@oneuptime/common 12.0.28 → 12.0.29

package/Tests/Server/Utils/LogPipelineProcessorValidation.test.ts

@@ -0,0 +1,198 @@
+import { validateLogPipelineProcessor } from "../../../Server/Utils/LogPipelineProcessorValidation";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import LogPipelineProcessorType from "../../../Types/Log/LogPipelineProcessorType";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test — the save-time gate on log pipeline processors.
+ *
+ * A processor that cannot run is invisible: it sits in the pipeline list
+ * looking configured while every log flows past it untouched. That is
+ * exactly the shape of OneUptime/oneuptime#2515, where GrokParser was a
+ * valid processor type with no implementation behind it.
+ *
+ * The grok pattern is where a typo is easy and silent, so it is compiled
+ * here — once per human edit, in front of the only person who can fix
+ * it. Everything else is left alone: this gate exists to catch what
+ * would otherwise fail quietly, not to re-validate the whole form.
+ */
+
+function grokProcessor(configuration: JSONObject | string): {
+  processorType: string;
+  configuration: JSONObject | string;
+} {
+  return {
+    processorType: LogPipelineProcessorType.GrokParser,
+    configuration: configuration,
+  };
+}
+
+describe("log pipeline processor validation — grok patterns", () => {
+  it("accepts a valid pattern", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor({
+          source: "body",
+          pattern: "%{IPV4:client_ip} %{WORD:verb} %{NUMBER:status:int}",
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("accepts a configuration persisted as a JSON string", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor(
+          JSON.stringify({ source: "body", pattern: "%{WORD:verb}" }),
+        ),
+      );
+    }).not.toThrow();
+  });
+
+  it("rejects a configuration string that is not JSON", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(grokProcessor("not json at all"));
+    }).toThrow(BadDataException);
+  });
+
+  it("rejects a missing configuration", () => {
+    expect(() => {
+      return validateLogPipelineProcessor({
+        processorType: LogPipelineProcessorType.GrokParser,
+        configuration: null,
+      });
+    }).toThrow(BadDataException);
+  });
+
+  it("rejects a missing or blank pattern", () => {
+    for (const pattern of [undefined, "", "   "]) {
+      expect(() => {
+        return validateLogPipelineProcessor(
+          grokProcessor({ source: "body", pattern: pattern as string }),
+        );
+      }).toThrow(BadDataException);
+    }
+  });
+
+  it("rejects an unknown pattern name, naming it in the error", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor({ source: "body", pattern: "%{NOSUCHTHING:x}" }),
+      );
+    }).toThrow('Unknown grok pattern "%{NOSUCHTHING}"');
+  });
+
+  it("rejects a pattern whose regex does not parse", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor({ source: "body", pattern: "%{WORD:verb} ([unclosed" }),
+      );
+    }).toThrow(BadDataException);
+  });
+
+  it("rejects a field name that could not become an attribute key", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor({ source: "body", pattern: "%{WORD:client ip}" }),
+      );
+    }).toThrow(BadDataException);
+  });
+
+  it("rejects an unknown capture type", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor({ source: "body", pattern: "%{NUMBER:status:decimal}" }),
+      );
+    }).toThrow(BadDataException);
+  });
+});
+
+describe("log pipeline processor validation — target prefix", () => {
+  it("accepts prefixes that read like attribute-key namespaces", () => {
+    for (const targetPrefix of ["http", "http.", "http_", "_private", "a-b"]) {
+      expect(() => {
+        return validateLogPipelineProcessor(
+          grokProcessor({
+            source: "body",
+            pattern: "%{WORD:verb}",
+            targetPrefix,
+          }),
+        );
+      }).not.toThrow();
+    }
+  });
+
+  it("accepts an absent or blank prefix", () => {
+    for (const targetPrefix of [undefined, "", "  "]) {
+      expect(() => {
+        return validateLogPipelineProcessor(
+          grokProcessor({
+            source: "body",
+            pattern: "%{WORD:verb}",
+            targetPrefix: targetPrefix as string,
+          }),
+        );
+      }).not.toThrow();
+    }
+  });
+
+  it("rejects a prefix with characters an attribute key should not carry", () => {
+    for (const targetPrefix of ["my prefix", "1http", "http!", "{x}"]) {
+      expect(() => {
+        return validateLogPipelineProcessor(
+          grokProcessor({
+            source: "body",
+            pattern: "%{WORD:verb}",
+            targetPrefix,
+          }),
+        );
+      }).toThrow(BadDataException);
+    }
+  });
+
+  it("rejects a non-string prefix or source", () => {
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor({
+          source: "body",
+          pattern: "%{WORD:verb}",
+          targetPrefix: 12 as unknown as string,
+        } as unknown as JSONObject),
+      );
+    }).toThrow(BadDataException);
+
+    expect(() => {
+      return validateLogPipelineProcessor(
+        grokProcessor({
+          source: 12 as unknown as string,
+          pattern: "%{WORD:verb}",
+        } as unknown as JSONObject),
+      );
+    }).toThrow(BadDataException);
+  });
+});
+
+describe("log pipeline processor validation — other processor types", () => {
+  /*
+   * The other three processor types were shipped without a save-time
+   * gate and are not silently broken the way grok was. Adding one for
+   * them is a separate decision; this pins that it did not happen by
+   * accident here.
+   */
+  it("leaves non-grok processors alone", () => {
+    for (const processorType of [
+      LogPipelineProcessorType.AttributeRemapper,
+      LogPipelineProcessorType.SeverityRemapper,
+      LogPipelineProcessorType.CategoryProcessor,
+      "SomethingElse",
+    ]) {
+      expect(() => {
+        return validateLogPipelineProcessor({
+          processorType: processorType,
+          configuration: { anything: "goes" },
+        });
+      }).not.toThrow();
+    }
+  });
+});

package/Tests/Server/Utils/SecurityEvent/ConnectorErrorMessage.test.ts

@@ -329,10 +329,16 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
     publicKeyEncoding: { type: "spki", format: "pem" },
   });
 
+  /*
+   * A real Google token host, because the client now allowlists token_uri
+   * and rejects anything else at construction. Nothing here reaches the
+   * network — the fetch is injected — so the host is only ever a string
+   * the validator has to accept.
+   */
   const SERVICE_ACCOUNT_JSON: string = JSON.stringify({
     client_email: "poller@example.iam.gserviceaccount.com",
     private_key: privateKey,
-    token_uri: "https://oauth2.example.com/token",
+    token_uri: "https://oauth2.googleapis.com/token",
   });
 
   const INSTANCE: string =
@@ -410,14 +416,29 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
     expect(rawMessage.startsWith(prefix)).toBe(true);
 
     /*
-     * The template is a 46-character prefix plus responseText.slice(0, 500).
-     * 546 > 500, so under the old TableColumnType.LongText declaration
-     * checkMaxLengthOfFields threw BadDataException on the poller's own
-     * recovery write — which is how lastPolledAt and lastError both stayed
-     * null while the connector silently stopped polling.
+     * The template is a 46-character prefix plus responseText.slice(0, 500),
+     * and now an operator hint behind that. 546 was already > 500, so under
+     * the old TableColumnType.LongText declaration checkMaxLengthOfFields
+     * threw BadDataException on the poller's own recovery write — which is
+     * how lastPolledAt and lastError both stayed null while the connector
+     * silently stopped polling. The hint only makes the overflow worse.
+     *
+     * Both halves are pinned by content rather than by total length: the
+     * echo is exactly the first 500 characters of the body, and the tail is
+     * exactly what describeHttpFailure derives for this status and body. A
+     * length-only check would go on passing if the echo and the hint ever
+     * traded characters with each other.
      */
+    const guidance: string = GoogleSecOpsClient.describeHttpFailure(
+      403,
+      HUGE_ERROR_BODY,
+    );
+
     expect(prefix.length).toBe(46);
-    expect(rawMessage.length).toBe(prefix.length + 500);
+    expect(guidance.length).toBeGreaterThan(0);
+    expect(rawMessage).toBe(
+      `${prefix}${HUGE_ERROR_BODY.slice(0, 500)}${guidance}`,
+    );
     expect(rawMessage.length).toBeGreaterThan(OLD_LAST_ERROR_COLUMN_MAX_LENGTH);
     expect(rawMessage.length).toBeGreaterThan(
       getMaxLengthFromTableColumnType(TableColumnType.LongText)!,
@@ -428,7 +449,16 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
     expect(stored.length).toBeLessThanOrEqual(
       MAX_CONNECTOR_ERROR_MESSAGE_LENGTH,
     );
-    // 546 fits inside 1000, so the whole diagnostic survives the clamp.
+
+    /*
+     * Prefix + echo + hint still fits inside 1000, so the whole diagnostic
+     * survives the clamp. Asserted rather than assumed: if a future hint
+     * pushes the worst case past the clamp, the operator starts reading a
+     * truncated message and this test should be the thing that says so.
+     */
+    expect(rawMessage.length).toBeLessThanOrEqual(
+      MAX_CONNECTOR_ERROR_MESSAGE_LENGTH,
+    );
     expect(stored).toBe(rawMessage);
   });
 
@@ -442,7 +472,16 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
 
     expect(rawMessage.startsWith(prefix)).toBe(true);
 
-    // Same shape as above: prefix + 500 characters of echoed body > 500.
+    /*
+     * Prefix + 500 characters of echoed body, and nothing behind it. The
+     * token exchange deliberately carries no Chronicle hint: every hint
+     * describeHttpFailure knows how to give is about the instance resource
+     * name, the chronicle.viewer role or the region prefix, none of which
+     * explains a refusal from the OAuth token endpoint. Pinned exactly, so
+     * that appending guidance here becomes a decision rather than a
+     * side effect of editing the alerts path.
+     */
+    expect(rawMessage).toBe(`${prefix}${HUGE_ERROR_BODY.slice(0, 500)}`);
     expect(rawMessage.length).toBe(prefix.length + 500);
     expect(rawMessage.length).toBeGreaterThan(OLD_LAST_ERROR_COLUMN_MAX_LENGTH);