Use rawBody for both JSON and URL-encoded requests, fallback to rawFormUrlEncodedBody for backward compatibility
     const requestBody: string =
       (req as OneUptimeRequest).rawBody ||
       (req as OneUptimeRequest).rawFormUrlEncodedBody ||
       "";
 
-    logger.debug(
-      `slackSignature: ${slackSignature}`,
-      getLogAttributesFromRequest(req),
-    );
-    logger.debug(`timestamp: ${timestamp}`, getLogAttributesFromRequest(req));
-    logger.debug(`requestBody: `, getLogAttributesFromRequest(req));
-    logger.debug(requestBody, getLogAttributesFromRequest(req));
+    /*
+     * Slack signs the timestamp specifically so a captured request cannot be
+     * replayed indefinitely. Verify the documented five-minute freshness
+     * window before doing any signature work. The strict decimal check keeps
+     * Number parsing from accepting partial values such as "123abc".
+     */
+    const timestampInSeconds: number = Number(timestamp);
+    const nowInSeconds: number = Math.floor(Date.now() / 1000);
+
+    if (
+      !UNIX_TIMESTAMP_REGEX.test(timestamp) ||
+      !Number.isSafeInteger(timestampInSeconds) ||
+      Math.abs(nowInSeconds - timestampInSeconds) > MAX_REQUEST_AGE_IN_SECONDS
+    ) {
+      logger.error(
+        "Slack request has a missing, malformed, or stale X-Slack-Request-Timestamp header.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new BadDataException("Slack Signature Verification Failed."),
+      );
+    }
 
     const providedDigest: string =
       slackSignature && slackSignature.startsWith(SIGNATURE_PREFIX)
@@ -94,11 +116,6 @@ export default class SlackAuthorization {
       .update(baseString)
       .digest("hex");
 
-    logger.debug(
-      `Generated signature: ${SIGNATURE_PREFIX}${expectedDigest}`,
-      getLogAttributesFromRequest(req),
-    );
-
     /*
      * Both sides are decoded from 64 validated hex characters, so both
      * buffers are 32 bytes and timingSafeEqual cannot throw here.
@@ -120,6 +137,67 @@ export default class SlackAuthorization {
       );
     }
 
+    /*
+     * URL verification and options loading have no side effects and need their
+     * normal response on every valid delivery. All other signed Slack routes
+     * are processed at most once.
+     */
+    const isNaturallyIdempotentRequest: boolean =
+      req.route?.path === "/slack/options-load" ||
+      req.body?.["type"] === "url_verification";
+
+    if (isNaturallyIdempotentRequest) {
+      next();
+      return;
+    }
+
+    /*
+     * Freshness bounds replay to a small window; this atomic cache claim closes
+     * that remaining window across every application replica. The expiry lasts
+     * until this timestamp can no longer pass the freshness check. That can be
+     * almost ten minutes when a sender clock is five minutes ahead.
+     */
+    const replayCacheTtlInSeconds: number = Math.max(
+      timestampInSeconds + MAX_REQUEST_AGE_IN_SECONDS - nowInSeconds + 1,
+      1,
+    );
+
+    let isFirstDelivery: boolean;
+
+    try {
+      isFirstDelivery = await GlobalCache.setStringIfNotExists(
+        REPLAY_CACHE_NAMESPACE,
+        expectedDigest,
+        timestamp,
+        { expiresInSeconds: replayCacheTtlInSeconds },
+      );
+    } catch {
+      /*
+       * Replay protection is part of authentication, so cache failure must
+       * fail closed. Letting the request through would silently restore the
+       * vulnerability whenever Redis is unavailable.
+       */
+      logger.error(
+        "Slack replay protection is unavailable.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new ServiceUnavailableException(
+          "Slack request verification is temporarily unavailable.",
+        ),
+      );
+    }
+
+    if (!isFirstDelivery) {
+      logger.debug(
+        "Duplicate Slack request acknowledged without reprocessing.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendTextResponse(req, res, "");
+    }
+
     logger.debug(
       "Slack request authorized successfully",
       getLogAttributesFromRequest(req),