@oneuptime/common 12.0.3 → 12.0.5

package/Tests/Server/Utils/GitHubWebhookAndTreeCacheIsolation.test.ts

@@ -0,0 +1,250 @@
+import GitHubUtil from "../../../Server/Utils/CodeRepository/GitHub/GitHub";
+import API from "../../../Utils/API";
+import GlobalCache from "../../../Server/Infrastructure/GlobalCache";
+import HTTPResponse from "../../../Types/API/HTTPResponse";
+import { JSONObject } from "../../../Types/JSON";
+import * as crypto from "crypto";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Two hardening fixes found while remediating GHSA-xx95-gmcf-7q86. Neither is
+ * in the advisory; both sit on the same GitHub App code path.
+ *
+ * 1. verifyWebhookSignature used to return true when no webhook secret was
+ *    configured, leaving POST /api/github/webhook unauthenticated on those
+ *    instances — and its `installation.deleted` branch clears installation IDs
+ *    across every tenant.
+ *
+ * 2. getRepositoryTreePaths caches a repository's full private file listing
+ *    and reads that cache BEFORE minting a token, so the cache key is what
+ *    stands in for access control on a hit. Keyed on org/repo/branch alone, it
+ *    could serve one installation's file listing to another.
+ */
+
+const WEBHOOK_SECRET: string = "test-webhook-secret";
+
+function loadGitHubUtilWithWebhookSecret(
+  secret: string | null,
+): typeof GitHubUtil {
+  jest.resetModules();
+  jest.doMock("../../../Server/EnvironmentConfig", () => {
+    return {
+      ...(jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+        string,
+        unknown
+      >),
+      GitHubAppWebhookSecret: secret,
+    };
+  });
+
+  /*
+   * A re-require is the point here: GitHubAppWebhookSecret is read at module
+   * load, so the only way to exercise the unconfigured branch is to reload the
+   * module against a different mocked config.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+  return require("../../../Server/Utils/CodeRepository/GitHub/GitHub")
+    .default as typeof GitHubUtil;
+}
+
+function signPayload(payload: string, secret: string): string {
+  return `sha256=${crypto
+    .createHmac("sha256", secret)
+    .update(payload)
+    .digest("hex")}`;
+}
+
+describe("GitHub webhook signature verification", () => {
+  const payload: string = JSON.stringify({
+    action: "deleted",
+    installation: { id: 12345678 },
+  });
+
+  afterEach(() => {
+    jest.resetModules();
+    jest.restoreAllMocks();
+  });
+
+  test("accepts a correctly signed payload", () => {
+    const util: typeof GitHubUtil =
+      loadGitHubUtilWithWebhookSecret(WEBHOOK_SECRET);
+
+    expect(
+      util.verifyWebhookSignature(
+        payload,
+        signPayload(payload, WEBHOOK_SECRET),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects a payload signed with the wrong secret", () => {
+    const util: typeof GitHubUtil =
+      loadGitHubUtilWithWebhookSecret(WEBHOOK_SECRET);
+
+    expect(
+      util.verifyWebhookSignature(payload, signPayload(payload, "wrong")),
+    ).toBe(false);
+  });
+
+  test("rejects a tampered payload", () => {
+    const util: typeof GitHubUtil =
+      loadGitHubUtilWithWebhookSecret(WEBHOOK_SECRET);
+
+    const signature: string = signPayload(payload, WEBHOOK_SECRET);
+    const tampered: string = JSON.stringify({
+      action: "deleted",
+      installation: { id: 99999999 },
+    });
+
+    expect(util.verifyWebhookSignature(tampered, signature)).toBe(false);
+  });
+
+  test("rejects a garbage signature without throwing", () => {
+    const util: typeof GitHubUtil =
+      loadGitHubUtilWithWebhookSecret(WEBHOOK_SECRET);
+
+    expect(util.verifyWebhookSignature(payload, "not-a-signature")).toBe(false);
+  });
+
+  /*
+   * The fix. Previously this returned true — so on an instance with no secret
+   * configured, anyone who could reach the endpoint could send an
+   * `installation.deleted` for any installation id and have OneUptime clear
+   * that installation from every project that had it.
+   */
+  test("fails CLOSED when no webhook secret is configured", () => {
+    const util: typeof GitHubUtil = loadGitHubUtilWithWebhookSecret(null);
+
+    expect(
+      util.verifyWebhookSignature(
+        payload,
+        signPayload(payload, WEBHOOK_SECRET),
+      ),
+    ).toBe(false);
+  });
+
+  test("an unconfigured instance rejects even a well-formed signature", () => {
+    const util: typeof GitHubUtil = loadGitHubUtilWithWebhookSecret("");
+
+    expect(util.verifyWebhookSignature(payload, signPayload(payload, ""))).toBe(
+      false,
+    );
+  });
+});
+
+describe("Repository tree cache is scoped to the installation", () => {
+  const TREE_RESPONSE: JSONObject = {
+    tree: [
+      { path: "src/secret.ts", type: "blob" },
+      { path: "src", type: "tree" },
+    ],
+  };
+
+  let getCacheSpy: jest.SpyInstance;
+  let setCacheSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest
+      .spyOn(GitHubUtil, "getInstallationAccessToken")
+      .mockResolvedValue({ token: "ghs_token", expiresAt: new Date() });
+
+    jest
+      .spyOn(API, "get")
+      .mockResolvedValue(new HTTPResponse<JSONObject>(200, TREE_RESPONSE, {}));
+
+    getCacheSpy = jest.spyOn(GlobalCache, "getStringArray");
+    getCacheSpy.mockResolvedValue(null);
+
+    setCacheSpy = jest.spyOn(GlobalCache, "setStringArray");
+    setCacheSpy.mockResolvedValue(undefined);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function argsFor(installationId: string): {
+    installationId: string;
+    organizationName: string;
+    repositoryName: string;
+    branchName: string;
+  } {
+    return {
+      installationId: installationId,
+      organizationName: "victim-org",
+      repositoryName: "private-repo",
+      branchName: "main",
+    };
+  }
+
+  test("includes the installation id in the cache key", async () => {
+    await GitHubUtil.getRepositoryTreePaths(argsFor("11111111"));
+
+    const cacheKey: string = getCacheSpy.mock.calls[0]![1] as string;
+    expect(cacheKey).toContain("11111111");
+  });
+
+  /*
+   * The point of the fix: the same org/repo/branch reached through a different
+   * installation must not collide, because a hit is served without minting a
+   * token or calling GitHub at all.
+   */
+  test("two installations naming the same repository use different keys", async () => {
+    await GitHubUtil.getRepositoryTreePaths(argsFor("11111111"));
+    await GitHubUtil.getRepositoryTreePaths(argsFor("99999999"));
+
+    const firstKey: string = getCacheSpy.mock.calls[0]![1] as string;
+    const secondKey: string = getCacheSpy.mock.calls[1]![1] as string;
+
+    expect(firstKey).not.toBe(secondKey);
+  });
+
+  test("writes back under the same installation-scoped key it read", async () => {
+    await GitHubUtil.getRepositoryTreePaths(argsFor("11111111"));
+
+    const readKey: string = getCacheSpy.mock.calls[0]![1] as string;
+    const writeKey: string = setCacheSpy.mock.calls[0]![1] as string;
+
+    expect(writeKey).toBe(readKey);
+  });
+
+  test("still distinguishes repositories and branches within one installation", async () => {
+    await GitHubUtil.getRepositoryTreePaths({
+      installationId: "11111111",
+      organizationName: "org",
+      repositoryName: "repo-a",
+      branchName: "main",
+    });
+    await GitHubUtil.getRepositoryTreePaths({
+      installationId: "11111111",
+      organizationName: "org",
+      repositoryName: "repo-b",
+      branchName: "main",
+    });
+    await GitHubUtil.getRepositoryTreePaths({
+      installationId: "11111111",
+      organizationName: "org",
+      repositoryName: "repo-a",
+      branchName: "develop",
+    });
+
+    const keys: Array<string> = getCacheSpy.mock.calls.map(
+      (call: Array<unknown>) => {
+        return call[1] as string;
+      },
+    );
+
+    expect(new Set(keys).size).toBe(3);
+  });
+
+  test("serves a cache hit without minting a token", async () => {
+    getCacheSpy.mockResolvedValue(["src/cached.ts"]);
+
+    const paths: Array<string> = await GitHubUtil.getRepositoryTreePaths(
+      argsFor("11111111"),
+    );
+
+    expect(paths).toEqual(["src/cached.ts"]);
+    expect(GitHubUtil.getInstallationAccessToken).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/Monitor/Criteria/APIRequestCriteriaPortTimings.test.ts

@@ -0,0 +1,212 @@
+import APIRequestCriteria from "../../../../../Server/Utils/Monitor/Criteria/APIRequestCriteria";
+import EvaluateOverTime from "../../../../../Server/Utils/Monitor/Criteria/EvaluateOverTime";
+import {
+  CheckOn,
+  CriteriaFilter,
+  EvaluateOverTimeType,
+  FilterType,
+} from "../../../../../Types/Monitor/CriteriaFilter";
+import PortMonitorTimings from "../../../../../Types/Monitor/PortMonitor/PortMonitorTimings";
+import ProbeMonitorResponse from "../../../../../Types/Probe/ProbeMonitorResponse";
+import ObjectID from "../../../../../Types/ObjectID";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+function buildResponse(portTimings?: PortMonitorTimings): ProbeMonitorResponse {
+  return {
+    projectId: ObjectID.generate(),
+    monitorId: ObjectID.generate(),
+    monitorStepId: ObjectID.generate(),
+    probeId: ObjectID.generate(),
+    failureCause: "",
+    monitoredAt: new Date(),
+    portTimings: portTimings,
+  };
+}
+
+function criteria(input: {
+  checkOn: CheckOn.PortDnsLookupTime | CheckOn.PortTcpConnectTime;
+  filterType?: FilterType;
+  value: number | string;
+  evaluateOverTime?: boolean;
+}): CriteriaFilter {
+  return {
+    checkOn: input.checkOn,
+    filterType: input.filterType || FilterType.GreaterThan,
+    value: input.value,
+    evaluateOverTime: input.evaluateOverTime,
+    evaluateOverTimeOptions: input.evaluateOverTime
+      ? {
+          timeValueInMinutes: 5,
+          evaluateOverTimeType: EvaluateOverTimeType.Average,
+        }
+      : undefined,
+  };
+}
+
+async function evaluate(
+  response: ProbeMonitorResponse,
+  criteriaFilter: CriteriaFilter,
+): Promise<string | null> {
+  return APIRequestCriteria.isMonitorInstanceCriteriaFilterMet({
+    dataToProcess: response,
+    criteriaFilter: criteriaFilter,
+  });
+}
+
+describe("APIRequestCriteria Port connection phase timings", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("evaluates the current DNS lookup duration", async () => {
+    const result: string | null = await evaluate(
+      buildResponse({
+        dnsLookupInMs: 151,
+        tcpConnectInMs: 25,
+        totalConnectionInMs: 176,
+      }),
+      criteria({ checkOn: CheckOn.PortDnsLookupTime, value: "150" }),
+    );
+
+    expect(result).toContain(CheckOn.PortDnsLookupTime);
+  });
+
+  test("returns null when the current DNS lookup duration is below the threshold", async () => {
+    const result: string | null = await evaluate(
+      buildResponse({
+        dnsLookupInMs: 149,
+        tcpConnectInMs: 25,
+        totalConnectionInMs: 174,
+      }),
+      criteria({ checkOn: CheckOn.PortDnsLookupTime, value: 150 }),
+    );
+
+    expect(result).toBeNull();
+  });
+
+  test("evaluates the current TCP connect duration independently of DNS", async () => {
+    const result: string | null = await evaluate(
+      buildResponse({
+        dnsLookupInMs: 300,
+        tcpConnectInMs: 75,
+        totalConnectionInMs: 375,
+      }),
+      criteria({
+        checkOn: CheckOn.PortTcpConnectTime,
+        filterType: FilterType.GreaterThanOrEqualTo,
+        value: 75,
+      }),
+    );
+
+    expect(result).toContain(CheckOn.PortTcpConnectTime);
+  });
+
+  test("treats an absent DNS phase on an IP-literal destination as no data", async () => {
+    const result: string | null = await evaluate(
+      buildResponse({ tcpConnectInMs: 20, totalConnectionInMs: 20 }),
+      criteria({
+        checkOn: CheckOn.PortDnsLookupTime,
+        filterType: FilterType.LessThan,
+        value: 100,
+      }),
+    );
+
+    expect(result).toBeNull();
+  });
+
+  test("treats an absent TCP phase on a failed pre-connect check as no data", async () => {
+    const result: string | null = await evaluate(
+      buildResponse({ dnsLookupInMs: 100, totalConnectionInMs: 100 }),
+      criteria({ checkOn: CheckOn.PortTcpConnectTime, value: 10 }),
+    );
+
+    expect(result).toBeNull();
+  });
+
+  test("preserves a legitimate zero-millisecond phase", async () => {
+    const result: string | null = await evaluate(
+      buildResponse({
+        dnsLookupInMs: 0,
+        tcpConnectInMs: 0,
+        totalConnectionInMs: 0,
+      }),
+      criteria({
+        checkOn: CheckOn.PortDnsLookupTime,
+        filterType: FilterType.LessThan,
+        value: 1,
+      }),
+    );
+
+    expect(result).not.toBeNull();
+  });
+
+  test("uses an evaluate-over-time aggregate instead of the current phase", async () => {
+    const overTimeSpy: ReturnType<typeof jest.spyOn> = jest
+      .spyOn(EvaluateOverTime, "getValueOverTime")
+      .mockResolvedValue(250);
+
+    const response: ProbeMonitorResponse = buildResponse({
+      dnsLookupInMs: 5,
+      tcpConnectInMs: 10,
+      totalConnectionInMs: 15,
+    });
+    const result: string | null = await evaluate(
+      response,
+      criteria({
+        checkOn: CheckOn.PortDnsLookupTime,
+        value: 200,
+        evaluateOverTime: true,
+      }),
+    );
+
+    expect(result).not.toBeNull();
+    expect(overTimeSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        projectId: response.projectId,
+        monitorId: response.monitorId,
+        metricType: CheckOn.PortDnsLookupTime,
+      }),
+    );
+  });
+
+  test("does not replace a zero evaluate-over-time aggregate with the current value", async () => {
+    jest.spyOn(EvaluateOverTime, "getValueOverTime").mockResolvedValue(0);
+
+    const result: string | null = await evaluate(
+      buildResponse({
+        dnsLookupInMs: 500,
+        tcpConnectInMs: 10,
+        totalConnectionInMs: 510,
+      }),
+      criteria({
+        checkOn: CheckOn.PortDnsLookupTime,
+        filterType: FilterType.LessThan,
+        value: 1,
+        evaluateOverTime: true,
+      }),
+    );
+
+    expect(result).not.toBeNull();
+  });
+
+  test("falls back to the current phase if the history query fails", async () => {
+    jest
+      .spyOn(EvaluateOverTime, "getValueOverTime")
+      .mockRejectedValue(new Error("history unavailable"));
+
+    const result: string | null = await evaluate(
+      buildResponse({
+        dnsLookupInMs: 1,
+        tcpConnectInMs: 250,
+        totalConnectionInMs: 251,
+      }),
+      criteria({
+        checkOn: CheckOn.PortTcpConnectTime,
+        value: 200,
+        evaluateOverTime: true,
+      }),
+    );
+
+    expect(result).not.toBeNull();
+  });
+});