@oneuptime/common 12.0.3 → 12.0.4

package/Tests/Server/Utils/CodeRepository/GitHubInstallationBinding.test.ts

@@ -0,0 +1,292 @@
+import GitHubInstallationBinding from "../../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import ProjectService from "../../../../Server/Services/ProjectService";
+import Project from "../../../../Models/DatabaseModels/Project";
+import CodeRepository from "../../../../Models/DatabaseModels/CodeRepository";
+import ObjectID from "../../../../Types/ObjectID";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { getColumnAccessControl } from "../../../../Types/Database/AccessControl/ColumnAccessControl";
+import { ColumnAccessControl } from "../../../../Types/BaseDatabase/AccessControl";
+import Permission from "../../../../Types/Permission";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * GHSA-xx95-gmcf-7q86. A GitHub App installation ID is a small integer, and
+ * the single GitHub App JWT this instance holds mints a write-scoped `ghs_`
+ * token for whichever installation it is handed. So "which project owns this
+ * installation?" has to be answered from a record only the verified install
+ * callback can write — never from the request, and never from a row the
+ * caller was able to create in a project they happen to own.
+ */
+
+describe("GitHubInstallationBinding", () => {
+  let projectId: ObjectID;
+  let findOneBySpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    projectId = ObjectID.generate();
+    findOneBySpy = jest.spyOn(ProjectService, "findOneBy");
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function mockBoundProject(project: Project | null): void {
+    findOneBySpy.mockResolvedValue(project);
+  }
+
+  function boundProject(): Project {
+    const project: Project = new Project();
+    project.id = projectId;
+    return project;
+  }
+
+  describe("isInstallationBoundToProject", () => {
+    test("returns true when the project owns the installation", async () => {
+      mockBoundProject(boundProject());
+
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "12345678",
+        }),
+      ).resolves.toBe(true);
+    });
+
+    test("returns false when no project row matches project + installation", async () => {
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "99999999",
+        }),
+      ).resolves.toBe(false);
+    });
+
+    /*
+     * The whole point: the query must be AND-ed on both the project and the
+     * installation. Matching on the project alone would return true for any
+     * installation ID the caller invented.
+     */
+    test("queries on BOTH the project id and the installation id", async () => {
+      mockBoundProject(boundProject());
+
+      await GitHubInstallationBinding.isInstallationBoundToProject({
+        projectId: projectId,
+        installationId: "12345678",
+      });
+
+      expect(findOneBySpy).toHaveBeenCalledTimes(1);
+
+      const findArgs: {
+        query: { _id?: string; gitHubAppInstallationId?: string };
+        props: { isRoot?: boolean };
+      } = findOneBySpy.mock.calls[0]![0] as {
+        query: { _id?: string; gitHubAppInstallationId?: string };
+        props: { isRoot?: boolean };
+      };
+
+      expect(findArgs.query._id).toBe(projectId.toString());
+      expect(findArgs.query.gitHubAppInstallationId).toBe("12345678");
+      expect(findArgs.props.isRoot).toBe(true);
+    });
+
+    /*
+     * An empty installation ID must never be treated as "bound" — otherwise a
+     * project with no GitHub connection at all would match every repository
+     * row whose installation ID had been cleared.
+     */
+    test("returns false for an empty installation id without querying", async () => {
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "",
+        }),
+      ).resolves.toBe(false);
+
+      expect(findOneBySpy).not.toHaveBeenCalled();
+    });
+
+    test("does not treat a different project's installation as bound", async () => {
+      // The service query is what enforces this; simulate the DB finding nothing.
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.isInstallationBoundToProject({
+          projectId: ObjectID.generate(),
+          installationId: "12345678",
+        }),
+      ).resolves.toBe(false);
+    });
+  });
+
+  /*
+   * The bulk-filter path. Callers listing a whole project's repositories read
+   * the binding once and compare in memory — every row in such a list is in
+   * the same project, so a per-row query would ask the same question N times.
+   */
+  describe("getBoundInstallationId", () => {
+    test("returns the installation the project owns", async () => {
+      const project: Project = boundProject();
+      project.gitHubAppInstallationId = "12345678";
+      mockBoundProject(project);
+
+      await expect(
+        GitHubInstallationBinding.getBoundInstallationId(projectId),
+      ).resolves.toBe("12345678");
+    });
+
+    /*
+     * Null, never "" or undefined: callers compare a row's installation ID
+     * against this, and an empty string would match a row whose ID had been
+     * cleared.
+     */
+    test("returns null for a project with no GitHub connection", async () => {
+      mockBoundProject(boundProject());
+
+      await expect(
+        GitHubInstallationBinding.getBoundInstallationId(projectId),
+      ).resolves.toBeNull();
+    });
+
+    test("returns null when the project does not exist", async () => {
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.getBoundInstallationId(projectId),
+      ).resolves.toBeNull();
+    });
+
+    test("reads as root, so a caller's permissions cannot blind the check", async () => {
+      mockBoundProject(boundProject());
+
+      await GitHubInstallationBinding.getBoundInstallationId(projectId);
+
+      const findArgs: {
+        query: { _id?: string };
+        props: { isRoot?: boolean };
+      } = findOneBySpy.mock.calls[0]![0] as {
+        query: { _id?: string };
+        props: { isRoot?: boolean };
+      };
+
+      expect(findArgs.query._id).toBe(projectId.toString());
+      expect(findArgs.props.isRoot).toBe(true);
+    });
+  });
+
+  describe("assertInstallationBoundToProject", () => {
+    test("resolves quietly when the binding exists", async () => {
+      mockBoundProject(boundProject());
+
+      await expect(
+        GitHubInstallationBinding.assertInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "12345678",
+        }),
+      ).resolves.toBeUndefined();
+    });
+
+    test("throws BadDataException when the binding is missing", async () => {
+      mockBoundProject(null);
+
+      await expect(
+        GitHubInstallationBinding.assertInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "99999999",
+        }),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    /*
+     * The error must not confirm that the installation exists elsewhere, or
+     * the failure message becomes the enumeration oracle the fix removed.
+     */
+    test("does not leak the installation id or another tenant's existence", async () => {
+      mockBoundProject(null);
+
+      let thrown: Error | null = null;
+
+      try {
+        await GitHubInstallationBinding.assertInstallationBoundToProject({
+          projectId: projectId,
+          installationId: "99999999",
+        });
+      } catch (err) {
+        thrown = err as Error;
+      }
+
+      expect(thrown).toBeInstanceOf(BadDataException);
+      expect(thrown!.message).not.toContain("99999999");
+      expect(thrown!.message.toLowerCase()).not.toContain("another");
+    });
+  });
+});
+
+/*
+ * The binding is only trustworthy if nothing outside the verified install
+ * callback can write it. These assertions pin the column ACLs that make that
+ * true — a future permission tidy-up that re-opens either column silently
+ * reopens the vulnerability, so it should fail here first.
+ */
+describe("Installation-id columns are not client-writable", () => {
+  test("CodeRepository.gitHubAppInstallationId cannot be created or updated by any API caller", () => {
+    const accessControl: ColumnAccessControl = getColumnAccessControl(
+      new CodeRepository(),
+      "gitHubAppInstallationId",
+    );
+
+    expect(accessControl.create).toEqual([]);
+    expect(accessControl.update).toEqual([]);
+  });
+
+  test("Project.gitHubAppInstallationId cannot be created or updated by any API caller", () => {
+    const accessControl: ColumnAccessControl = getColumnAccessControl(
+      new Project(),
+      "gitHubAppInstallationId",
+    );
+
+    expect(accessControl.create).toEqual([]);
+    expect(accessControl.update).toEqual([]);
+  });
+
+  /*
+   * Specifically the permissions an attacker gets for free by creating their
+   * own project. Being able to write either column from one of these is the
+   * whole exploit.
+   */
+  test.each([
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.CreateCodeRepository,
+    Permission.EditCodeRepository,
+    Permission.EditProject,
+  ])(
+    "%s cannot write either installation-id column",
+    (permission: Permission) => {
+      const repositoryAccessControl: ColumnAccessControl =
+        getColumnAccessControl(new CodeRepository(), "gitHubAppInstallationId");
+      const projectAccessControl: ColumnAccessControl = getColumnAccessControl(
+        new Project(),
+        "gitHubAppInstallationId",
+      );
+
+      expect(repositoryAccessControl.create).not.toContain(permission);
+      expect(repositoryAccessControl.update).not.toContain(permission);
+      expect(projectAccessControl.create).not.toContain(permission);
+      expect(projectAccessControl.update).not.toContain(permission);
+    },
+  );
+
+  // Reading it stays available — the dashboard shows connection status from it.
+  test("the column remains readable so the dashboard can show connection status", () => {
+    const accessControl: ColumnAccessControl = getColumnAccessControl(
+      new CodeRepository(),
+      "gitHubAppInstallationId",
+    );
+
+    expect(accessControl.read.length).toBeGreaterThan(0);
+  });
+});

package/Tests/Server/Utils/GitHubInstallationOwnershipVerification.test.ts

@@ -0,0 +1,340 @@
+import GitHubUtil from "../../../Server/Utils/CodeRepository/GitHub/GitHub";
+import API from "../../../Utils/API";
+import HTTPResponse from "../../../Types/API/HTTPResponse";
+import HTTPErrorResponse from "../../../Types/API/HTTPErrorResponse";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import URL from "../../../Types/API/URL";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * GHSA-xx95-gmcf-7q86 — proving the installer owns the installation.
+ *
+ * `installation_id` arrives on the install redirect as a bare integer in a
+ * query string. Anyone can type any value there, so on its own it proves
+ * nothing about who owns the installation — and OneUptime writes that value
+ * into Project.gitHubAppInstallationId, which every token-minting path then
+ * treats as authoritative.
+ *
+ * The OAuth `code` is what closes the gap: GitHub mints it for one specific
+ * GitHub account and it is single-use, so trading it in reveals which
+ * installations that account can actually administer.
+ */
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    ...(jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >),
+    GitHubAppClientId: "test-client-id",
+    GitHubAppClientSecret: "test-client-secret",
+  };
+});
+
+function okResponse(data: JSONObject): HTTPResponse<JSONObject> {
+  return new HTTPResponse<JSONObject>(200, data, {});
+}
+
+function errorResponse(statusCode: number): HTTPErrorResponse {
+  return new HTTPErrorResponse(statusCode, {}, {});
+}
+
+function installationsPage(ids: Array<number>): JSONObject {
+  return {
+    installations: ids.map((id: number) => {
+      return { id: id };
+    }),
+  };
+}
+
+describe("GitHub installation ownership verification", () => {
+  let postSpy: jest.SpyInstance;
+  let getSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    postSpy = jest.spyOn(API, "post");
+    getSpy = jest.spyOn(API, "get");
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("exchangeOAuthCodeForUserAccessToken", () => {
+    test("returns the user access token GitHub issues for the code", async () => {
+      postSpy.mockResolvedValue(okResponse({ access_token: "gho_user_token" }));
+
+      await expect(
+        GitHubUtil.exchangeOAuthCodeForUserAccessToken("the-code"),
+      ).resolves.toBe("gho_user_token");
+    });
+
+    test("sends the app credentials and the code to GitHub's token endpoint", async () => {
+      postSpy.mockResolvedValue(okResponse({ access_token: "gho_user_token" }));
+
+      await GitHubUtil.exchangeOAuthCodeForUserAccessToken("the-code");
+
+      const callArgs: {
+        url: URL;
+        data: JSONObject;
+      } = postSpy.mock.calls[0]![0] as { url: URL; data: JSONObject };
+
+      expect(callArgs.url.toString()).toContain(
+        "github.com/login/oauth/access_token",
+      );
+      expect(callArgs.data["client_id"]).toBe("test-client-id");
+      expect(callArgs.data["client_secret"]).toBe("test-client-secret");
+      expect(callArgs.data["code"]).toBe("the-code");
+    });
+
+    /*
+     * GitHub answers a bad, expired or already-redeemed code with HTTP 200 and
+     * an `error` body rather than a 4xx. Treating "not an HTTP error" as
+     * success would accept a replayed or invented code and let the caller skip
+     * verification entirely.
+     */
+    test("rejects a 200 response that carries no access token", async () => {
+      postSpy.mockResolvedValue(
+        okResponse({
+          error: "bad_verification_code",
+          error_description: "The code passed is incorrect or expired.",
+        }),
+      );
+
+      await expect(
+        GitHubUtil.exchangeOAuthCodeForUserAccessToken("replayed-code"),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    test("rejects when GitHub returns an HTTP error", async () => {
+      postSpy.mockResolvedValue(errorResponse(401));
+
+      await expect(
+        GitHubUtil.exchangeOAuthCodeForUserAccessToken("the-code"),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+  });
+
+  describe("listInstallationIdsForUserAccessToken", () => {
+    test("returns the installation ids the user can administer", async () => {
+      getSpy.mockResolvedValue(okResponse(installationsPage([111, 222])));
+
+      await expect(
+        GitHubUtil.listInstallationIdsForUserAccessToken("gho_user_token"),
+      ).resolves.toEqual(["111", "222"]);
+    });
+
+    test("asks GitHub as the user, not as the app", async () => {
+      getSpy.mockResolvedValue(okResponse(installationsPage([111])));
+
+      await GitHubUtil.listInstallationIdsForUserAccessToken("gho_user_token");
+
+      const callArgs: {
+        url: URL;
+        headers: { Authorization?: string };
+      } = getSpy.mock.calls[0]![0] as {
+        url: URL;
+        headers: { Authorization?: string };
+      };
+
+      expect(callArgs.url.toString()).toContain(
+        "api.github.com/user/installations",
+      );
+      expect(callArgs.headers.Authorization).toBe("Bearer gho_user_token");
+    });
+
+    /*
+     * A user with more than a page of installations must not silently lose the
+     * one they are installing — that would fail a legitimate install.
+     */
+    test("pages through every installation", async () => {
+      const firstPage: Array<number> = Array.from(
+        { length: 100 },
+        (_unused: unknown, index: number) => {
+          return index + 1;
+        },
+      );
+
+      getSpy
+        .mockResolvedValueOnce(okResponse(installationsPage(firstPage)))
+        .mockResolvedValueOnce(okResponse(installationsPage([999])));
+
+      const ids: Array<string> =
+        await GitHubUtil.listInstallationIdsForUserAccessToken("gho_token");
+
+      expect(getSpy).toHaveBeenCalledTimes(2);
+      expect(ids).toHaveLength(101);
+      expect(ids).toContain("999");
+    });
+
+    test("returns an empty list when the user administers nothing", async () => {
+      getSpy.mockResolvedValue(okResponse({ installations: [] }));
+
+      await expect(
+        GitHubUtil.listInstallationIdsForUserAccessToken("gho_token"),
+      ).resolves.toEqual([]);
+    });
+
+    test("rejects when GitHub returns an HTTP error", async () => {
+      getSpy.mockResolvedValue(errorResponse(401));
+
+      await expect(
+        GitHubUtil.listInstallationIdsForUserAccessToken("gho_token"),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+  });
+
+  describe("assertUserControlsInstallation", () => {
+    beforeEach(() => {
+      postSpy.mockResolvedValue(okResponse({ access_token: "gho_user_token" }));
+    });
+
+    test("resolves when the installation is one the user administers", async () => {
+      getSpy.mockResolvedValue(okResponse(installationsPage([111, 222])));
+
+      await expect(
+        GitHubUtil.assertUserControlsInstallation({
+          oauthCode: "the-code",
+          installationId: "222",
+        }),
+      ).resolves.toBeUndefined();
+    });
+
+    /*
+     * The exact attack: a valid code for the attacker's own GitHub account,
+     * paired with a victim's installation ID typed into the redirect URL.
+     */
+    test("rejects an installation the authorizing account does not administer", async () => {
+      getSpy.mockResolvedValue(okResponse(installationsPage([111])));
+
+      await expect(
+        GitHubUtil.assertUserControlsInstallation({
+          oauthCode: "attackers-own-valid-code",
+          installationId: "99999999",
+        }),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    test("rejects when the user administers no installations at all", async () => {
+      getSpy.mockResolvedValue(okResponse({ installations: [] }));
+
+      await expect(
+        GitHubUtil.assertUserControlsInstallation({
+          oauthCode: "the-code",
+          installationId: "111",
+        }),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    /*
+     * Fail closed: a verification step that can be skipped by breaking the
+     * call it depends on is not a verification step.
+     */
+    test("rejects rather than passing when the code exchange fails", async () => {
+      postSpy.mockResolvedValue(okResponse({ error: "bad_verification_code" }));
+
+      await expect(
+        GitHubUtil.assertUserControlsInstallation({
+          oauthCode: "bad-code",
+          installationId: "111",
+        }),
+      ).rejects.toBeInstanceOf(BadDataException);
+
+      expect(getSpy).not.toHaveBeenCalled();
+    });
+
+    test("rejects rather than passing when the installation list cannot be read", async () => {
+      getSpy.mockResolvedValue(errorResponse(500));
+
+      await expect(
+        GitHubUtil.assertUserControlsInstallation({
+          oauthCode: "the-code",
+          installationId: "111",
+        }),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+
+    // Ids cross the boundary as strings on one side and numbers on the other.
+    test("matches ids regardless of string/number representation", async () => {
+      getSpy.mockResolvedValue(okResponse(installationsPage([12345678])));
+
+      await expect(
+        GitHubUtil.assertUserControlsInstallation({
+          oauthCode: "the-code",
+          installationId: "12345678",
+        }),
+      ).resolves.toBeUndefined();
+    });
+
+    /*
+     * A prefix or substring match would let "1111" pass for installation
+     * "11110". Membership must be exact.
+     */
+    test("does not accept an installation id that merely looks similar", async () => {
+      getSpy.mockResolvedValue(okResponse(installationsPage([11110])));
+
+      await expect(
+        GitHubUtil.assertUserControlsInstallation({
+          oauthCode: "the-code",
+          installationId: "1111",
+        }),
+      ).rejects.toBeInstanceOf(BadDataException);
+    });
+  });
+});
+
+describe("GitHub OAuth verification when the app is not configured", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+    jest.resetModules();
+  });
+
+  /*
+   * An instance without OAuth credentials must refuse to bind rather than
+   * quietly skipping verification — a soft fallback here would reopen the
+   * vulnerability for every self-hosted install that never set the vars.
+   */
+  test("refuses to exchange a code without client credentials", async () => {
+    jest.resetModules();
+    jest.doMock("../../../Server/EnvironmentConfig", () => {
+      return {
+        ...(jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+          string,
+          unknown
+        >),
+        GitHubAppClientId: null,
+        GitHubAppClientSecret: null,
+      };
+    });
+
+    /*
+     * A re-require is the point here: the client credentials are read at
+     * module load, so the unconfigured branch can only be reached by reloading
+     * the module against a different mocked config.
+     */
+    const UnconfiguredGitHubUtil: typeof GitHubUtil =
+      // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+      require("../../../Server/Utils/CodeRepository/GitHub/GitHub").default;
+
+    const postSpy: jest.SpyInstance = jest.spyOn(API, "post");
+
+    let thrown: Error | null = null;
+
+    try {
+      await UnconfiguredGitHubUtil.exchangeOAuthCodeForUserAccessToken(
+        "the-code",
+      );
+    } catch (err) {
+      thrown = err as Error;
+    }
+
+    /*
+     * jest.resetModules() reloads the exception class too, so `instanceof`
+     * would compare two distinct copies of it — assert the contract instead.
+     */
+    expect(thrown).not.toBeNull();
+    expect(thrown!.message).toContain("GITHUB_APP_CLIENT_ID");
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+});