@oneuptime/common 12.0.29 → 12.0.31

package/Server/API/TelemetryAPI.ts

@@ -14,7 +14,9 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import TelemetryType from "../../Types/Telemetry/TelemetryType";
 import TelemetryAttributeService from "../Services/TelemetryAttributeService";
 import TelemetrySourceMapService from "../Services/TelemetrySourceMapService";
-import SourceMapResolver from "../Utils/Telemetry/SourceMapResolver";
+import SourceMapResolver, {
+  MAX_FRAMES_PER_RESOLVE_REQUEST,
+} from "../Utils/Telemetry/SourceMapResolver";
 import {
   MinifiedStackFrame,
   ResolveStackTraceResult,
@@ -214,10 +216,28 @@ const requireProfileReadAccess: Array<RequestHandler> =
 
 /*
  * Mirrors the read access control declared on the SecurityEvent analytics
- * model.
+ * model - which, unlike every other signal above, is NOT the telemetry list.
+ * Security events read through the Security tiers only, so this route cannot
+ * be built from createTelemetryReadAccessGuard: doing so would leave the
+ * attribute endpoints open to ProjectMember and the Telemetry tiers while the
+ * model-backed CRUD API refused them, and the attribute keys and values of a
+ * SIEM table are themselves the sensitive part - usernames, hostnames, source
+ * IPs, and every value seen for them.
  */
-const requireSecurityEventReadAccess: Array<RequestHandler> =
-  createTelemetryReadAccessGuard(Permission.ReadSecurityEvent);
+const requireSecurityEventReadAccess: Array<RequestHandler> = [
+  UserMiddleware.getUserMiddleware,
+  UserMiddleware.requireUserAuthentication,
+  UserMiddleware.requirePermission({
+    permissions: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
+      Permission.ReadSecurityEvent,
+    ],
+  }),
+];
 
 router.post(
   "/telemetry/metrics/get-attributes",
@@ -346,6 +366,24 @@ router.post(
         );
       }
 
+      /*
+       * Bound the array before sanitizing it. sanitizeMinifiedStackFrames
+       * never throws and never truncates, so without this the only limit on
+       * the work a caller can ask for is the body-size cap.
+       */
+      if (
+        (body["frames"] as Array<unknown>).length >
+        MAX_FRAMES_PER_RESOLVE_REQUEST
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            `frames must contain at most ${MAX_FRAMES_PER_RESOLVE_REQUEST} stack frames.`,
+          ),
+        );
+      }
+
       const frames: Array<MinifiedStackFrame> =
         SourceMapResolver.sanitizeMinifiedStackFrames(body["frames"]);
 

package/Server/EnvironmentConfig.ts

@@ -15,6 +15,7 @@ import Route from "../Types/API/Route";
 import SubscriptionPlan from "../Types/Billing/SubscriptionPlan";
 import Email from "../Types/Email";
 import { JSONObject } from "../Types/JSON";
+import LIMIT_MAX from "../Types/Database/LimitMax";
 import ObjectID from "../Types/ObjectID";
 import Port from "../Types/Port";
 import Hostname from "../Types/API/Hostname";
@@ -101,6 +102,49 @@ const parsePositiveNumberFromEnv: (
   return parsedValue;
 };
 
+/*
+ * Like parsePositiveNumberFromEnv, but for settings that count things
+ * (requests, seconds): "1.5" or "0" are misconfigurations and fall back to the
+ * default rather than being rounded into something the operator did not ask
+ * for.
+ */
+const parsePositiveIntegerFromEnv: (
+  envKey: string,
+  fallback: number,
+) => number = (envKey: string, fallback: number): number => {
+  const rawValue: string | undefined = process.env[envKey];
+
+  if (rawValue === undefined || rawValue.trim() === "") {
+    return fallback;
+  }
+
+  const parsedValue: number = Number(rawValue.trim());
+
+  if (
+    !Number.isFinite(parsedValue) ||
+    !Number.isInteger(parsedValue) ||
+    parsedValue <= 0
+  ) {
+    return fallback;
+  }
+
+  return parsedValue;
+};
+
+/*
+ * parsePositiveIntegerFromEnv with a ceiling the rest of the system can
+ * actually honour. A configured value the app would silently fail to enforce
+ * is worse than a visibly clamped one -- so this clamps rather than trusting
+ * the operator, and every call site documents WHY its ceiling exists.
+ */
+const parseClampedIntegerFromEnv: (
+  envKey: string,
+  fallback: number,
+  ceiling: number,
+) => number = (envKey: string, fallback: number, ceiling: number): number => {
+  return Math.min(parsePositiveIntegerFromEnv(envKey, fallback), ceiling);
+};
+
 export const IsBillingEnabled: boolean = BillingConfig.IsBillingEnabled;
 export const BillingPublicKey: string = BillingConfig.BillingPublicKey;
 export const BillingPrivateKey: string = BillingConfig.BillingPrivateKey;
@@ -277,6 +321,75 @@ export const EncryptionSecret: ObjectID = new ObjectID(
   process.env["ENCRYPTION_SECRET"] || "secret",
 );
 
+/*
+ * The ENCRYPTION_SECRET values that ship in this repository, and are therefore
+ * as public as the source tree itself.
+ *
+ * "secret" is the fallback above. "please-change-this-to-random-value" is what
+ * `config.example.env` sets, and the documented Docker Compose install is
+ * `cp config.example.env config.env` (README) with
+ * `ENCRYPTION_SECRET: ${ENCRYPTION_SECRET}` passed straight through by
+ * docker-compose.base.yml -- so it is the key an install that follows the docs
+ * actually runs with unless the operator edits it. Home/Scripts/Install.sh
+ * randomizes the placeholders, but nothing in the documented compose path
+ * calls it, and Scripts/Install/MergeEnvTemplate.js carries the placeholder
+ * forward on upgrade. The Helm chart is unaffected: it generates a random
+ * secret when `encryptionSecret` is left empty.
+ */
+export const InsecureEncryptionSecretValues: Array<string> = [
+  "secret",
+  "please-change-this-to-random-value",
+];
+
+/*
+ * The prefix every placeholder in config.example.env starts with. Flagging it
+ * catches a partially edited placeholder ("please-change-this-to-random-value-2")
+ * as well as the exact strings above.
+ */
+export const InsecureEncryptionSecretPrefix: string = "please-change-this";
+
+/*
+ * True when the install is encrypting columns with a value the repository
+ * ships rather than one the operator chose.
+ *
+ * Every `@TableColumn({ encrypted: true })` value -- OAuth tokens, SMTP
+ * passwords, the on-call calendar feed tokens -- is AES-encrypted with
+ * ENCRYPTION_SECRET, so leaving it unset or at one of the shipped placeholders
+ * means anyone who can read a database dump can read every one of those
+ * columns with a key that is public on GitHub. Nothing refuses to start over
+ * it (that would take down an existing install on upgrade), but the boot log
+ * says so loudly; see EncryptionSecretWarning and StartServer.init.
+ *
+ * The comparison is case-sensitive on purpose: the encryption key is, and the
+ * warning is about the exact values an attacker would try first. Any other
+ * weak key is the operator's own choice.
+ */
+export const IsEncryptionSecretInsecure: boolean = ((): boolean => {
+  const rawValue: string | undefined = process.env["ENCRYPTION_SECRET"];
+
+  if (rawValue === undefined) {
+    return true;
+  }
+
+  const value: string = rawValue.trim();
+
+  return (
+    value === "" ||
+    InsecureEncryptionSecretValues.includes(value) ||
+    value.startsWith(InsecureEncryptionSecretPrefix)
+  );
+})();
+
+/*
+ * The boot warning itself, or null when the secret is fine. EnvironmentConfig
+ * cannot log it directly -- Logger imports LogLevel from this module, so
+ * importing Logger here would be circular -- which is why the message is
+ * exported and the process entrypoint emits it.
+ */
+export const EncryptionSecretWarning: string | null = IsEncryptionSecretInsecure
+  ? 'ENCRYPTION_SECRET is unset or still one of the placeholder values shipped in this repository ("secret", or the "please-change-this-to-random-value" that config.example.env sets). Every encrypted database column (integration tokens, SMTP credentials, on-call calendar feed tokens) is protected only by a key that is public in the OneUptime repository. Set ENCRYPTION_SECRET to a long random value in config.env (or the Helm chart) before storing anything sensitive. Note that changing it later makes values encrypted with the old key unreadable.'
+  : null;
+
 export const OpenSourceDeploymentWebhookUrl: string =
   process.env["OPEN_SOURCE_DEPLOYMENT_WEBHOOK_URL"] || "";
 
@@ -725,6 +838,143 @@ export const DisableTelemetry: boolean =
 export const DisableUpdateCheck: boolean =
   process.env["DISABLE_UPDATE_CHECK"] === "true";
 
+/*
+ * On-call calendar feeds: the public, token-in-URL .ics endpoints that Google
+ * Calendar / Outlook / Apple Calendar poll for on-call shifts
+ * (/api/on-call-calendar/{user,schedule,project}/<token>/...).
+ *
+ * Kill switch. When true every feed route answers 503 with Retry-After: 3600
+ * so calendar clients back off for an hour and keep the copy they already
+ * have, instead of dropping the calendar the way a 404 would make them.
+ * Nothing about the feeds is deleted; flip it back and they resume.
+ */
+export const DisableOnCallCalendarFeed: boolean =
+  process.env["DISABLE_ON_CALL_CALENDAR_FEED"] === "true";
+
+/*
+ * Fixed-window rate limits for those same feed routes. Two counters, either of
+ * which can reject: per token + client address, and per client address alone
+ * (the ceiling that survives a caller rotating tokens). The defaults are sized
+ * for calendar clients, which poll on the order of once an hour -- Apple is the
+ * most eager at every five minutes -- with a lot of headroom for a team's
+ * clients behind one office address. The limiter fails OPEN when Redis is
+ * unreachable: it is load control, not the only thing guarding the token.
+ */
+export const OnCallCalendarFeedRateLimitWindowSeconds: number =
+  parsePositiveIntegerFromEnv(
+    "ON_CALL_CALENDAR_FEED_RATE_LIMIT_WINDOW_SECONDS",
+    60,
+  );
+
+export const OnCallCalendarFeedRateLimitPerTokenPerWindow: number =
+  parsePositiveIntegerFromEnv(
+    "ON_CALL_CALENDAR_FEED_RATE_LIMIT_PER_TOKEN_PER_WINDOW",
+    60,
+  );
+
+export const OnCallCalendarFeedRateLimitPerIpPerWindow: number =
+  parsePositiveIntegerFromEnv(
+    "ON_CALL_CALENDAR_FEED_RATE_LIMIT_PER_IP_PER_WINDOW",
+    3000,
+  );
+
+/*
+ * Source map ingestion and resolution limits.
+ *
+ * These were fixed constants, sized on the assumption that "a build rarely
+ * emits more than a few dozen chunks with maps". That assumption does not
+ * survive route-level code splitting: a Nuxt/Vite/Next app with a hundred
+ * routes emits hundreds of chunk .map files per release, and the maps that
+ * did not fit simply never resolved. They are operator knobs now, and the
+ * Helm chart exposes each one.
+ *
+ * The division of labour matters, because it is what makes raising the
+ * ceiling safe:
+ *
+ *   - SourceMapMaxMapsPerRelease is purely a WRITE gate. An upload past it is
+ *     rejected with a 400 that names the limit. It is no longer the
+ *     resolver's read limit, so raising it can never turn stored maps into
+ *     maps that store fine and then silently never resolve.
+ *   - SourceMapMaxBytesPerResolve is what bounds the READ path. Resolution
+ *     loads whole maps into memory, so a byte budget -- not a row count -- is
+ *     the invariant that actually protects the process.
+ */
+
+/*
+ * Distinct bundles one (project, service, release) may hold.
+ *
+ * Clamped to LIMIT_MAX because the gate reads the release's existing bundle
+ * paths with LIMIT_MAX; a configured value above that could not be enforced
+ * and would be a lie.
+ */
+export const SourceMapMaxMapsPerRelease: number = parseClampedIntegerFromEnv(
+  "SOURCE_MAP_MAX_MAPS_PER_RELEASE",
+  1000,
+  LIMIT_MAX,
+);
+
+/*
+ * How long uploaded maps are kept. A map is only useful while exceptions from
+ * its release are still within telemetry retention, and the default
+ * comfortably exceeds it.
+ */
+export const SourceMapRetentionInDays: number = parsePositiveIntegerFromEnv(
+  "SOURCE_MAP_RETENTION_DAYS",
+  90,
+);
+
+/*
+ * Hard ceiling on ONE map, enforced on the raw upload and again on the
+ * decoded string.
+ *
+ * The ceiling is MAX_MULTIPART_FILE_BYTES from
+ * Common/Server/Middleware/MultipartFormData.ts, repeated as a literal
+ * because that module pulls in multer and express and has no business being
+ * imported by config. The two are pinned to each other by
+ * Common/Tests/Server/Utils/Telemetry/SourceMapLimits.test.ts. Configuring
+ * past it would not raise anything: multer aborts the request first, turning
+ * the 400 this ceiling is meant to give into a confusing 413.
+ */
+export const SourceMapMaxFileSizeInBytes: number = parseClampedIntegerFromEnv(
+  "SOURCE_MAP_MAX_FILE_SIZE_BYTES",
+  50 * 1024 * 1024,
+  50 * 1024 * 1024,
+);
+
+/*
+ * Source map files accepted in ONE upload request.
+ *
+ * Separate from the per-release ceiling: a release may hold far more maps
+ * than any single request may carry, and CI splits the upload. Clamped to
+ * MAX_MULTIPART_FILES, which is the shared middleware default and runs
+ * BEFORE authentication on every route that mounts it -- so this knob only
+ * ever narrows the source map route, never widens the pre-auth surface that
+ * Pyroscope and inbound email sit behind.
+ */
+export const SourceMapMaxFilesPerRequest: number = parseClampedIntegerFromEnv(
+  "SOURCE_MAP_MAX_FILES_PER_REQUEST",
+  50,
+  50,
+);
+
+/*
+ * Total map bytes one resolve request may pull into memory.
+ *
+ * This is the bound that used to be implied by the per-release count, and it
+ * is a much tighter one: resolution materialises whole maps, each up to
+ * SourceMapMaxFileSizeInBytes, and the set it loads is chosen by a
+ * caller-supplied frames array. Maps that do not fit the budget are skipped
+ * in match-quality order and REPORTED on the response, so a skip is visible
+ * rather than looking like "no map was uploaded".
+ *
+ * 512 MiB is roughly ten maps at the per-file ceiling, or every map of a
+ * realistically sized release many times over.
+ */
+export const SourceMapMaxBytesPerResolve: number = parsePositiveIntegerFromEnv(
+  "SOURCE_MAP_MAX_BYTES_PER_RESOLVE",
+  512 * 1024 * 1024,
+);
+
 export const EnableProfiling: boolean =
   process.env["ENABLE_PROFILING"] === "true";