@oneuptime/common 12.0.25 → 12.0.26

package/Server/Utils/SSRFProtection.ts

@@ -1,5 +1,6 @@
 import URL from "../../Types/API/URL";
 import BadDataException from "../../Types/Exception/BadDataException";
+import PrivateNetworkWebhookConfig from "./PrivateNetworkWebhookConfig";
 import dns from "dns";
 import net from "net";
 
@@ -16,7 +17,81 @@ import net from "net";
  * different address between validation and the actual request (DNS rebinding).
  * Callers should therefore ALSO disable redirect-following on the request so a
  * validated public host cannot 3xx-redirect the server to an internal target.
+ *
+ * Blocked targets fall into two tiers, because a self-hosted install has a
+ * legitimate reason to reach one of them and none at all to reach the other:
+ *
+ *   FORBIDDEN — loopback, unspecified, link-local (the 169.254.169.254 cloud
+ *     metadata endpoint lives here), multicast, reserved, broadcast, and the
+ *     hostnames that name them. Refused in every deployment. The only way past
+ *     is an exact entry in the instance's PRIVATE_NETWORK_WEBHOOK_ALLOWLIST.
+ *
+ *   PRIVATE — RFC-1918, CGNAT, IPv6 unique-local and site-local. Refused by
+ *     default, which is the only correct answer for multi-tenant SaaS, but a
+ *     self-hosted operator can permit it with ALLOW_PRIVATE_NETWORK_WEBHOOKS
+ *     (see PrivateNetworkWebhookConfig).
+ *
+ * The same guard runs on the sandboxed axios bridge (VMRunner), which is
+ * shared with the Probe's custom code monitor. That caller reads its policy
+ * from the PROBE's environment, not the API server's, and overrides
+ * `targetLabel` and `privateNetworkHint` so its refusals name the right noun
+ * and the right machine.
+ *
+ * The tier only widens for callers that pass
+ * `allowPrivateNetworkTargets: true`, which means "this URL was authored by an
+ * authenticated member of a project". Sinks whose target can be chosen by an
+ * unauthenticated visitor — status page subscriber webhooks — pass nothing and
+ * get the strict policy, so the exception can never be reached from outside
+ * the tenant however the instance is configured.
  */
+
+export enum WebhookAddressTier {
+  Public = "Public",
+  Private = "Private",
+  Forbidden = "Forbidden",
+}
+
+export interface WebhookTargetValidationOptions {
+  /*
+   * A statement about the CALLER, not a permission: "this URL was written by
+   * an authenticated member of a project, not by a passing visitor". It is
+   * therefore a constant at each call site, never derived from request data.
+   *
+   * On its own it grants nothing — the instance configuration decides what, if
+   * anything, it unlocks (PrivateNetworkWebhookConfig), and an instance that
+   * configured neither knob is unaffected by it entirely. Its job is to keep
+   * the exception out of reach of the one sink whose target an unauthenticated
+   * visitor chooses.
+   *
+   * Absent means strict, so a new call site that says nothing is safe by
+   * default.
+   */
+  allowPrivateNetworkTargets?: boolean | undefined;
+
+  /*
+   * What to call the thing in error messages. Defaults to "Webhook URL",
+   * which is what most callers guard — but the same guard also sits on the
+   * sandboxed axios bridge, and telling the author of a monitor that their
+   * "webhook" was refused is simply wrong.
+   */
+  targetLabel?: string | undefined;
+
+  /*
+   * The sentence appended to a PRIVATE-tier refusal saying how to permit it.
+   * It has to be per-caller: the setting that would allow a workflow webhook
+   * lives on the API server, and the setting that would allow a probe's
+   * monitor lives on the probe — usually a different machine, often owned by
+   * a different person. Naming the wrong one is how an operator ends up
+   * filing the bug this feature came from.
+   */
+  privateNetworkHint?: string | undefined;
+}
+
+const DEFAULT_TARGET_LABEL: string = "Webhook URL";
+
+const DEFAULT_PRIVATE_NETWORK_HINT: string =
+  " Self-hosted instances can allow this by setting ALLOW_PRIVATE_NETWORK_WEBHOOKS or PRIVATE_NETWORK_WEBHOOK_ALLOWLIST.";
+
 export default class SSRFProtection {
   /*
    * Returns the bare, lowercased host of a URL — no port, no brackets — or an
@@ -80,7 +155,12 @@ export default class SSRFProtection {
 
   public static async validateWebhookTargetIsSafe(
     rawUrl: string | URL,
+    options?: WebhookTargetValidationOptions,
   ): Promise<void> {
+    const label: string = options?.targetLabel || DEFAULT_TARGET_LABEL;
+    const privateNetworkHint: string =
+      options?.privateNetworkHint ?? DEFAULT_PRIVATE_NETWORK_HINT;
+
     /*
      * URL.fromString only knows http/https/ws/wss/mongodb/mailto/tel/sms and
      * silently DEFAULTS anything else to https - "file:///etc/passwd" comes
@@ -101,29 +181,25 @@ export default class SSRFProtection {
       schemeMatch[1] &&
       !["http", "https"].includes(schemeMatch[1].toLowerCase())
     ) {
-      throw new BadDataException(
-        "Webhook URL must use http or https protocol.",
-      );
+      throw new BadDataException(`${label} must use http or https protocol.`);
     }
 
     let parsed: URL;
     try {
       parsed = URL.fromString(rawUrl.toString());
     } catch {
-      throw new BadDataException("Webhook URL is not a valid URL");
+      throw new BadDataException(`${label} is not a valid URL`);
     }
 
     const protocolValue: string = parsed.protocol.toString().toLowerCase();
     if (protocolValue !== "http://" && protocolValue !== "https://") {
-      throw new BadDataException(
-        "Webhook URL must use http or https protocol.",
-      );
+      throw new BadDataException(`${label} must use http or https protocol.`);
     }
 
     const rawHost: string = parsed.hostname.hostname.toLowerCase();
 
     if (!rawHost) {
-      throw new BadDataException("Webhook URL must include a host.");
+      throw new BadDataException(`${label} must include a host.`);
     }
 
     /*
@@ -137,7 +213,7 @@ export default class SSRFProtection {
     const hostname: string = SSRFProtection.extractHost(rawHost);
 
     if (!hostname) {
-      throw new BadDataException("Webhook URL must include a host.");
+      throw new BadDataException(`${label} must include a host.`);
     }
 
     /*
@@ -159,16 +235,58 @@ export default class SSRFProtection {
         ? [hostname, whatwgHostname]
         : [hostname];
 
+    /*
+     * The caller's declaration only ever reaches the instance configuration
+     * through here. With it false — the default, and every sink whose URL an
+     * unauthenticated visitor can choose — `isPrivateTierAllowed` and every
+     * allowlist lookup below are false too, and the policy is bit-for-bit what
+     * it was before the exception existed.
+     */
+    const isOptedIn: boolean = options?.allowPrivateNetworkTargets === true;
+    const isPrivateTierAllowed: boolean =
+      isOptedIn && PrivateNetworkWebhookConfig.isPrivateNetworkAllowed();
+
+    /*
+     * A host the operator named outright needs no further inspection — not the
+     * tier check, and not DNS. That is the whole point of naming
+     * "mattermost.internal": it resolves into a range the blocklist refuses,
+     * and the operator has said to trust it anyway.
+     */
+    const isHostAllowlisted: (host: string) => boolean = (
+      host: string,
+    ): boolean => {
+      if (!isOptedIn) {
+        return false;
+      }
+
+      return SSRFProtection.isIpLiteral(host)
+        ? PrivateNetworkWebhookConfig.isAddressAllowed(host)
+        : PrivateNetworkWebhookConfig.isHostnameAllowed(host);
+    };
+
     for (const host of hostnames) {
-      if (SSRFProtection.isBlockedHostnameLiteral(host)) {
+      if (isHostAllowlisted(host)) {
+        continue;
+      }
+
+      const tier: WebhookAddressTier =
+        SSRFProtection.classifyHostnameLiteral(host);
+
+      if (tier === WebhookAddressTier.Forbidden) {
+        throw new BadDataException(
+          `${label} points to a private, loopback, or link-local address and is not allowed.`,
+        );
+      }
+
+      if (tier === WebhookAddressTier.Private && !isPrivateTierAllowed) {
         throw new BadDataException(
-          "Webhook URL points to a private, loopback, or link-local address and is not allowed.",
+          `${label} points to a private network address and is not allowed.${privateNetworkHint}`,
         );
       }
     }
 
     for (const host of hostnames) {
-      if (SSRFProtection.isIpLiteral(host)) {
+      if (SSRFProtection.isIpLiteral(host) || isHostAllowlisted(host)) {
         continue;
       }
 
@@ -177,16 +295,32 @@ export default class SSRFProtection {
         resolved = await dns.promises.lookup(host, { all: true });
       } catch {
         throw new BadDataException(
-          "Webhook URL hostname could not be resolved via DNS.",
+          `${label} hostname could not be resolved via DNS.`,
         );
       }
 
       for (const entry of resolved) {
+        const address: string = entry.address.toLowerCase();
+
         if (
-          SSRFProtection.isBlockedHostnameLiteral(entry.address.toLowerCase())
+          isOptedIn &&
+          PrivateNetworkWebhookConfig.isAddressAllowed(address)
         ) {
+          continue;
+        }
+
+        const tier: WebhookAddressTier =
+          SSRFProtection.classifyHostnameLiteral(address);
+
+        if (tier === WebhookAddressTier.Forbidden) {
           throw new BadDataException(
-            "Webhook URL resolves to a private, loopback, or link-local address and is not allowed.",
+            `${label} resolves to a private, loopback, or link-local address and is not allowed.`,
+          );
+        }
+
+        if (tier === WebhookAddressTier.Private && !isPrivateTierAllowed) {
+          throw new BadDataException(
+            `${label} resolves to a private network address and is not allowed.${privateNetworkHint}`,
           );
         }
       }
@@ -343,19 +477,21 @@ export default class SSRFProtection {
   }
 
   /*
-   * True when an IPv6 literal points somewhere the server must never be made
-   * to reach. Ranges, not spellings: loopback, unspecified, link-local
-   * (fe80::/10), unique-local (fc00::/7) and multicast (ff00::/8), plus the
-   * ways IPv6 can embed IPv4 routing endpoints - IPv4-mapped (::ffff:0:0/96),
+   * Tier of an IPv6 literal. Ranges, not spellings: loopback, unspecified,
+   * link-local (fe80::/10) and multicast (ff00::/8) are FORBIDDEN;
+   * unique-local (fc00::/7) and site-local (fec0::/10) are PRIVATE. The ways
+   * IPv6 can embed IPv4 routing endpoints - IPv4-mapped (::ffff:0:0/96),
    * IPv4-compatible (::/96), NAT64 (64:ff9b::/96), 6to4 (2002::/16), and
-   * Teredo (2001:0000::/32) - which are handed to the IPv4 blocklist.
+   * Teredo (2001:0000::/32) - are handed to the IPv4 classifier, so an
+   * embedded 10.0.0.1 is PRIVATE and an embedded 169.254.169.254 is FORBIDDEN
+   * exactly as the bare forms are.
    */
-  private static isBlockedIpv6(address: string): boolean {
+  private static classifyIpv6(address: string): WebhookAddressTier {
     const groups: Array<number> | null = SSRFProtection.expandIpv6(address);
 
     if (!groups) {
       // Not parseable as IPv6; the caller's other checks decide.
-      return false;
+      return WebhookAddressTier.Public;
     }
 
     const isZeroThrough: (endExclusive: number) => boolean = (
@@ -384,17 +520,17 @@ export default class SSRFProtection {
 
     // ::  — unspecified. Connecting here lands on the local host.
     if (isZeroThrough(8)) {
-      return true;
+      return WebhookAddressTier.Forbidden;
     }
 
     // ::1 — loopback.
     if (isZeroThrough(7) && groups[7] === 1) {
-      return true;
+      return WebhookAddressTier.Forbidden;
     }
 
     // ::ffff:0:0/96 — IPv4-mapped.
     if (isZeroThrough(5) && groups[5] === 0xffff) {
-      return SSRFProtection.isBlockedIpv4(embeddedIpv4(6));
+      return SSRFProtection.classifyIpv4(embeddedIpv4(6));
     }
 
     // 64:ff9b::/96 — NAT64 well-known prefix.
@@ -406,27 +542,28 @@ export default class SSRFProtection {
       groups[4] === 0 &&
       groups[5] === 0
     ) {
-      return SSRFProtection.isBlockedIpv4(embeddedIpv4(6));
+      return SSRFProtection.classifyIpv4(embeddedIpv4(6));
     }
 
     // ::/96 — IPv4-compatible (deprecated, still routable by some stacks).
     if (isZeroThrough(6)) {
-      return SSRFProtection.isBlockedIpv4(embeddedIpv4(6));
+      return SSRFProtection.classifyIpv4(embeddedIpv4(6));
     }
 
     // 2002::/16 — 6to4 stores the IPv4 gateway in bits 16-48.
     if (groups[0] === 0x2002) {
-      return SSRFProtection.isBlockedIpv4(embeddedIpv4(1));
+      return SSRFProtection.classifyIpv4(embeddedIpv4(1));
     }
 
     /*
      * 2001:0000::/32 — Teredo stores its server IPv4 in bits 32-64 and
-     * an inverted client IPv4 in the last 32 bits.
+     * an inverted client IPv4 in the last 32 bits. Either one landing
+     * somewhere blocked condemns the address, so take the stricter verdict.
      */
     if (groups[0] === 0x2001 && groups[1] === 0) {
-      return (
-        SSRFProtection.isBlockedIpv4(embeddedIpv4(2)) ||
-        SSRFProtection.isBlockedIpv4(embeddedIpv4(6, true))
+      return SSRFProtection.strictestTier(
+        SSRFProtection.classifyIpv4(embeddedIpv4(2)),
+        SSRFProtection.classifyIpv4(embeddedIpv4(6, true)),
       );
     }
 
@@ -434,28 +571,49 @@ export default class SSRFProtection {
 
     // fe80::/10 — link-local.
     if ((first & 0xffc0) === 0xfe80) {
-      return true;
+      return WebhookAddressTier.Forbidden;
     }
 
-    // fc00::/7 — unique-local.
+    // ff00::/8 — multicast.
+    if ((first & 0xff00) === 0xff00) {
+      return WebhookAddressTier.Forbidden;
+    }
+
+    // fc00::/7 — unique-local. A self-hosted install's own internal network.
     if ((first & 0xfe00) === 0xfc00) {
-      return true;
+      return WebhookAddressTier.Private;
     }
 
     // fec0::/10 — site-local. Deprecated by RFC 3879, still routed on some networks.
     if ((first & 0xffc0) === 0xfec0) {
-      return true;
+      return WebhookAddressTier.Private;
     }
 
-    // ff00::/8 — multicast.
-    if ((first & 0xff00) === 0xff00) {
-      return true;
+    return WebhookAddressTier.Public;
+  }
+
+  private static strictestTier(
+    left: WebhookAddressTier,
+    right: WebhookAddressTier,
+  ): WebhookAddressTier {
+    if (
+      left === WebhookAddressTier.Forbidden ||
+      right === WebhookAddressTier.Forbidden
+    ) {
+      return WebhookAddressTier.Forbidden;
     }
 
-    return false;
+    if (
+      left === WebhookAddressTier.Private ||
+      right === WebhookAddressTier.Private
+    ) {
+      return WebhookAddressTier.Private;
+    }
+
+    return WebhookAddressTier.Public;
   }
 
-  private static isBlockedIpv4(address: string): boolean {
+  private static classifyIpv4(address: string): WebhookAddressTier {
     const octets: Array<number> = address.split(".").map((part: string) => {
       return Number(part);
     });
@@ -466,47 +624,59 @@ export default class SSRFProtection {
         return Number.isNaN(octet) || octet < 0 || octet > 255;
       })
     ) {
-      return true;
+      /*
+       * Unparseable. Refuse outright rather than fall through to "public":
+       * whatever produced this is not something to hand to an HTTP client, and
+       * it must not become reachable by opting in to the private tier either.
+       */
+      return WebhookAddressTier.Forbidden;
     }
 
     const [first, second] = octets as [number, number, number, number];
 
     if (first === 0) {
-      return true; // 0.0.0.0/8 — "this host".
+      return WebhookAddressTier.Forbidden; // 0.0.0.0/8 — "this host".
     }
     if (first === 127) {
-      return true; // loopback
+      return WebhookAddressTier.Forbidden; // loopback
+    }
+    if (first === 169 && second === 254) {
+      // link-local, incl. the 169.254.169.254 metadata endpoint
+      return WebhookAddressTier.Forbidden;
+    }
+    if (first >= 224) {
+      // multicast, reserved, and 255.255.255.255
+      return WebhookAddressTier.Forbidden;
     }
     if (first === 10) {
-      return true; // RFC-1918
+      return WebhookAddressTier.Private; // RFC-1918
     }
     if (first === 172 && (second & 0xf0) === 16) {
-      return true; // RFC-1918 172.16/12
+      return WebhookAddressTier.Private; // RFC-1918 172.16/12
     }
     if (first === 192 && second === 168) {
-      return true; // RFC-1918
-    }
-    if (first === 169 && second === 254) {
-      return true; // link-local, incl. the 169.254.169.254 metadata endpoint
+      return WebhookAddressTier.Private; // RFC-1918
     }
     if (first === 100 && (second & 0xc0) === 64) {
-      return true; // CGNAT 100.64/10
-    }
-    if (first >= 224) {
-      return true; // multicast, reserved, and 255.255.255.255
+      return WebhookAddressTier.Private; // CGNAT 100.64/10
     }
 
-    return false;
+    return WebhookAddressTier.Public;
   }
 
-  private static isBlockedHostnameLiteral(hostname: string): boolean {
+  /*
+   * Tier of a bare host — an IP literal in either family, or a hostname that
+   * names the local machine on its own. Anything else is Public here and is
+   * decided later on what DNS answers for it.
+   */
+  private static classifyHostnameLiteral(hostname: string): WebhookAddressTier {
     if (
       hostname === "localhost" ||
       hostname === "localhost." ||
       hostname.endsWith(".localhost") ||
       hostname === "metadata.google.internal"
     ) {
-      return true;
+      return WebhookAddressTier.Forbidden;
     }
 
     const address: string = SSRFProtection.stripZoneId(
@@ -514,13 +684,13 @@ export default class SSRFProtection {
     );
 
     if (net.isIPv4(address)) {
-      return SSRFProtection.isBlockedIpv4(address);
+      return SSRFProtection.classifyIpv4(address);
     }
 
     if (net.isIPv6(address)) {
-      return SSRFProtection.isBlockedIpv6(address);
+      return SSRFProtection.classifyIpv6(address);
     }
 
-    return false;
+    return WebhookAddressTier.Public;
   }
 }

package/Server/Utils/SecurityEvent/ConnectorErrorMessage.ts

@@ -0,0 +1,106 @@
+import logger from "../Logger";
+
+/*
+ * Recording a failure must never itself become a failure.
+ *
+ * Both security-event background loops — the Google SecOps poller and the
+ * detection rule evaluator — catch a per-item error and then write it back
+ * onto the row: lastError, plus the lastPolledAt / lastEvaluatedAt stamp
+ * that says the item was attempted at all. That bookkeeping write used to
+ * run bare inside the catch block, where it had two ways to throw:
+ *
+ *   - lastError was declared TableColumnType.LongText, i.e. varchar(500),
+ *     while a Google SecOps client error is a ~46 character prefix plus up
+ *     to 500 characters of echoed response body. DatabaseService's
+ *     checkMaxLengthOfFields rejects any string longer than the column's
+ *     declared max with a BadDataException, so a long API error made the
+ *     recovery write throw. ClickHouse errors echo the whole query back,
+ *     so the evaluator side was even likelier to trip over it.
+ *   - any ordinary database trouble — a dropped connection, a deadlock, a
+ *     constraint — does exactly the same thing.
+ *
+ * A throw from there escapes the catch block, and the entire loop with it.
+ * Nothing gets stamped, every remaining connection or rule in that tick is
+ * skipped, and the next tick a minute later repeats the run identically.
+ * What the customer sees is a connector that never polls whose row still
+ * reads lastPolledAt = null AND lastError = null: the two columns meant to
+ * explain the outage are precisely the ones the outage prevented from
+ * being written, so the failure is completely silent.
+ *
+ * Hence the two halves of this file: clamp the message to something a
+ * column will always accept, and run the write inside its own try/catch
+ * that logs and swallows. Whatever happens, the loop advances to the next
+ * item.
+ */
+
+export const MAX_CONNECTOR_ERROR_MESSAGE_LENGTH: number = 1000;
+
+/*
+ * Appended when a message is clamped, and counted inside the limit rather
+ * than added on top of it. A cut message that ends mid-sentence with no
+ * marker reads like the whole error, which sends whoever is debugging the
+ * stored value looking for a cause that was never there.
+ */
+const TRUNCATION_MARKER: string = "... (truncated)";
+
+/*
+ * What an error carrying nothing usable becomes. An empty string and the
+ * literal "undefined" both read like a bug in the recorder rather than a
+ * failure worth chasing, so neither is ever stored.
+ */
+const UNKNOWN_ERROR_MESSAGE: string = "Unknown error.";
+
+export default class ConnectorErrorMessage {
+  /*
+   * Anything thrown -> a message short enough that storing it cannot be
+   * what fails next. Errors contribute their .message; everything else is
+   * stringified.
+   */
+  public static toMessage(error: unknown): string {
+    let message: string = "";
+
+    if (error instanceof Error) {
+      message = error.message || "";
+    } else if (error !== null && error !== undefined) {
+      message = String(error);
+    }
+
+    message = message.trim();
+
+    if (!message) {
+      return UNKNOWN_ERROR_MESSAGE;
+    }
+
+    if (message.length <= MAX_CONNECTOR_ERROR_MESSAGE_LENGTH) {
+      return message;
+    }
+
+    const keptPrefix: string = message.slice(
+      0,
+      MAX_CONNECTOR_ERROR_MESSAGE_LENGTH - TRUNCATION_MARKER.length,
+    );
+
+    return `${keptPrefix}${TRUNCATION_MARKER}`;
+  }
+
+  /*
+   * Runs a failure-bookkeeping write inside its own try/catch. The caller
+   * is already handling one error and has already logged it; losing the
+   * record of that error is bad, but abandoning every remaining item in
+   * the run is far worse. So a write failure is logged against `label`
+   * and swallowed. This never rethrows.
+   */
+  public static async recordFailure(data: {
+    label: string;
+    write: () => Promise<void>;
+  }): Promise<void> {
+    try {
+      await data.write();
+    } catch (recordError) {
+      logger.error(
+        `${data.label}: could not record the failure on the row. The original error is logged above; continuing with the next item.`,
+      );
+      logger.error(recordError);
+    }
+  }
+}