@oneuptime/common 12.0.23 → 12.0.25

package/Tests/Server/Middleware/MultipartFormData.test.ts

@@ -0,0 +1,298 @@
+import { describe, expect, jest, test } from "@jest/globals";
+import timers from "timers";
+
+/*
+ * multer calls `setImmediate` internally (make-middleware.js and
+ * remove-uploaded-files.js), and Common's jest environment is jsdom, which
+ * does not expose it. A `@jest-environment node` docblock is not an option
+ * here - Common's shared jest.setup.ts touches `window`, which is why
+ * EsbuildConfig.test.ts spawns a subprocess instead - so lend jsdom the
+ * real one from Node.
+ */
+if (
+  typeof (globalThis as unknown as { setImmediate?: unknown }).setImmediate !==
+  "function"
+) {
+  (globalThis as unknown as { setImmediate: unknown }).setImmediate =
+    timers.setImmediate;
+}
+
+/*
+ * The limits under test are 25 and 50 MiB, so the fixtures that probe them
+ * are 25 and 50 MiB of real multipart body parsed by the real busboy.
+ * That does not fit in jest's 5s default.
+ */
+jest.setTimeout(180_000);
+
+/*
+ * The multipart reader used by Pyroscope ingest and the SendGrid inbound
+ * email webhook.
+ *
+ * Both routes mount it BEFORE their auth check - Pyroscope before
+ * isAuthorizedServiceMiddleware, SendGrid before the webhook secret is
+ * verified - and it uses multer's memoryStorage, so every part it accepts
+ * is buffered in the process on behalf of a caller who has not proved
+ * anything yet.
+ *
+ * multer's defaults leave almost all of that unbounded: fileSize, files,
+ * fields and parts are all Infinity out of the box, and only fieldSize
+ * has a default at all. These tests pin the limits and the status code a
+ * breach produces, because the failure mode of getting this wrong is
+ * silent - an unbounded upload looks exactly like a working one until the
+ * pod dies.
+ */
+
+import MultipartFormDataMiddleware, {
+  MAX_MULTIPART_FIELDS,
+  MAX_MULTIPART_FIELD_BYTES,
+  MAX_MULTIPART_FILES,
+  MAX_MULTIPART_FILE_BYTES,
+} from "../../../Server/Middleware/MultipartFormData";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import { Readable } from "stream";
+
+const BOUNDARY: string = "----oneuptimetestboundary";
+
+interface MultipartPart {
+  name: string;
+  value: Buffer;
+  filename?: string;
+}
+
+function buildMultipartBody(parts: Array<MultipartPart>): Buffer {
+  const chunks: Array<Buffer> = [];
+
+  for (const part of parts) {
+    const disposition: string = part.filename
+      ? `form-data; name="${part.name}"; filename="${part.filename}"`
+      : `form-data; name="${part.name}"`;
+
+    const header: string =
+      `--${BOUNDARY}\r\n` +
+      `Content-Disposition: ${disposition}\r\n` +
+      (part.filename ? "Content-Type: application/octet-stream\r\n" : "") +
+      "\r\n";
+
+    chunks.push(Buffer.from(header));
+    chunks.push(part.value);
+    chunks.push(Buffer.from("\r\n"));
+  }
+
+  chunks.push(Buffer.from(`--${BOUNDARY}--\r\n`));
+
+  return Buffer.concat(chunks as unknown as Array<Uint8Array>);
+}
+
+interface Outcome {
+  req: ExpressRequest;
+  error: unknown;
+  nextCalls: number;
+}
+
+/*
+ * Drive the middleware with a real multipart body over a real Readable, so
+ * busboy does the parsing it does in production rather than being faked.
+ */
+function run(parts: Array<MultipartPart>): Promise<Outcome> {
+  const body: Buffer = buildMultipartBody(parts);
+
+  const req: Readable & {
+    headers: Record<string, string>;
+    body?: unknown;
+    files?: unknown;
+  } = Readable.from([body]) as never;
+
+  req.headers = {
+    "content-type": `multipart/form-data; boundary=${BOUNDARY}`,
+    "content-length": String(body.length),
+  };
+
+  const res: ExpressResponse = {
+    status: (): unknown => {
+      return { send: (): void => {}, json: (): void => {} };
+    },
+    headersSent: false,
+  } as unknown as ExpressResponse;
+
+  return new Promise<Outcome>((resolve: (value: Outcome) => void): void => {
+    let nextCalls: number = 0;
+
+    MultipartFormDataMiddleware(req as unknown as ExpressRequest, res, ((
+      err?: unknown,
+    ): void => {
+      nextCalls++;
+      resolve({
+        req: req as unknown as ExpressRequest,
+        error: err,
+        nextCalls: nextCalls,
+      });
+    }) as NextFunction);
+  });
+}
+
+function files(outcome: Outcome): Array<{ fieldname: string; buffer: Buffer }> {
+  return (outcome.req.files || []) as Array<{
+    fieldname: string;
+    buffer: Buffer;
+  }>;
+}
+
+describe("MultipartFormData - the limits are set where they were reasoned about", () => {
+  test("sizes match the app-wide 50 MiB body-parser number", () => {
+    expect(MAX_MULTIPART_FILE_BYTES).toBe(50 * 1024 * 1024);
+    expect(MAX_MULTIPART_FIELD_BYTES).toBe(25 * 1024 * 1024);
+  });
+
+  test("counts are bounded at all, which is the part multer leaves at Infinity", () => {
+    expect(MAX_MULTIPART_FILES).toBe(50);
+    expect(MAX_MULTIPART_FIELDS).toBe(200);
+    expect(Number.isFinite(MAX_MULTIPART_FILES)).toBe(true);
+    expect(Number.isFinite(MAX_MULTIPART_FIELDS)).toBe(true);
+  });
+});
+
+describe("MultipartFormData - normal bodies still parse", () => {
+  test("a single file arrives as a Buffer on req.files", async () => {
+    const outcome: Outcome = await run([
+      { name: "profile", value: Buffer.from("pprof-bytes"), filename: "p.pb" },
+    ]);
+
+    expect(outcome.error).toBeUndefined();
+    expect(files(outcome)).toHaveLength(1);
+    expect(files(outcome)[0]!.fieldname).toBe("profile");
+    expect(files(outcome)[0]!.buffer.toString()).toBe("pprof-bytes");
+  });
+
+  test("fields and files together, the SendGrid shape", async () => {
+    const outcome: Outcome = await run([
+      { name: "from", value: Buffer.from("someone@example.com") },
+      { name: "subject", value: Buffer.from("hello") },
+      { name: "attachment1", value: Buffer.from("PDF"), filename: "a.pdf" },
+    ]);
+
+    expect(outcome.error).toBeUndefined();
+    expect((outcome.req.body as Record<string, string>)["from"]).toBe(
+      "someone@example.com",
+    );
+    expect(files(outcome)).toHaveLength(1);
+  });
+
+  test("a body with no parts at all is fine", async () => {
+    const outcome: Outcome = await run([]);
+
+    expect(outcome.error).toBeUndefined();
+    expect(files(outcome)).toHaveLength(0);
+  });
+
+  test("a file right at the count limit is accepted", async () => {
+    const outcome: Outcome = await run(
+      Array.from({ length: MAX_MULTIPART_FILES }, (_v: unknown, i: number) => {
+        return {
+          name: `f${i}`,
+          value: Buffer.from("x"),
+          filename: `f${i}.bin`,
+        };
+      }),
+    );
+
+    expect(outcome.error).toBeUndefined();
+    expect(files(outcome)).toHaveLength(MAX_MULTIPART_FILES);
+  });
+
+  test("fields right at the count limit are accepted", async () => {
+    const outcome: Outcome = await run(
+      Array.from({ length: MAX_MULTIPART_FIELDS }, (_v: unknown, i: number) => {
+        return { name: `k${i}`, value: Buffer.from("v") };
+      }),
+    );
+
+    expect(outcome.error).toBeUndefined();
+    expect(
+      Object.keys(outcome.req.body as Record<string, unknown>),
+    ).toHaveLength(MAX_MULTIPART_FIELDS);
+  });
+});
+
+describe("MultipartFormData - breaches answer 413, not 500", () => {
+  test("one file over the size limit", async () => {
+    const outcome: Outcome = await run([
+      {
+        name: "big",
+        value: Buffer.alloc(MAX_MULTIPART_FILE_BYTES + 1),
+        filename: "big.bin",
+      },
+    ]);
+
+    expect(outcome.error).toBeInstanceOf(Exception);
+    expect((outcome.error as Exception).code).toBe(
+      ExceptionCode.PayloadTooLargeException,
+    );
+    expect((outcome.error as Exception).code).toBe(413);
+    expect((outcome.error as Exception).message).toContain("LIMIT_FILE_SIZE");
+  });
+
+  test("one file too many", async () => {
+    const outcome: Outcome = await run(
+      Array.from(
+        { length: MAX_MULTIPART_FILES + 1 },
+        (_v: unknown, i: number) => {
+          return {
+            name: `f${i}`,
+            value: Buffer.from("x"),
+            filename: `f${i}.bin`,
+          };
+        },
+      ),
+    );
+
+    expect((outcome.error as Exception).code).toBe(
+      ExceptionCode.PayloadTooLargeException,
+    );
+    expect((outcome.error as Exception).message).toContain("LIMIT_FILE_COUNT");
+  });
+
+  test("one field too many - thousands of tiny parts is the cheap version of this attack", async () => {
+    const outcome: Outcome = await run(
+      Array.from(
+        { length: MAX_MULTIPART_FIELDS + 1 },
+        (_v: unknown, i: number) => {
+          return { name: `k${i}`, value: Buffer.from("v") };
+        },
+      ),
+    );
+
+    expect((outcome.error as Exception).code).toBe(
+      ExceptionCode.PayloadTooLargeException,
+    );
+    expect((outcome.error as Exception).message).toContain("LIMIT_FIELD_COUNT");
+  });
+
+  test("one field value over the size limit", async () => {
+    const outcome: Outcome = await run([
+      { name: "html", value: Buffer.alloc(MAX_MULTIPART_FIELD_BYTES + 1) },
+    ]);
+
+    expect((outcome.error as Exception).code).toBe(
+      ExceptionCode.PayloadTooLargeException,
+    );
+    expect((outcome.error as Exception).message).toContain("LIMIT_FIELD_VALUE");
+  });
+
+  test("next() is called exactly once on a breach", async () => {
+    const outcome: Outcome = await run([
+      {
+        name: "big",
+        value: Buffer.alloc(MAX_MULTIPART_FILE_BYTES + 1),
+        filename: "big.bin",
+      },
+    ]);
+
+    expect(outcome.nextCalls).toBe(1);
+  });
+});

package/Tests/Server/Middleware/SlackAuthorization.test.ts

@@ -1,5 +1,6 @@
-import { describe, expect, test, beforeEach } from "@jest/globals";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 import crypto from "crypto";
+import GlobalCache from "../../../Server/Infrastructure/GlobalCache";
 import SlackAuthorization from "../../../Server/Middleware/SlackAuthorization";
 import Response from "../../../Server/Utils/Response";
 import {
@@ -8,6 +9,7 @@ import {
   OneUptimeRequest,
 } from "../../../Server/Utils/Express";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import ServiceUnavailableException from "../../../Types/Exception/ServiceUnavailableException";
 
 const SIGNING_SECRET: string = "slack-app-signing-secret";
 
@@ -28,6 +30,16 @@ jest.mock("../../../Server/Utils/Response", () => {
     __esModule: true,
     default: {
       sendErrorResponse: jest.fn(),
+      sendTextResponse: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../Server/Infrastructure/GlobalCache", () => {
+  return {
+    __esModule: true,
+    default: {
+      setStringIfNotExists: jest.fn(),
     },
   };
 });
@@ -41,11 +53,16 @@ jest.mock("../../../Server/Utils/Response", () => {
  * have to come back as the intended 400.
  */
 describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
-  const TIMESTAMP: string = "1700000000";
+  const NOW_IN_SECONDS: number = 1_800_000_000;
+  const TIMESTAMP: string = NOW_IN_SECONDS.toString();
   const RAW_BODY: string = "token=abc&team_id=T123&command=%2Foneuptime";
 
   const sendErrorResponse: jest.Mock =
     Response.sendErrorResponse as unknown as jest.Mock;
+  const sendTextResponse: jest.Mock =
+    Response.sendTextResponse as unknown as jest.Mock;
+  const setStringIfNotExists: jest.Mock =
+    GlobalCache.setStringIfNotExists as unknown as jest.Mock;
 
   const res: ExpressResponse = {} as ExpressResponse;
   let next: NextFunction;
@@ -62,15 +79,19 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
   type BuildRequestFunction = (
     signature: string | undefined,
     body?: string,
+    timestamp?: string | null,
   ) => OneUptimeRequest;
 
   const buildRequest: BuildRequestFunction = (
     signature: string | undefined,
     body: string = RAW_BODY,
+    timestamp: string | null = TIMESTAMP,
   ): OneUptimeRequest => {
-    const headers: Record<string, string> = {
-      "x-slack-request-timestamp": TIMESTAMP,
-    };
+    const headers: Record<string, string> = {};
+
+    if (timestamp !== null) {
+      headers["x-slack-request-timestamp"] = timestamp;
+    }
 
     if (signature !== undefined) {
       headers["x-slack-signature"] = signature;
@@ -81,9 +102,15 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    jest.spyOn(Date, "now").mockReturnValue(NOW_IN_SECONDS * 1000);
+    setStringIfNotExists.mockResolvedValue(true);
     next = jest.fn();
   });
 
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
   test("calls next when the signature matches the timestamp and body", async () => {
     const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
 
@@ -91,6 +118,12 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
 
     expect(next).toHaveBeenCalled();
     expect(sendErrorResponse).not.toHaveBeenCalled();
+    expect(setStringIfNotExists).toHaveBeenCalledWith(
+      "slack-request-replay",
+      sign(TIMESTAMP, RAW_BODY).slice("v0=".length),
+      TIMESTAMP,
+      { expiresInSeconds: 5 * 60 + 1 },
+    );
   });
 
   test("rejects a well-formed signature computed over a different body", async () => {
@@ -107,6 +140,212 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
       res,
       new BadDataException("Slack Signature Verification Failed."),
     );
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("accepts a request exactly five minutes old", async () => {
+    const timestamp: string = (NOW_IN_SECONDS - 5 * 60).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("accepts a request exactly five minutes in the future and covers the full replay window", async () => {
+    const timestamp: string = (NOW_IN_SECONDS + 5 * 60).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(setStringIfNotExists).toHaveBeenCalledWith(
+      "slack-request-replay",
+      sign(timestamp, RAW_BODY).slice("v0=".length),
+      timestamp,
+      { expiresInSeconds: 10 * 60 + 1 },
+    );
+  });
+
+  test("rejects a correctly signed request older than five minutes", async () => {
+    const timestamp: string = (NOW_IN_SECONDS - 5 * 60 - 1).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("rejects a correctly signed request more than five minutes in the future", async () => {
+    const timestamp: string = (NOW_IN_SECONDS + 5 * 60 + 1).toString();
+    const req: OneUptimeRequest = buildRequest(
+      sign(timestamp, RAW_BODY),
+      RAW_BODY,
+      timestamp,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+  });
+
+  test("acknowledges a duplicate without invoking the Slack handler", async () => {
+    setStringIfNotExists.mockResolvedValue(false);
+    const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+    expect(sendTextResponse).toHaveBeenCalledWith(req, res, "");
+  });
+
+  test("uses the canonical digest so signature casing cannot bypass replay detection", async () => {
+    const lowercaseSignature: string = sign(TIMESTAMP, RAW_BODY);
+    const uppercaseSignature: string = `v0=${lowercaseSignature
+      .slice("v0=".length)
+      .toUpperCase()}`;
+    const firstRequest: OneUptimeRequest = buildRequest(lowercaseSignature);
+    const replayRequest: OneUptimeRequest = buildRequest(uppercaseSignature);
+
+    setStringIfNotExists
+      .mockResolvedValueOnce(true)
+      .mockResolvedValueOnce(false);
+
+    await SlackAuthorization.isAuthorizedSlackRequest(firstRequest, res, next);
+    await SlackAuthorization.isAuthorizedSlackRequest(replayRequest, res, next);
+
+    const canonicalDigest: string = lowercaseSignature.slice("v0=".length);
+    expect(setStringIfNotExists).toHaveBeenNthCalledWith(
+      1,
+      "slack-request-replay",
+      canonicalDigest,
+      TIMESTAMP,
+      { expiresInSeconds: 5 * 60 + 1 },
+    );
+    expect(setStringIfNotExists).toHaveBeenNthCalledWith(
+      2,
+      "slack-request-replay",
+      canonicalDigest,
+      TIMESTAMP,
+      { expiresInSeconds: 5 * 60 + 1 },
+    );
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(sendTextResponse).toHaveBeenCalledWith(replayRequest, res, "");
+  });
+
+  test("allows repeated URL verification requests to reach their idempotent handler", async () => {
+    const signature: string = sign(TIMESTAMP, RAW_BODY);
+    const firstRequest: OneUptimeRequest = buildRequest(signature);
+    const secondRequest: OneUptimeRequest = buildRequest(signature);
+
+    Object.assign(firstRequest, {
+      route: { path: "/slack/events" },
+      body: { type: "url_verification" },
+    });
+    Object.assign(secondRequest, {
+      route: { path: "/slack/events" },
+      body: { type: "url_verification" },
+    });
+
+    await SlackAuthorization.isAuthorizedSlackRequest(firstRequest, res, next);
+    await SlackAuthorization.isAuthorizedSlackRequest(secondRequest, res, next);
+
+    expect(next).toHaveBeenCalledTimes(2);
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("allows repeated options loads to reach their idempotent handler", async () => {
+    const signature: string = sign(TIMESTAMP, RAW_BODY);
+    const firstRequest: OneUptimeRequest = buildRequest(signature);
+    const secondRequest: OneUptimeRequest = buildRequest(signature);
+
+    Object.assign(firstRequest, {
+      route: { path: "/slack/options-load" },
+    });
+    Object.assign(secondRequest, {
+      route: { path: "/slack/options-load" },
+    });
+
+    await SlackAuthorization.isAuthorizedSlackRequest(firstRequest, res, next);
+    await SlackAuthorization.isAuthorizedSlackRequest(secondRequest, res, next);
+
+    expect(next).toHaveBeenCalledTimes(2);
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
+
+  test("fails closed when distributed replay protection is unavailable", async () => {
+    setStringIfNotExists.mockRejectedValue(new Error("cache unavailable"));
+    const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new ServiceUnavailableException(
+        "Slack request verification is temporarily unavailable.",
+      ),
+    );
+  });
+
+  const malformedTimestamps: Array<[string, string | null]> = [
+    ["absent", null],
+    ["empty", ""],
+    ["non-numeric", "not-a-timestamp"],
+    ["partially numeric", `${TIMESTAMP}abc`],
+    ["fractional", `${TIMESTAMP}.5`],
+    ["negative", "-1"],
+    ["outside the safe integer range", "999999999999999999999"],
+  ];
+
+  describe("rejects a malformed timestamp", () => {
+    test.each(malformedTimestamps)(
+      "%s",
+      async (_label: string, timestamp: string | null) => {
+        const signedTimestamp: string = timestamp || TIMESTAMP;
+        const req: OneUptimeRequest = buildRequest(
+          sign(signedTimestamp, RAW_BODY),
+          RAW_BODY,
+          timestamp,
+        );
+
+        await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+        expect(next).not.toHaveBeenCalled();
+        expect(sendErrorResponse).toHaveBeenCalledWith(
+          req,
+          res,
+          new BadDataException("Slack Signature Verification Failed."),
+        );
+        expect(setStringIfNotExists).not.toHaveBeenCalled();
+      },
+    );
   });
 
   /*
@@ -143,7 +382,25 @@ describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
           res,
           new BadDataException("Slack Signature Verification Failed."),
         );
+        expect(setStringIfNotExists).not.toHaveBeenCalled();
       },
     );
   });
+
+  test("normalizes an array signature header without throwing", async () => {
+    const req: OneUptimeRequest = buildRequest(undefined);
+    req.headers["x-slack-signature"] = ["not-a-signature"];
+
+    await expect(
+      SlackAuthorization.isAuthorizedSlackRequest(req, res, next),
+    ).resolves.toBeUndefined();
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+    expect(setStringIfNotExists).not.toHaveBeenCalled();
+  });
 });