@oneuptime/common 12.0.25 → 12.0.27

package/Types/API/URL.ts

@@ -191,6 +191,23 @@ export default class URL extends DatabaseProperty {
     this.setParamsFromQueryString(queryString);
   }
 
+  /*
+   * Everything after the FIRST "?". split("?")[1] stopped at the second one,
+   * so a query that legitimately contains "?" — an encoded redirect target,
+   * say — lost its tail. RFC 3986 3.4 lets "?" appear inside a query.
+   */
+  private static queryStringOf(url: string): string {
+    const separatorIndex: number = url.indexOf("?");
+    return separatorIndex === -1 ? "" : url.substring(separatorIndex + 1);
+  }
+
+  /*
+   * Each pair splits on its FIRST "=" only. Splitting on every "=" and taking
+   * element [1] silently dropped everything after the second one, so a Jira
+   * JQL search ("?jql=project = OPS"), an OData "$filter", or a base64
+   * signature padded with "==" went out as a different query than the caller
+   * wrote — and the request still reported success.
+   */
   private setParamsFromQueryString(queryString?: string): void {
     if (!queryString) {
       return;
@@ -198,13 +215,25 @@ export default class URL extends DatabaseProperty {
 
     const keyValues: Array<string> = queryString.split("&");
     for (const keyValue of keyValues) {
-      if (keyValue.split("=")[0] && keyValue.split("=")[1]) {
-        const key: string | undefined = keyValue.split("=")[0];
-        const value: string | undefined = keyValue.split("=")[1];
-        if (key && value) {
-          this._params[key] = value;
-        }
+      const separatorIndex: number = keyValue.indexOf("=");
+
+      /*
+       * No "=" at all is a value-less param ("?flag"). It is kept with an
+       * empty value instead of being dropped, and queryStringSuffix re-emits
+       * it bare. A pair with no key ("?=v", or the empty segment in "?a=1&&b=2")
+       * has nothing to key on, so it is skipped.
+       */
+      const key: string =
+        separatorIndex === -1
+          ? keyValue
+          : keyValue.substring(0, separatorIndex);
+
+      if (!key) {
+        continue;
       }
+
+      this._params[key] =
+        separatorIndex === -1 ? "" : keyValue.substring(separatorIndex + 1);
     }
   }
 
@@ -221,7 +250,13 @@ export default class URL extends DatabaseProperty {
       "?" +
       Object.keys(this.params)
         .map((key: string) => {
-          return key + "=" + this.params[key];
+          /*
+           * An empty value re-emits as a bare key, so "?flag" survives a round
+           * trip. Values go back out verbatim: whatever encoding the caller
+           * supplied is what reaches the wire.
+           */
+          const value: string | undefined = this.params[key];
+          return value ? key + "=" + value : key;
         })
         .join("&")
     );
@@ -241,22 +276,33 @@ export default class URL extends DatabaseProperty {
     }
 
     let urlString: string = `${this.protocol}${this.hostname || this.email}`;
-    if (!this.email && !urlString.startsWith("mailto:")) {
-      if (this.route && this.route.toString().startsWith("/")) {
-        if (urlString.endsWith("/")) {
-          urlString = urlString.substring(0, urlString.length - 1);
-        }
-        urlString += this.route.toString();
-      } else {
-        if (urlString.endsWith("/")) {
-          urlString = urlString.substring(0, urlString.length - 1);
-        }
-        urlString += "/" + this.route.toString();
-      }
 
-      urlString += this.queryStringSuffix();
+    /*
+     * mailto: has no authority to trim and no route to append, so it skips the
+     * branch below — but it CAN carry a query, and "?subject=...&body=..." is
+     * the whole point of a prefilled mail link. The suffix used to be appended
+     * inside that branch, so skipping the route silently dropped the subject
+     * and body too, and the link opened on an empty draft. It returns here
+     * with the suffix attached instead, the way the opaque branch above does.
+     */
+    if (this.email || urlString.startsWith("mailto:")) {
+      return urlString + this.queryStringSuffix();
+    }
+
+    if (this.route && this.route.toString().startsWith("/")) {
+      if (urlString.endsWith("/")) {
+        urlString = urlString.substring(0, urlString.length - 1);
+      }
+      urlString += this.route.toString();
+    } else {
+      if (urlString.endsWith("/")) {
+        urlString = urlString.substring(0, urlString.length - 1);
+      }
+      urlString += "/" + this.route.toString();
     }
 
+    urlString += this.queryStringSuffix();
+
     return urlString;
   }
 
@@ -354,7 +400,7 @@ export default class URL extends DatabaseProperty {
        * to accept an email address — and "?subject=..." along with it.
        */
       const address: string = url.split("?")[0] || "";
-      const mailQueryString: string = url.split("?")[1] || "";
+      const mailQueryString: string = URL.queryStringOf(url);
 
       return new URL(protocol, address, undefined, mailQueryString);
     }
@@ -366,11 +412,25 @@ export default class URL extends DatabaseProperty {
        * Hostname.
        */
       const number: string = url.split("?")[0] || "";
-      const opaqueQueryString: string = url.split("?")[1] || "";
+      const opaqueQueryString: string = URL.queryStringOf(url);
 
       return new URL(protocol, number, undefined, opaqueQueryString);
     }
 
+    /*
+     * The query and the fragment come off BEFORE the authority and the route
+     * are read off the string.
+     *
+     * Splitting on "/" first meant a "/" inside a QUERY VALUE was read as a
+     * path segment whenever the URL had no path of its own:
+     * "https://example.com?next=/a/b" parsed to a route of "a/b" and went back
+     * out as "https://example.com/a/b?next=/a/b" — a path nobody wrote, on a
+     * request the workflow API components dispatch verbatim. The authority was
+     * already cut at "?"/"#" and is unchanged by this, so the host stays the
+     * one the SSRF check upstream resolved; what moved was the path.
+     */
+    const beforeQuery: string = url.split("?")[0] || "";
+
     /*
      * The authority ends at the first "/", "?" or "#". Splitting on "/" alone
      * left the query and fragment glued to the host for URLs with no path
@@ -378,19 +438,31 @@ export default class URL extends DatabaseProperty {
      * round-tripped wrong and handed anything that later interpolated the
      * host a way to smuggle a path.
      */
-    const authority: string = (url.split("/")[0] || "").split(/[?#]/)[0] || "";
+    const authorityAndPath: string = beforeQuery.split("#")[0] || "";
+
+    /*
+     * A fragment is not a field on this type. It rides on the end of the route
+     * — which is where it has always ended up, because the route was cut at
+     * "?" and never at "#" — so "…/docs#section" keeps round-tripping instead
+     * of losing its "#section" to this change.
+     */
+    const fragment: string = beforeQuery.substring(authorityAndPath.length);
+
+    const authority: string = authorityAndPath.split("/")[0] || "";
 
     const hostname: Hostname = new Hostname(authority);
 
     let route: Route | undefined;
 
-    if (url.split("/").length > 1) {
-      const paths: Array<string> = url.split("/");
-      paths.shift();
-      route = new Route(paths.join("/").split("?")[0]);
+    const pathSegments: Array<string> = authorityAndPath.split("/");
+    pathSegments.shift(); // drop the authority; what is left is the path
+    const path: string = pathSegments.join("/");
+
+    if (path || fragment) {
+      route = new Route(path + fragment);
     }
 
-    const queryString: string | undefined = url.split("?")[1] || "";
+    const queryString: string = URL.queryStringOf(url);
 
     return new URL(protocol, hostname, route, queryString);
   }

package/Types/AnalyticsDatabase/AnalyticsTableName.ts

@@ -7,6 +7,14 @@ enum AnalyticsTableName {
    * attributes with a keys sidecar for arbitrary-field filtering.
    */
   SecurityEvent = "SecurityEventItemV1",
+  /*
+   * Normalized IOC rows from STIX/TAXII threat-intel feeds. Keyed by
+   * (projectId, feedId, indicatorValue, stixId) on ReplacingMergeTree so
+   * a re-polled indicator upserts by its `version` (STIX modified
+   * timestamp) instead of duplicating; per-row retentionDate TTL expires
+   * indicators at valid_until.
+   */
+  ThreatIntelIndicator = "ThreatIntelIndicatorItemV1",
   /*
    * Deploy/config-change markers posted by CI/CD, rendered as dashed
    * vertical lines on metric charts. Peer of LogItemV3 in layout (tenant

package/Types/BaseDatabase/NotWildcard.ts

@@ -0,0 +1,86 @@
+import BadDataException from "../Exception/BadDataException";
+import { JSONObject, ObjectType } from "../JSON";
+import QueryOperator from "./QueryOperator";
+import { toLikePattern } from "./WildcardPattern";
+
+/**
+ * "matches none of these globs" — the negation of {@link Wildcard}, produced
+ * by `-@key:value*` in the telemetry search bar.
+ *
+ * It is a class of its own rather than a flag because every compiler in the
+ * codebase dispatches on operator identity, and because the negated form is
+ * not simply `NOT <positive form>` at the edges: on a nullable scalar the
+ * predicate has to let NULL through, and on a map sub-key it has to let rows
+ * that lack the key entirely through — the same asymmetry `NotContains`
+ * carries.
+ */
+export default class NotWildcard<T extends string> extends QueryOperator<T> {
+  private _values: Array<T> = [];
+
+  public get values(): Array<T> {
+    return this._values;
+  }
+
+  public set values(v: Array<T>) {
+    this._values = v;
+  }
+
+  /** The first glob. Convenience for the overwhelmingly common single case. */
+  public get value(): T {
+    return (this._values[0] ?? "") as T;
+  }
+
+  public constructor(value: T | Array<T>) {
+    super();
+    this.values = Array.isArray(value) ? value : [value];
+  }
+
+  /**
+   * The canonical DSL rendering, so that a value which slips into a
+   * string-coercing code path degrades to something a human can read rather
+   * than to `[object Object]`.
+   */
+  public override toString(): T {
+    if (this._values.length === 1) {
+      return (this._values[0] ?? "") as T;
+    }
+
+    return `(${this._values.join(" OR ")})` as T;
+  }
+
+  /** The globs compiled to LIKE/ILIKE patterns, in order. */
+  public toPatterns(): Array<string> {
+    return this._values.map((glob: T) => {
+      return toLikePattern(glob?.toString() || "");
+    });
+  }
+
+  public override toJSON(): JSONObject {
+    return {
+      _type: ObjectType.NotWildcard,
+      value: (this as NotWildcard<T>).values.map((glob: T) => {
+        return glob?.toString() || "";
+      }),
+    };
+  }
+
+  public static override fromJSON<T extends string>(
+    json: JSONObject,
+  ): NotWildcard<T> {
+    if (json["_type"] === ObjectType.NotWildcard) {
+      const value: unknown = json["value"];
+
+      if (Array.isArray(value)) {
+        return new NotWildcard<T>(
+          value.map((entry: unknown) => {
+            return String(entry ?? "") as T;
+          }),
+        );
+      }
+
+      return new NotWildcard<T>((value as T) || ("" as T));
+    }
+
+    throw new BadDataException("Invalid JSON: " + JSON.stringify(json));
+  }
+}

package/Types/BaseDatabase/Wildcard.ts

@@ -0,0 +1,89 @@
+import BadDataException from "../Exception/BadDataException";
+import { JSONObject, ObjectType } from "../JSON";
+import QueryOperator from "./QueryOperator";
+import { toLikePattern } from "./WildcardPattern";
+
+/**
+ * "matches any of these globs" — `api-*`, `*.internal`, `svc-?`.
+ *
+ * The payload is an ARRAY of globs so that one operator covers both a single
+ * pattern (`@k:a*`) and an any-of list that mixes patterns with literals
+ * (`@k:(a* OR bravo)`). `Query<T>` has no OR node and is not getting one, so
+ * folding the disjunction into the operator is what makes an OR over one key
+ * expressible at all.
+ *
+ * The globs are stored exactly as the user typed them, escapes intact: the
+ * LIKE pattern is derived at compile time by `toLikePattern`, so the client
+ * never has to know which database it is talking to and a filter that
+ * round-trips through a saved view or a URL stays readable.
+ */
+export default class Wildcard<T extends string> extends QueryOperator<T> {
+  private _values: Array<T> = [];
+
+  public get values(): Array<T> {
+    return this._values;
+  }
+
+  public set values(v: Array<T>) {
+    this._values = v;
+  }
+
+  /** The first glob. Convenience for the overwhelmingly common single case. */
+  public get value(): T {
+    return (this._values[0] ?? "") as T;
+  }
+
+  public constructor(value: T | Array<T>) {
+    super();
+    this.values = Array.isArray(value) ? value : [value];
+  }
+
+  /**
+   * The canonical DSL rendering, so that a value which slips into a
+   * string-coercing code path degrades to something a human can read rather
+   * than to `[object Object]`.
+   */
+  public override toString(): T {
+    if (this._values.length === 1) {
+      return (this._values[0] ?? "") as T;
+    }
+
+    return `(${this._values.join(" OR ")})` as T;
+  }
+
+  /** The globs compiled to LIKE/ILIKE patterns, in order. */
+  public toPatterns(): Array<string> {
+    return this._values.map((glob: T) => {
+      return toLikePattern(glob?.toString() || "");
+    });
+  }
+
+  public override toJSON(): JSONObject {
+    return {
+      _type: ObjectType.Wildcard,
+      value: (this as Wildcard<T>).values.map((glob: T) => {
+        return glob?.toString() || "";
+      }),
+    };
+  }
+
+  public static override fromJSON<T extends string>(
+    json: JSONObject,
+  ): Wildcard<T> {
+    if (json["_type"] === ObjectType.Wildcard) {
+      const value: unknown = json["value"];
+
+      if (Array.isArray(value)) {
+        return new Wildcard<T>(
+          value.map((entry: unknown) => {
+            return String(entry ?? "") as T;
+          }),
+        );
+      }
+
+      return new Wildcard<T>((value as T) || ("" as T));
+    }
+
+    throw new BadDataException("Invalid JSON: " + JSON.stringify(json));
+  }
+}

package/Types/BaseDatabase/WildcardPattern.ts

@@ -0,0 +1,176 @@
+/*
+ * Glob → SQL LIKE translation, shared by every wildcard-capable filter.
+ *
+ * Users type globs (`api-*`, `*.internal`, `a?c`); ClickHouse and Postgres
+ * speak LIKE patterns (`%`, `_`). The two alphabets overlap in the worst
+ * possible way: a `%` a user typed literally is a match-anything token to the
+ * database, and an `_` matches any single character. So the translation has to
+ * happen in ONE pass that can tell a metacharacter the user meant from one the
+ * database will read — running `escapeIlikePattern` first and then replacing
+ * `*` would work, but running it after would escape the `%` this function just
+ * produced, and every caller getting that order wrong is a silent
+ * match-nothing.
+ *
+ * Grammar:
+ *   *      → zero or more characters   (LIKE `%`)
+ *   ?      → exactly one character     (LIKE `_`)
+ *   \*     → a literal asterisk        (also \? \\ , and \<anything> is that
+ *                                       character, literally)
+ *   %  _   → literal, escaped for the database
+ *
+ * Both databases honour backslash escapes inside LIKE patterns, and every
+ * pattern this module produces is bound as a query parameter — never
+ * interpolated — so this is a correctness concern, not an injection one.
+ */
+
+/*
+ * How many globs one wildcard filter may carry.
+ *
+ * Unlike `IN (...)`, which binds one array parameter, each glob is its own
+ * ILIKE predicate — the cost is multiplicative in the number of patterns and
+ * the filter comes straight off a request body. A user typing an any-of list
+ * will never approach this; a request that does is refused with a 400 that
+ * names the limit rather than being silently truncated into a filter that
+ * means something narrower than what was asked for.
+ */
+export const MAX_WILDCARD_PATTERNS: number = 50;
+
+type EscapeLiteralCharFunction = (character: string) => string;
+
+/** Escape one literal character so LIKE reads it as itself. */
+const escapeLiteralChar: EscapeLiteralCharFunction = (
+  character: string,
+): string => {
+  if (character === "\\") {
+    return "\\\\";
+  }
+
+  if (character === "%") {
+    return "\\%";
+  }
+
+  if (character === "_") {
+    return "\\_";
+  }
+
+  return character;
+};
+
+export type GlobToLikePatternFunction = (glob: string) => string;
+
+/**
+ * Translate a user-typed glob into a LIKE/ILIKE pattern.
+ *
+ * `toLikePattern("api-*")` → `"api-%"`, `toLikePattern("*.internal")` →
+ * `"%.internal"`, `toLikePattern("100%")` → `"100\\%"` (a literal percent,
+ * because the user typed no wildcard at all).
+ */
+export const toLikePattern: GlobToLikePatternFunction = (
+  glob: string,
+): string => {
+  let pattern: string = "";
+
+  for (let index: number = 0; index < glob.length; index++) {
+    const character: string = glob[index]!;
+
+    if (character === "\\") {
+      /*
+       * A trailing lone backslash is the user's literal backslash — there is
+       * no next character for it to escape.
+       */
+      const escaped: string | undefined = glob[index + 1];
+
+      if (escaped === undefined) {
+        pattern += escapeLiteralChar("\\");
+        continue;
+      }
+
+      pattern += escapeLiteralChar(escaped);
+      index++;
+      continue;
+    }
+
+    if (character === "*") {
+      pattern += "%";
+      continue;
+    }
+
+    if (character === "?") {
+      pattern += "_";
+      continue;
+    }
+
+    pattern += escapeLiteralChar(character);
+  }
+
+  return pattern;
+};
+
+export type HasWildcardFunction = (value: string) => boolean;
+
+/**
+ * Does this value contain an UNESCAPED wildcard?
+ *
+ * This is what decides whether a typed value becomes a wildcard predicate or
+ * plain equality, so it has to honour the same escapes `toLikePattern` does:
+ * `a\*b` is a literal three-character-plus value, not a glob.
+ */
+export const hasWildcard: HasWildcardFunction = (value: string): boolean => {
+  for (let index: number = 0; index < value.length; index++) {
+    const character: string = value[index]!;
+
+    if (character === "\\") {
+      // Skip whatever it escapes; an escaped `*` is not a wildcard.
+      index++;
+      continue;
+    }
+
+    if (character === "*" || character === "?") {
+      return true;
+    }
+  }
+
+  return false;
+};
+
+export type EscapeWildcardsFunction = (value: string) => string;
+
+/**
+ * Make a value glob-inert, for building a search string out of data.
+ *
+ * A value that came from the data itself (a facet value the user clicked, an
+ * attribute copied off a log row) must round-trip as itself — a Kubernetes
+ * container arg like `--foo=*` or a URL pattern `/api/*` would otherwise come
+ * back as a wildcard and match far more than the row it was copied from.
+ */
+export const escapeWildcards: EscapeWildcardsFunction = (
+  value: string,
+): string => {
+  return value.replace(/([\\*?])/g, "\\$1");
+};
+
+/**
+ * Strip the escapes from a glob, recovering the literal text the user meant.
+ *
+ * Used to render a chip and to fall back to exact equality when a value turns
+ * out to carry no wildcard after all.
+ */
+export const unescapeWildcards: EscapeWildcardsFunction = (
+  value: string,
+): string => {
+  let literal: string = "";
+
+  for (let index: number = 0; index < value.length; index++) {
+    const character: string = value[index]!;
+
+    if (character === "\\" && index + 1 < value.length) {
+      literal += value[index + 1]!;
+      index++;
+      continue;
+    }
+
+    literal += character;
+  }
+
+  return literal;
+};