@oneuptime/common 12.0.30 → 12.0.32

package/build/dist/Utils/NetworkDiscovery/ReverseDnsNameUtil.js

@@ -0,0 +1,132 @@
+/*
+ * What a PTR record is allowed to become, shared by the probe that performs
+ * the lookup and by every reader of the name it stored (OneUptime issue
+ * #3529).
+ *
+ * A discovered host's `dnsHostname` is the ONLY field in a scan result whose
+ * value is chosen by the scanned network rather than by OneUptime or by the
+ * operator: it is whatever a PTR record on some resolver says, and a
+ * discovery scan is routinely pointed at a subnet nobody in the project
+ * administers. That value then becomes a NetworkDevice's name, its slug, and
+ * a line in the Review dialog — so it is normalised HERE, once, by a pure
+ * function both sides call, rather than trusted anywhere.
+ *
+ * Normalising on the probe alone would not be enough. `discoveredDevices` is
+ * jsonb written verbatim from the probe's payload (ProbeIngest/
+ * DiscoveryScan.ts), so the server's own copy of these rules is what holds
+ * for results stored by a probe running a different version, and for rows
+ * hand-written through the API. Normalising on the server alone would not be
+ * enough either: the probe should not spend a scan's storage on names it
+ * knows will be discarded. Both call this.
+ */
+/*
+ * A DNS name is at most 255 octets on the wire; the presentation form tops
+ * out at 253 characters once the length prefixes and root label are removed.
+ * NetworkDevice.name is varchar(100) and DiscoveredDeviceBuilder clamps to 80
+ * for the slug's sake, so this ceiling never decides a device name on its own
+ * — it is here to reject a value that was never a DNS name to begin with.
+ */
+export const MAX_REVERSE_DNS_NAME_LENGTH = 253;
+// RFC 1035 section 2.3.4: labels are 63 octets or fewer.
+export const MAX_REVERSE_DNS_LABEL_LENGTH = 63;
+/*
+ * One label: letters, digits, hyphen — plus underscore, which is not legal in
+ * a hostname but IS common in the wild (Windows/DHCP-registered names, and
+ * plenty of hand-authored reverse zones), and rejecting it would throw away
+ * real names for a standards point nothing here depends on. A hyphen may not
+ * lead or trail.
+ *
+ * Everything else is refused, and the refusals are the point: a name is
+ * rendered in the dashboard, slugified into a URL, and written to a varchar.
+ * Whitespace, quotes, angle brackets, slashes, control characters and
+ * non-ASCII all mean the answer was not a hostname, and a scan of an
+ * untrusted subnet is exactly where that shows up.
+ */
+const LABEL_PATTERN = /^[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?$/;
+/*
+ * The reverse-lookup zones themselves. A resolver that echoes the query name
+ * back — some do, on certain failure modes — hands us
+ * "51.166.18.10.in-addr.arpa", which passes every other rule here and is a
+ * strictly worse device name than the address it was derived from.
+ */
+const REVERSE_LOOKUP_ZONES = ["in-addr.arpa", "ip6.arpa"];
+/*
+ * True when every label is digits — "10.18.166.51", but also "51" and "1.2".
+ *
+ * This is what keeps a PTR that merely restates the address out of the name
+ * field. It matters more than it looks: the whole point of the feature is
+ * that a name is more useful than an address, so a "name" that IS the address
+ * must fall through to the address rather than be presented as a resolved
+ * hostname the operator can trust. Checked as "all labels numeric" rather
+ * than as a dotted-quad regex so "51" and "10.18" are caught too.
+ */
+const NUMERIC_LABEL_PATTERN = /^[0-9]+$/;
+function isAllNumericLabels(labels) {
+    return labels.every((label) => {
+        return NUMERIC_LABEL_PATTERN.test(label);
+    });
+}
+/**
+ * The hostname a PTR answer may be stored and displayed as, or undefined when
+ * the answer is not usable as one.
+ *
+ * Accepts `unknown` rather than `string` on purpose: on the server side the
+ * input is a value read out of a jsonb column, and "the probe sent a number"
+ * is a case that has to return undefined rather than throw inside a render.
+ *
+ * Case is PRESERVED. It is whatever the reverse zone was authored with, which
+ * is as close to the operator's intent as this data gets, and DNS's own
+ * case-insensitivity is not a reason to discard it.
+ */
+export function normalizeReverseDnsName(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    /*
+     * Exactly ONE trailing dot is dropped — the root label of a fully qualified
+     * name, which some resolvers include and some do not. A second one leaves
+     * an empty final label, which the per-label check below refuses; that is
+     * deliberate, because "foo.." is malformed rather than "foo." with a typo,
+     * and silently repairing it would be inventing a name.
+     */
+    const withoutRootLabel = trimmed.endsWith(".")
+        ? trimmed.substring(0, trimmed.length - 1)
+        : trimmed;
+    if (!withoutRootLabel) {
+        return undefined;
+    }
+    if (withoutRootLabel.length > MAX_REVERSE_DNS_NAME_LENGTH) {
+        return undefined;
+    }
+    const lowerCased = withoutRootLabel.toLowerCase();
+    for (const zone of REVERSE_LOOKUP_ZONES) {
+        /*
+         * The apex is checked as well as the suffix. `in-addr.arpa` on its own is
+         * a legal hostname string that passes every other rule here, and it is
+         * what a resolver echoing a truncated query name hands back — a strictly
+         * worse label for a device than the address it was derived from.
+         */
+        if (lowerCased === zone || lowerCased.endsWith(`.${zone}`)) {
+            return undefined;
+        }
+    }
+    const labels = withoutRootLabel.split(".");
+    for (const label of labels) {
+        if (!label || label.length > MAX_REVERSE_DNS_LABEL_LENGTH) {
+            return undefined;
+        }
+        if (!LABEL_PATTERN.test(label)) {
+            return undefined;
+        }
+    }
+    if (isAllNumericLabels(labels)) {
+        return undefined;
+    }
+    return withoutRootLabel;
+}
+export default normalizeReverseDnsName;
+//# sourceMappingURL=ReverseDnsNameUtil.js.map

package/build/dist/Utils/NetworkDiscovery/ReverseDnsNameUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReverseDnsNameUtil.js","sourceRoot":"","sources":["../../../../Utils/NetworkDiscovery/ReverseDnsNameUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAW,GAAG,CAAC;AAEvD,yDAAyD;AACzD,MAAM,CAAC,MAAM,4BAA4B,GAAW,EAAE,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAAW,+CAA+C,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,oBAAoB,GAAkB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;AAEzE;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAW,UAAU,CAAC;AAEjD,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;QACpC,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,gBAAgB,GAAW,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpD,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC;IAEZ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAW,gBAAgB,CAAC,WAAW,EAAE,CAAC;IAE1D,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC;;;;;WAKG;QACH,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAkB,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,eAAe,uBAAuB,CAAC"}

package/build/dist/Utils/Rules/RuleEngineLimits.js

@@ -0,0 +1,31 @@
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+/*
+ * How many of a project's automation rules one engine run reads.
+ *
+ * Every rule engine — label, owner, on-call, privacy, auto-remediation,
+ * runbook — answers the same question when a resource is created: "which of
+ * this project's enabled rules match it?". That read used to be written as
+ * `limit: 100, skip: 0`, which is not a page of a paged walk but the whole
+ * evaluation: rule 101 and beyond were fetched by nobody and therefore
+ * matched nothing, forever.
+ *
+ * Nothing surfaced it. The engines have no queue, no cursor and no counter;
+ * they run inline in the resource's onCreateSuccess and log only what they
+ * attached. A project with 1,243 monitor label rules imported 1,000+ monitors
+ * and watched ~50-100 of them get labelled while the rest stayed bare, which
+ * reads exactly like a backlog draining slowly and is in fact 92% of the
+ * rules never being consulted at all (OneUptime/oneuptime#3506).
+ *
+ * The default sort on these reads is createdAt DESC, so the 100 that DID run
+ * were the newest — which is why a rule written early, against a naming
+ * convention the estate was later built on, is precisely the kind of rule
+ * that went quiet.
+ *
+ * LIMIT_PER_PROJECT is the codebase's existing bound for "every row of this
+ * kind in one project". Rules are hand-authored configuration, so this is a
+ * ceiling rather than a page size: a project would need 10,000 enabled rules
+ * of a single kind to reach it.
+ */
+export const MAX_RULES_EVALUATED_PER_PROJECT = LIMIT_PER_PROJECT;
+export default MAX_RULES_EVALUATED_PER_PROJECT;
+//# sourceMappingURL=RuleEngineLimits.js.map

package/build/dist/Utils/Rules/RuleEngineLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuleEngineLimits.js","sourceRoot":"","sources":["../../../../Utils/Rules/RuleEngineLimits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAW,iBAAiB,CAAC;AAEzE,eAAe,+BAA+B,CAAC"}

package/build/dist/Utils/Rules/RulePatternMatchUtil.js

@@ -4,7 +4,7 @@
  *
  * These fields are documented as case-insensitive regular expressions, but
  * the sibling Network Site assignment rules take '*' wildcard globs and the
- * two features sit next to each other under Network > Automation. A user who
+ * two features sit next to each other under Network > Rules. A user who
  * typed `*0664*` into a label rule got silence: `new RegExp("*0664*")` throws
  * "Nothing to repeat", the rule engine swallowed the SyntaxError, and the
  * rule matched nothing forever (OneUptime/oneuptime#2940).

package/build/dist/Utils/Slug.js

@@ -1,7 +1,28 @@
 import Faker from "./Faker";
 import slugify from "slugify";
+/*
+ * The tail every slug carries: a dash plus ten random digits.
+ *
+ * It is what keeps two objects of the same name apart, so it is the half that
+ * survives when a slug has to be cut down to fit its column.
+ */
+export const SLUG_SUFFIX_LENGTH = 11;
 export default class Slug {
-    static getSlug(name) {
+    /*
+     * `maxLength`, when given, is the width of the column the slug is about to
+     * be written to.
+     *
+     * It exists because the create path THROWS on an oversized value rather
+     * than truncating it (DatabaseService.checkMaxLengthOfFields), and a slug
+     * source is routinely wider than the slug column: Incident.title is
+     * varchar(500) against a varchar(100) slug. Without a ceiling, slugifying
+     * such a column turns a long title into a failed insert.
+     *
+     * Only the readable half is trimmed; the random tail is never touched. A
+     * `maxLength` narrower than SLUG_SUFFIX_LENGTH therefore cannot be honoured
+     * -- the tail wins -- but no column is anywhere near that narrow.
+     */
+    static getSlug(name, maxLength) {
         if (name === null) {
             name = Faker.generateName();
         }
@@ -10,6 +31,15 @@ export default class Slug {
             return "";
         }
         let slug = slugify(name, { remove: /[&*+~.,\\/()|'"!:@]+/g });
+        if (maxLength !== undefined) {
+            /*
+             * Cut to what the tail leaves, then drop any dash the cut left
+             * dangling so the result does not read as `something--0123456789`.
+             */
+            slug = slug
+                .substring(0, Math.max(0, maxLength - SLUG_SUFFIX_LENGTH))
+                .replace(/-+$/, "");
+        }
         slug = `${slug}-${Faker.getRandomNumbers(10).toString()}`;
         slug = slug.toLowerCase();
         return slug;

package/build/dist/Utils/Slug.js.map

@@ -1 +1 @@
-{"version":3,"file":"Slug.js","sourceRoot":"","sources":["../../../Utils/Slug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,CAAC,OAAO,OAAO,IAAI;IAChB,MAAM,CAAC,OAAO,CAAC,IAAmB;QACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,IAAI,GAAW,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACtE,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC1D,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1B,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"Slug.js","sourceRoot":"","sources":["../../../Utils/Slug.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW,EAAE,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,IAAI;IACvB;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,OAAO,CAAC,IAAmB,EAAE,SAAkB;QAC3D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,IAAI,GAAW,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAEtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B;;;eAGG;YACH,IAAI,GAAG,IAAI;iBACR,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAC;iBACzD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC1D,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1B,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/jest.config.json

@@ -48,6 +48,7 @@
   "testEnvironment": "<rootDir>/Tests/Utils/TimezoneEnvironment.js",
   "setupFilesAfterEnv": ["<rootDir>/Tests/jest.setup.ts"],
   "collectCoverage": false,
+  "testTimeout": 60000,
   "coverageReporters": ["text", "lcov"],
   "testRegex": "./Tests/(.*)\\.test\\.(ts|tsx)$",
   "collectCoverageFrom": ["./**/*.{ts,tsx}"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneuptime/common",
-  "version": "12.0.30",
+  "version": "12.0.32",
   "description": "",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "main": "index.js",
   "scripts": {
-    "test": "cd .. && export $(grep -v '^#' config.env | xargs) && cd Common && node --max-old-space-size=6144 node_modules/.bin/jest --runInBand ./Tests --detectOpenHandles --forceExit",
+    "test": "cd .. && export $(grep -v '^#' config.env | xargs) && cd Common && node --max-old-space-size=4096 node_modules/.bin/jest ./Tests --forceExit --maxWorkers=2",
     "test-file": "cd .. && export $(grep -v '^#' config.env | xargs) && cd Common && node node_modules/.bin/jest --runInBand $1 --detectOpenHandles",
     "coverage": "jest --detectOpenHandles --coverage",
     "compile": "tsc",