@oneuptime/common 12.0.3 → 12.0.4

package/Server/API/DashboardAPI.ts

@@ -69,6 +69,7 @@ import NetworkSiteService from "../Services/NetworkSiteService";
 import SpanService from "../Services/SpanService";
 import LogService from "../Services/LogService";
 import DashboardComponentType from "../../Types/Dashboard/DashboardComponentType";
+import { DashboardVariableType } from "../../Types/Dashboard/DashboardVariable";
 import Includes from "../../Types/BaseDatabase/Includes";
 
 /*
@@ -994,6 +995,14 @@ export default class DashboardAPI extends BaseAPI<
      * the behaviour here scoped to the dashboard's owning projectId.
      * Authorization reuses DashboardService.hasReadAccess (public flag, IP
      * whitelist, master password) — never falls back to project-wide read.
+     *
+     * The requested attribute key is additionally allowlisted against the
+     * keys this dashboard's own variables bind to. Project scoping alone is
+     * not enough here: the underlying query is a SELECT DISTINCT over the
+     * attribute map of every log, span, metric and exception in the project,
+     * so an unrestricted key would let anyone holding a public dashboard id
+     * read `user.email`, `db.statement`, `http.url`, ... out of telemetry the
+     * dashboard never renders (GHSA-w332-x78m-vf3v).
      */
     this.router.post(
       `${new this.entityType()
@@ -1021,10 +1030,11 @@ export default class DashboardAPI extends BaseAPI<
             );
           }
 
-          const attributeKey: string | undefined =
-            req.body && (req.body["attributeKey"] as string);
+          const attributeKey: unknown = req.body
+            ? req.body["attributeKey"]
+            : undefined;
 
-          if (!attributeKey || !attributeKey.trim()) {
+          if (typeof attributeKey !== "string" || !attributeKey.trim()) {
             throw new BadDataException("attributeKey is required.");
           }
 
@@ -1048,6 +1058,7 @@ export default class DashboardAPI extends BaseAPI<
               select: {
                 _id: true,
                 projectId: true,
+                dashboardViewConfig: true,
               },
               props: {
                 isRoot: true,
@@ -1058,11 +1069,32 @@ export default class DashboardAPI extends BaseAPI<
             throw new NotFoundException("Dashboard not found");
           }
 
+          /*
+           * Only the attribute keys this dashboard's own variable dropdowns
+           * offer may be read. Variable interpolation only ever substitutes
+           * a variable's VALUE into a widget filter — never its key — so the
+           * stored view config is an exact allowlist. A dashboard with no
+           * telemetry-attribute variables has nothing to look up and is
+           * refused outright.
+           */
+          const requestedAttributeKey: string = attributeKey.trim();
+
+          const allowedAttributeKeys: Set<string> =
+            DashboardAPI.collectDashboardVariableAttributeKeys(
+              dashboard.dashboardViewConfig,
+            );
+
+          if (!allowedAttributeKeys.has(requestedAttributeKey)) {
+            throw new BadDataException(
+              "This attribute is not part of this dashboard.",
+            );
+          }
+
           const values: Array<string> =
             await TelemetryAttributeService.fetchAttributeValues({
               projectId: dashboard.projectId,
               telemetryType,
-              attributeKey: attributeKey.trim(),
+              attributeKey: requestedAttributeKey,
             });
 
           return Response.sendJsonObjectResponse(req, res, {
@@ -1265,9 +1297,25 @@ export default class DashboardAPI extends BaseAPI<
             DashboardAPI.collectDashboardMetricNames(
               dashboard.dashboardViewConfig,
             );
-          const requestedMetricName: unknown = aggregateBy.query
-            ? (aggregateBy.query as Record<string, unknown>)["name"]
-            : undefined;
+
+          /*
+           * Read the query through an OWN-properties copy. JSON.parse turns a
+           * literal "__proto__" member into a real own key and
+           * JSONFunctions.deserialize copies it with `newVal[key] = ...`,
+           * which fires Object.prototype's __proto__ setter — so a plain
+           * `query["name"]` lookup walks the prototype chain and sees a name
+           * that a later own-properties spread would silently drop, leaving
+           * the aggregation with no metric predicate at all. The check and
+           * the object that reaches the database must read the same keys.
+           */
+          const requestedQuery: Record<string, unknown> =
+            aggregateBy.query &&
+            typeof aggregateBy.query === "object" &&
+            !Array.isArray(aggregateBy.query)
+              ? { ...(aggregateBy.query as Record<string, unknown>) }
+              : {};
+
+          const requestedMetricName: unknown = requestedQuery["name"];
 
           if (
             typeof requestedMetricName !== "string" ||
@@ -1279,14 +1327,156 @@ export default class DashboardAPI extends BaseAPI<
           }
 
           /*
-           * Security: never trust a client-supplied projectId on a public,
-           * unauthenticated endpoint. Pin the aggregation to the dashboard's
-           * project before it reaches the database service.
+           * Pinning the metric name is not enough on its own: a grouped
+           * aggregation echoes each group's key back in the result rows, so
+           * `groupByAttributeKeys: ["enduser.id"]` — or the blunter
+           * `groupBy: { attributes: true }`, which returns the WHOLE
+           * attribute map — turns an allowlisted metric into a reader for
+           * attribute values the widget never renders. Both grouping
+           * dimensions are therefore allowlisted against the stored view
+           * config as well; interpolation never rewrites either of them.
            */
+          const allowedGroupByAttributeKeys: Set<string> =
+            DashboardAPI.collectDashboardGroupByAttributeKeys(
+              dashboard.dashboardViewConfig,
+            );
+          const requestedGroupByAttributeKeys: unknown =
+            aggregateBy.groupByAttributeKeys;
+
+          /*
+           * `null` means "not grouped" here: JSONFunctions.serialize drops
+           * undefined but preserves null, and both downstream sinks already
+           * treat a null grouping as absent.
+           */
+          if (
+            requestedGroupByAttributeKeys !== undefined &&
+            requestedGroupByAttributeKeys !== null
+          ) {
+            if (!Array.isArray(requestedGroupByAttributeKeys)) {
+              throw new BadDataException(
+                "groupByAttributeKeys must be an array of attribute keys.",
+              );
+            }
+
+            for (const requestedKey of requestedGroupByAttributeKeys) {
+              if (
+                typeof requestedKey !== "string" ||
+                !allowedGroupByAttributeKeys.has(requestedKey)
+              ) {
+                throw new BadDataException(
+                  "This attribute is not part of this dashboard.",
+                );
+              }
+            }
+          }
+
+          const allowedGroupByColumns: Set<string> =
+            DashboardAPI.collectDashboardGroupByColumns(
+              dashboard.dashboardViewConfig,
+            );
+          const requestedGroupBy: unknown = aggregateBy.groupBy;
+
+          if (requestedGroupBy !== undefined && requestedGroupBy !== null) {
+            if (
+              typeof requestedGroupBy !== "object" ||
+              Array.isArray(requestedGroupBy)
+            ) {
+              throw new BadDataException("groupBy must be an object.");
+            }
+
+            for (const requestedColumn of Object.keys(requestedGroupBy)) {
+              if (!allowedGroupByColumns.has(requestedColumn)) {
+                throw new BadDataException(
+                  "This grouping is not part of this dashboard.",
+                );
+              }
+            }
+
+            /*
+             * Hand the SQL builder the same keys this guard validated. The
+             * guard reads Object.keys but the GROUP BY builder walks the
+             * object with for...in, so an inherited key would otherwise
+             * reach the query without ever being checked.
+             */
+            aggregateBy.groupBy = {
+              ...(requestedGroupBy as Record<string, unknown>),
+            } as typeof aggregateBy.groupBy;
+          }
+
+          /*
+           * The client never chooses what is aggregated over what: every
+           * widget aggregates `value` over `time`. Left open, an anonymous
+           * caller could aggregate `attributes` instead — `max(attributes)`
+           * returns the whole map and the row mapper passes non-numeric
+           * aggregates through untouched, handing back a full attribute map
+           * per time bucket.
+           */
+          if (aggregateBy.aggregateColumnName !== "value") {
+            throw new BadDataException("Invalid aggregateColumnName.");
+          }
+
+          if (aggregateBy.aggregationTimestampColumnName !== "time") {
+            throw new BadDataException(
+              "Invalid aggregationTimestampColumnName.",
+            );
+          }
+
+          // Never let an anonymous caller choose an unbounded page.
+          aggregateBy.limit = Math.min(
+            Math.max(Number(aggregateBy.limit) || LIMIT_PER_PROJECT, 1),
+            LIMIT_PER_PROJECT,
+          );
+          aggregateBy.skip = Math.max(Number(aggregateBy.skip) || 0, 0);
+
+          /*
+           * Security: the client does not get to choose what is filtered on a
+           * public, unauthenticated endpoint. Rebuild the query from the
+           * fields the dashboard's own widgets legitimately send — the
+           * allowlisted metric name, the time window, and attribute filters
+           * on keys those widgets already filter by — and pin the project.
+           * Everything else the client sent is dropped rather than merged: a
+           * foreign projectId, a filter on an arbitrary attribute key used as
+           * a blind ILIKE oracle, a key smuggled in on the prototype
+           * (GHSA-w332-x78m-vf3v).
+           */
+          const allowedFilterAttributeKeys: Set<string> =
+            DashboardAPI.collectDashboardFilterAttributeKeys(
+              dashboard.dashboardViewConfig,
+            );
+
+          const sanitizedAttributes: Record<string, unknown> = {};
+          const requestedAttributes: unknown = requestedQuery["attributes"];
+
+          if (
+            requestedAttributes &&
+            typeof requestedAttributes === "object" &&
+            !Array.isArray(requestedAttributes)
+          ) {
+            for (const requestedAttributeKey of Object.keys(
+              requestedAttributes as Record<string, unknown>,
+            )) {
+              if (!allowedFilterAttributeKeys.has(requestedAttributeKey)) {
+                throw new BadDataException(
+                  "This attribute is not part of this dashboard.",
+                );
+              }
+
+              sanitizedAttributes[requestedAttributeKey] = (
+                requestedAttributes as Record<string, unknown>
+              )[requestedAttributeKey];
+            }
+          }
+
           aggregateBy.query = {
-            ...(aggregateBy.query || {}),
+            name: requestedMetricName,
+            ...(requestedQuery["time"] !== undefined
+              ? { time: requestedQuery["time"] }
+              : {}),
+            ...(Object.keys(sanitizedAttributes).length > 0
+              ? { attributes: sanitizedAttributes }
+              : {}),
             projectId: dashboard.projectId,
-          };
+          } as unknown as typeof aggregateBy.query;
 
           const aggregateResult: AggregatedResult =
             await MetricService.aggregateBy(aggregateBy);
@@ -1518,6 +1708,223 @@ export default class DashboardAPI extends BaseAPI<
     return metricNames;
   }
 
+  /*
+   * Walk a stored dashboard view config and collect every OpenTelemetry
+   * attribute key its variables bind to (a `Telemetry Attribute` variable
+   * carries the key its dropdown lists values for). Used as the allowlist
+   * for the public attribute-values endpoint, so an anonymous viewer can
+   * only read the values behind this dashboard's own variable pickers and
+   * not every attribute in the owning project.
+   */
+  private static collectDashboardVariableAttributeKeys(
+    dashboardViewConfig: unknown,
+  ): Set<string> {
+    const attributeKeys: Set<string> = new Set<string>();
+
+    const walk: (node: unknown) => void = (node: unknown): void => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+
+      if (Array.isArray(node)) {
+        for (const item of node) {
+          walk(item);
+        }
+        return;
+      }
+
+      const obj: Record<string, unknown> = node as Record<string, unknown>;
+
+      if (obj["type"] === DashboardVariableType.TelemetryAttribute) {
+        const attributeKey: unknown = obj["attributeKey"];
+
+        if (
+          typeof attributeKey === "string" &&
+          attributeKey.trim().length > 0
+        ) {
+          attributeKeys.add(attributeKey.trim());
+        }
+      }
+
+      for (const key of Object.keys(obj)) {
+        walk(obj[key]);
+      }
+    };
+
+    walk(dashboardViewConfig);
+
+    return attributeKeys;
+  }
+
+  /*
+   * Walk a stored dashboard view config and collect every OpenTelemetry
+   * attribute key its metric widgets group by — `groupByAttributeKeys`
+   * (chart / value / gauge / legacy table queries) and `groupByAttributes`
+   * (the table widget's richer per-key form). Used as the allowlist for the
+   * public metric-aggregate endpoint, whose grouped results echo each
+   * group's key values back to the caller.
+   */
+  private static collectDashboardGroupByAttributeKeys(
+    dashboardViewConfig: unknown,
+  ): Set<string> {
+    const attributeKeys: Set<string> = new Set<string>();
+
+    const addKey: (value: unknown) => void = (value: unknown): void => {
+      if (typeof value === "string" && value.length > 0) {
+        attributeKeys.add(value);
+      }
+    };
+
+    const walk: (node: unknown) => void = (node: unknown): void => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+
+      if (Array.isArray(node)) {
+        for (const item of node) {
+          walk(item);
+        }
+        return;
+      }
+
+      const obj: Record<string, unknown> = node as Record<string, unknown>;
+
+      const groupByAttributeKeys: unknown = obj["groupByAttributeKeys"];
+      if (Array.isArray(groupByAttributeKeys)) {
+        for (const key of groupByAttributeKeys) {
+          addKey(key);
+        }
+      }
+
+      const groupByAttributes: unknown = obj["groupByAttributes"];
+      if (Array.isArray(groupByAttributes)) {
+        for (const groupByAttribute of groupByAttributes) {
+          if (groupByAttribute && typeof groupByAttribute === "object") {
+            addKey((groupByAttribute as Record<string, unknown>)["key"]);
+          }
+        }
+      }
+
+      for (const key of Object.keys(obj)) {
+        walk(obj[key]);
+      }
+    };
+
+    walk(dashboardViewConfig);
+
+    return attributeKeys;
+  }
+
+  /*
+   * Attribute keys a public metric aggregation may FILTER on.
+   *
+   * Two sources, and both are needed:
+   *
+   * - Keys the widgets themselves persist — `filterData.attributes` on a
+   *   chart/value/gauge query, and the table widget's widget-level
+   *   `attributeFilters`.
+   * - Keys the dashboard's `Telemetry Attribute` variables bind to. The
+   *   shipped templates store `filterData: { metricName, aggegationType }`
+   *   and no attributes at all; the filter on e.g.
+   *   `resource.k8s.cluster.name` only appears once the viewer picks a value
+   *   and DashboardVariableInterpolation injects it at render time. An
+   *   allowlist built from stored filters alone would refuse every real
+   *   templated dashboard the moment its variable is used.
+   */
+  private static collectDashboardFilterAttributeKeys(
+    dashboardViewConfig: unknown,
+  ): Set<string> {
+    const attributeKeys: Set<string> =
+      DashboardAPI.collectDashboardVariableAttributeKeys(dashboardViewConfig);
+
+    const addKeysOf: (value: unknown) => void = (value: unknown): void => {
+      if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return;
+      }
+
+      for (const key of Object.keys(value as Record<string, unknown>)) {
+        if (key.length > 0) {
+          attributeKeys.add(key);
+        }
+      }
+    };
+
+    const walk: (node: unknown) => void = (node: unknown): void => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+
+      if (Array.isArray(node)) {
+        for (const item of node) {
+          walk(item);
+        }
+        return;
+      }
+
+      const obj: Record<string, unknown> = node as Record<string, unknown>;
+
+      const filterData: unknown = obj["filterData"];
+      if (filterData && typeof filterData === "object") {
+        addKeysOf((filterData as Record<string, unknown>)["attributes"]);
+      }
+
+      addKeysOf(obj["attributeFilters"]);
+
+      for (const key of Object.keys(obj)) {
+        walk(obj[key]);
+      }
+    };
+
+    walk(dashboardViewConfig);
+
+    return attributeKeys;
+  }
+
+  /*
+   * Walk a stored dashboard view config and collect every model column its
+   * widgets group by. Used as the allowlist for the public metric-aggregate
+   * endpoint: grouping echoes the grouped column back in every result row,
+   * so `groupBy: { attributes: true }` would hand an anonymous viewer the
+   * entire attribute map of an allowlisted metric.
+   */
+  private static collectDashboardGroupByColumns(
+    dashboardViewConfig: unknown,
+  ): Set<string> {
+    const groupByColumns: Set<string> = new Set<string>();
+
+    const walk: (node: unknown) => void = (node: unknown): void => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+
+      if (Array.isArray(node)) {
+        for (const item of node) {
+          walk(item);
+        }
+        return;
+      }
+
+      const obj: Record<string, unknown> = node as Record<string, unknown>;
+
+      const groupBy: unknown = obj["groupBy"];
+      if (groupBy && typeof groupBy === "object" && !Array.isArray(groupBy)) {
+        for (const column of Object.keys(groupBy as Record<string, unknown>)) {
+          if ((groupBy as Record<string, unknown>)[column]) {
+            groupByColumns.add(column);
+          }
+        }
+      }
+
+      for (const key of Object.keys(obj)) {
+        walk(obj[key]);
+      }
+    };
+
+    walk(dashboardViewConfig);
+
+    return groupByColumns;
+  }
+
   /*
    * Walk a stored dashboard view config and collect every widget type it
    * renders. Used to build an allowlist for the public resource-list