@oneuptime/common 12.0.4 → 12.0.6

package/Server/Utils/Monitor/Criteria/DomainMonitorCriteria.ts

@@ -8,6 +8,8 @@ import {
 import DomainMonitorResponse from "../../../../Types/Monitor/DomainMonitor/DomainMonitorResponse";
 import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
+import EvaluateOverTime from "./EvaluateOverTime";
+import logger from "../../Logger";
 
 export default class DomainMonitorCriteria {
   @CaptureSpan()
@@ -24,6 +26,60 @@ export default class DomainMonitorCriteria {
     const domainResponse: DomainMonitorResponse | undefined =
       dataToProcess.domainResponse;
 
+    let overTimeValue: Array<number | boolean> | number | boolean | undefined =
+      undefined;
+
+    if (
+      input.criteriaFilter.evaluateOverTime &&
+      input.criteriaFilter.evaluateOverTimeOptions
+    ) {
+      try {
+        overTimeValue = await EvaluateOverTime.getValueOverTime({
+          projectId: dataToProcess.projectId,
+          monitorId: input.dataToProcess.monitorId!,
+          evaluateOverTimeOptions: input.criteriaFilter.evaluateOverTimeOptions,
+          metricType: input.criteriaFilter.checkOn,
+        });
+
+        if (Array.isArray(overTimeValue) && overTimeValue.length === 0) {
+          overTimeValue = undefined;
+        }
+      } catch (err) {
+        logger.error(
+          `Error in getting over time value for ${input.criteriaFilter.checkOn}`,
+        );
+        logger.error(err);
+        overTimeValue = undefined;
+      }
+    }
+
+    /*
+     * Whether the registration lookup itself succeeded. Without this, a
+     * domain whose TLD has no working WHOIS or RDAP service produces a
+     * response with no expiry date, every Domain* filter below returns null,
+     * and the monitor silently keeps its previous status - which is what
+     * made an unsupported TLD look healthy.
+     */
+    if (input.criteriaFilter.checkOn === CheckOn.IsOnline) {
+      const currentIsOnline: boolean | Array<boolean> =
+        (overTimeValue as Array<boolean>) || dataToProcess.isOnline;
+
+      return CompareCriteria.compareCriteriaBoolean({
+        value: currentIsOnline,
+        criteriaFilter: input.criteriaFilter,
+      });
+    }
+
+    if (input.criteriaFilter.checkOn === CheckOn.IsRequestTimeout) {
+      const currentIsTimeout: boolean | Array<boolean> =
+        (overTimeValue as Array<boolean>) || dataToProcess.isTimeout;
+
+      return CompareCriteria.compareCriteriaBoolean({
+        value: currentIsTimeout,
+        criteriaFilter: input.criteriaFilter,
+      });
+    }
+
     // Check domain expires in days
     if (input.criteriaFilter.checkOn === CheckOn.DomainExpiresDaysIn) {
       threshold = CompareCriteria.convertToNumber(threshold);

package/Server/Utils/Monitor/MonitorMetricUtil.ts

@@ -1,6 +1,7 @@
 import logger from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import TelemetryUtil from "../Telemetry/Telemetry";
+import MetricResourceAttributeUtil from "../../../Utils/Metrics/MetricResourceAttributeUtil";
 import MetricService from "../../Services/MetricService";
 import GlobalConfigService from "../../Services/GlobalConfigService";
 import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
@@ -8,6 +9,7 @@ import DataToProcess from "./DataToProcess";
 import { MetricPointType } from "../../../Models/AnalyticsModels/Metric";
 import ServiceType from "../../../Types/Telemetry/ServiceType";
 import MetricType from "../../../Models/DatabaseModels/MetricType";
+import Label from "../../../Models/DatabaseModels/Label";
 import BasicInfrastructureMetrics, {
   NetworkInterfaceMetrics,
 } from "../../../Types/Infrastructure/BasicMetrics";
@@ -17,6 +19,7 @@ import CapturedMetric from "../../../Types/Monitor/CustomCodeMonitor/CapturedMet
 import HttpPhaseTimings from "../../../Types/Monitor/HttpPhaseTimings";
 import MonitorMetricType from "../../../Types/Monitor/MonitorMetricType";
 import PingMonitorResponse from "../../../Types/Monitor/PingMonitor/PingMonitorResponse";
+import PortMonitorTimings from "../../../Types/Monitor/PortMonitor/PortMonitorTimings";
 import SnmpInterface from "../../../Types/Monitor/SnmpMonitor/SnmpInterface";
 import { SnmpOidResponse } from "../../../Types/Monitor/SnmpMonitor/SnmpMonitorResponse";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
@@ -233,6 +236,47 @@ export default class MonitorMetricUtil {
     data.metricNameServiceNameMap[data.metricName] = metricType;
   }
 
+  /**
+   * Stamp every metric row produced by one monitor check with the monitor's
+   * label and custom field attributes.
+   *
+   * Done as a single pass over the finished rows rather than threaded through
+   * the ~30 emission sites below: every metric from one check describes the
+   * same monitor, so there is nothing per-metric to decide, and one pass is
+   * far easier to keep correct than thirty call sites.
+   *
+   * Resource attributes are merged LAST. Custom code monitors let a user
+   * supply their own attribute names, and those must not be able to shadow the
+   * oneuptime.* namespace.
+   */
+  public static applyResourceAttributesToMetricRows(data: {
+    metricRows: Array<JSONObject>;
+    labels?: Array<Label> | undefined;
+    customFields?: JSONObject | undefined;
+  }): void {
+    const resourceAttributes: JSONObject =
+      MetricResourceAttributeUtil.getResourceAttributes({
+        labels: data.labels,
+        customFields: data.customFields,
+      });
+
+    if (Object.keys(resourceAttributes).length === 0) {
+      // Nothing to stamp; leave the rows (and their attributeKeys) untouched.
+      return;
+    }
+
+    for (const metricRow of data.metricRows) {
+      const attributes: JSONObject =
+        MetricResourceAttributeUtil.mergeResourceAttributes(
+          (metricRow["attributes"] as JSONObject) || {},
+          resourceAttributes,
+        );
+
+      metricRow["attributes"] = attributes;
+      metricRow["attributeKeys"] = TelemetryUtil.getAttributeKeys(attributes);
+    }
+  }
+
   @CaptureSpan()
   public static async saveMonitorMetrics(data: {
     monitorId: ObjectID;
@@ -240,6 +284,15 @@ export default class MonitorMetricUtil {
     dataToProcess: DataToProcess;
     probeName: string | undefined;
     monitorName: string | undefined;
+    /*
+     * The monitor's own taxonomy, passed in by the caller which has already
+     * loaded the monitor — this is the hottest Postgres path in the product,
+     * so nothing here re-reads it. Both are optional: callers that do not
+     * select them simply record no oneuptime.label.* / oneuptime.customField.*
+     * attributes.
+     */
+    monitorLabels?: Array<Label> | undefined;
+    monitorCustomFields?: JSONObject | undefined;
   }): Promise<void> {
     if (!data.monitorId) {
       return;
@@ -1093,6 +1146,51 @@ export default class MonitorMetricUtil {
       }
     }
 
+    const portTimings: PortMonitorTimings | undefined = (
+      data.dataToProcess as ProbeMonitorResponse
+    ).portTimings;
+
+    if (portTimings) {
+      const extraAttributes: JSONObject = {
+        probeId: (
+          data.dataToProcess as ProbeMonitorResponse
+        ).probeId.toString(),
+      };
+
+      const phaseMetrics: Array<{
+        metricName: MonitorMetricType;
+        value: number | undefined;
+        description: string;
+      }> = [
+        {
+          metricName: MonitorMetricType.PortDnsLookupTime,
+          value: portTimings.dnsLookupInMs,
+          description: "DNS lookup time for this Port monitor",
+        },
+        {
+          metricName: MonitorMetricType.PortTcpConnectTime,
+          value: portTimings.tcpConnectInMs,
+          description: "TCP connect time for this Port monitor",
+        },
+      ];
+
+      for (const phaseMetric of phaseMetrics) {
+        await this.pushMonitorMetric({
+          projectId: data.projectId,
+          monitorId: data.monitorId,
+          monitorName: data.monitorName,
+          probeName: data.probeName,
+          metricName: phaseMetric.metricName,
+          value: phaseMetric.value,
+          description: phaseMetric.description,
+          unit: "ms",
+          extraAttributes: extraAttributes,
+          metricRows: metricRows,
+          metricNameServiceNameMap: metricNameServiceNameMap,
+        });
+      }
+    }
+
     if ((data.dataToProcess as ProbeMonitorResponse).pingResponse) {
       const pingResponse: PingMonitorResponse = (
         data.dataToProcess as ProbeMonitorResponse
@@ -1294,6 +1392,12 @@ export default class MonitorMetricUtil {
       metricNameServiceNameMap[prefixedName] = metricType;
     }
 
+    this.applyResourceAttributesToMetricRows({
+      metricRows: metricRows,
+      labels: data.monitorLabels,
+      customFields: data.monitorCustomFields,
+    });
+
     if (metricRows.length > 0) {
       await MetricService.insertJsonRows(metricRows);
     }

package/Server/Utils/Monitor/MonitorResource.ts

@@ -138,6 +138,18 @@ export default class MonitorResourceUtil {
         _id: true,
         name: true,
         minimumProbeAgreement: true,
+        /*
+         * Recorded as oneuptime.label.* / oneuptime.customField.* attributes on
+         * every monitor metric this result produces, so response time and
+         * uptime are groupable by a project's own taxonomy. Selected here
+         * rather than re-read inside MonitorMetricUtil: this is the hottest
+         * Postgres path in the product and it already loads the monitor.
+         */
+        labels: {
+          _id: true,
+          name: true,
+        },
+        customFields: true,
       },
       props: {
         isRoot: true,
@@ -480,6 +492,8 @@ export default class MonitorResourceUtil {
           dataToProcess: dataToProcess,
           probeName: probeName || undefined,
           monitorName: monitorName || undefined,
+          monitorLabels: monitor.labels || undefined,
+          monitorCustomFields: monitor.customFields || undefined,
         });
       } catch (err) {
         logger.error("Unable to save metrics");

package/Server/Utils/Monitor/MonitorTemplateUtil.ts

@@ -424,6 +424,7 @@ export default class MonitorTemplateUtil {
           nameServers: domainResponse?.nameServers,
           domainStatus: domainResponse?.domainStatus,
           dnssec: domainResponse?.dnssec,
+          lookupMethod: domainResponse?.lookupMethod,
         } as JSONObject;
       }
 

package/Server/Utils/PasswordHash.ts

@@ -241,9 +241,12 @@ export default class PasswordHash {
    *   salted SHA   `SHA256("v2:" + salt + ":" + secret + ":" + password)`.
    *   bare SHA     `SHA256(secret + password)`, from before salts existed.
    *
-   * The last two are told apart by whether the row has a salt, which is the
-   * same rule they were written under. Anything not carrying a recognised
-   * scheme prefix is one of them.
+   * Normally the last two are told apart by whether the row has a salt,
+   * which is the rule they were written under. During a rolling deployment,
+   * however, an old pod can write a bare SHA digest while leaving a new pod's
+   * salt behind. Anything without a recognised scheme prefix therefore tries
+   * the selected legacy scheme first and the bare scheme as a compatibility
+   * fallback.
    */
   public static async verify(data: {
     plainValue: string;
@@ -259,11 +262,32 @@ export default class PasswordHash {
     );
 
     if (!parsed) {
+      const matchesSelectedLegacyScheme: boolean =
+        await HashedString.verifyValue({
+          plainValue: data.plainValue,
+          hashedValue: data.storedValue,
+          encryptionSecret: EncryptionSecret,
+          salt: data.salt || null,
+        });
+
+      if (matchesSelectedLegacyScheme || !data.salt) {
+        return matchesSelectedLegacyScheme;
+      }
+
+      /*
+       * Rolling-deploy compatibility. A pod running the pre-salt write path
+       * can replace a password with the original bare SHA-256 digest while a
+       * salt written by a newer pod remains on the row. A bare digest carries
+       * no scheme marker, so trying only the salted-SHA construction would
+       * lock that resource out permanently. Fall back to the original scheme
+       * when a supplied salt does not match; the successful caller upgrades
+       * the row to scrypt immediately afterwards.
+       */
       return await HashedString.verifyValue({
         plainValue: data.plainValue,
         hashedValue: data.storedValue,
         encryptionSecret: EncryptionSecret,
-        salt: data.salt || null,
+        salt: null,
       });
     }
 

package/Server/Utils/Response.ts

@@ -24,6 +24,7 @@ import ListData from "../../Types/ListData";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Route from "../../Types/API/Route";
 import CaptureSpan from "./Telemetry/CaptureSpan";
+import { IsBillingEnabled } from "../EnvironmentConfig";
 
 export default class Response {
   @CaptureSpan()
@@ -94,7 +95,17 @@ export default class Response {
   ): void {
     const oneUptimeResponse: OneUptimeResponse = res as OneUptimeResponse;
 
-    oneUptimeResponse.render(path, vars);
+    /*
+     * Analytics is opt-in per render, and off unless this is the hosted
+     * product. A self-hosted install has no reason to load Google Tag Manager
+     * from googletagmanager.com, and an air-gapped one cannot - it would just
+     * be another request left hanging. Same default the frontend index pages
+     * already use; passing the flag explicitly still wins.
+     */
+    oneUptimeResponse.render(path, {
+      enableGoogleTagManager: IsBillingEnabled,
+      ...vars,
+    });
   }
 
   @CaptureSpan()

package/Server/Utils/SSRFProtection.ts

@@ -0,0 +1,237 @@
+import URL from "../../Types/API/URL";
+import BadDataException from "../../Types/Exception/BadDataException";
+import dns from "dns";
+
+const IPV4_LITERAL_REGEX: RegExp = /^(\d{1,3}\.){3}\d{1,3}$/;
+const IPV6_UNIQUE_LOCAL_REGEX: RegExp = /^f[cd][0-9a-f]{2}:/;
+
+/*
+ * Guards outbound HTTP(S) requests whose target is (fully or partly)
+ * attacker-controlled — status page subscriber webhooks, project webhook
+ * notifications, etc. — against Server-Side Request Forgery. It rejects URLs
+ * that point at loopback, RFC-1918 private ranges, link-local (including the
+ * 169.254.169.254 cloud metadata endpoint), CGNAT, and IPv6 loopback /
+ * link-local / unique-local addresses, resolving DNS hostnames first so a
+ * public-looking name that maps to an internal address is still blocked.
+ *
+ * This is a best-effort, TOCTOU-susceptible check: a hostname can resolve to a
+ * different address between validation and the actual request (DNS rebinding).
+ * Callers should therefore ALSO disable redirect-following on the request so a
+ * validated public host cannot 3xx-redirect the server to an internal target.
+ */
+export default class SSRFProtection {
+  /*
+   * Returns the bare, lowercased host of a URL — no port, no brackets — or an
+   * empty string if it cannot be parsed. Host-pinning allowlists (Slack, Teams)
+   * must compare against THIS, never against the whole URL string: a substring
+   * check on the full URL is satisfied by an attacker-controlled path or query
+   * (`http://169.254.169.254/?x=office.com`) and pins nothing.
+   */
+  public static getBareHostname(rawUrl: string | URL): string {
+    let parsed: URL;
+    try {
+      parsed = URL.fromString(rawUrl.toString());
+    } catch {
+      return "";
+    }
+
+    return SSRFProtection.extractHost(parsed.hostname.hostname.toLowerCase());
+  }
+
+  /*
+   * True when the URL's host is exactly one of `allowedDomains` or a subdomain
+   * of one, and the scheme is https. Suffix matching is anchored on a leading
+   * dot so `office.com.attacker.tld` and `evil-office.com` are both rejected.
+   */
+  public static isUrlOnAllowedDomain(
+    rawUrl: string | URL,
+    allowedDomains: Array<string>,
+  ): boolean {
+    let parsed: URL;
+    try {
+      parsed = URL.fromString(rawUrl.toString());
+    } catch {
+      return false;
+    }
+
+    if (parsed.protocol.toString().toLowerCase() !== "https://") {
+      return false;
+    }
+
+    const hostname: string = SSRFProtection.getBareHostname(rawUrl);
+
+    if (!hostname) {
+      return false;
+    }
+
+    return allowedDomains.some((domain: string) => {
+      const allowed: string = domain.toLowerCase();
+      return hostname === allowed || hostname.endsWith(`.${allowed}`);
+    });
+  }
+
+  public static async validateWebhookTargetIsSafe(
+    rawUrl: string | URL,
+  ): Promise<void> {
+    let parsed: URL;
+    try {
+      parsed = URL.fromString(rawUrl.toString());
+    } catch {
+      throw new BadDataException("Webhook URL is not a valid URL");
+    }
+
+    const protocolValue: string = parsed.protocol.toString().toLowerCase();
+    if (protocolValue !== "http://" && protocolValue !== "https://") {
+      throw new BadDataException(
+        "Webhook URL must use http or https protocol.",
+      );
+    }
+
+    const rawHost: string = parsed.hostname.hostname.toLowerCase();
+
+    if (!rawHost) {
+      throw new BadDataException("Webhook URL must include a host.");
+    }
+
+    /*
+     * OneUptime's URL parser keeps the port glued to the host (e.g.
+     * "169.254.169.254:80"). Strip it before the checks below, otherwise a
+     * literal-with-port slips past the IPv4 blocklist and, because it contains
+     * a ":", is mistaken for an IP literal and skips DNS resolution entirely.
+     */
+    const hostname: string = SSRFProtection.extractHost(rawHost);
+
+    if (!hostname) {
+      throw new BadDataException("Webhook URL must include a host.");
+    }
+
+    if (SSRFProtection.isBlockedHostnameLiteral(hostname)) {
+      throw new BadDataException(
+        "Webhook URL points to a private, loopback, or link-local address and is not allowed.",
+      );
+    }
+
+    if (!SSRFProtection.isIpLiteral(hostname)) {
+      let resolved: Array<{ address: string }> = [];
+      try {
+        resolved = await dns.promises.lookup(hostname, { all: true });
+      } catch {
+        throw new BadDataException(
+          "Webhook URL hostname could not be resolved via DNS.",
+        );
+      }
+
+      for (const entry of resolved) {
+        if (
+          SSRFProtection.isBlockedHostnameLiteral(entry.address.toLowerCase())
+        ) {
+          throw new BadDataException(
+            "Webhook URL resolves to a private, loopback, or link-local address and is not allowed.",
+          );
+        }
+      }
+    }
+  }
+
+  /*
+   * Extracts the bare host (IPv4, IPv6, or hostname) from a "host[:port]"
+   * string, handling bracketed IPv6 (`[::1]`, `[::1]:8080`) and unbracketed
+   * IPv6 literals (which contain multiple colons and carry no port).
+   */
+  private static extractHost(hostWithPort: string): string {
+    const host: string = hostWithPort.trim();
+
+    if (host.startsWith("[")) {
+      const closingBracketIndex: number = host.indexOf("]");
+      if (closingBracketIndex !== -1) {
+        return host.slice(1, closingBracketIndex);
+      }
+      return host.replace(/^\[|\]$/g, "");
+    }
+
+    const colonCount: number = (host.match(/:/g) || []).length;
+
+    if (colonCount > 1) {
+      // Unbracketed IPv6 literal — colons are part of the address, not a port.
+      return host;
+    }
+
+    if (colonCount === 1) {
+      // host:port — keep only the host part.
+      return host.split(":")[0] || "";
+    }
+
+    return host;
+  }
+
+  private static isIpLiteral(hostname: string): boolean {
+    return IPV4_LITERAL_REGEX.test(hostname) || hostname.includes(":");
+  }
+
+  private static isBlockedHostnameLiteral(hostname: string): boolean {
+    if (
+      hostname === "localhost" ||
+      hostname.endsWith(".localhost") ||
+      hostname === "metadata.google.internal"
+    ) {
+      return true;
+    }
+
+    const ipv4Match: RegExpMatchArray | null = hostname.match(
+      /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
+    );
+    if (ipv4Match) {
+      const octets: Array<number> = [
+        Number(ipv4Match[1]),
+        Number(ipv4Match[2]),
+        Number(ipv4Match[3]),
+        Number(ipv4Match[4]),
+      ];
+
+      if (
+        octets.some((o: number) => {
+          return o < 0 || o > 255;
+        })
+      ) {
+        return true;
+      }
+      if (octets[0] === 0) {
+        return true;
+      }
+      if (octets[0] === 127) {
+        return true;
+      }
+      if (octets[0] === 10) {
+        return true;
+      }
+      if (octets[0] === 172 && (octets[1]! & 0xf0) === 16) {
+        return true;
+      }
+      if (octets[0] === 192 && octets[1] === 168) {
+        return true;
+      }
+      if (octets[0] === 169 && octets[1] === 254) {
+        return true;
+      }
+      if (octets[0] === 100 && (octets[1]! & 0xc0) === 64) {
+        return true;
+      }
+      return false;
+    }
+
+    if (hostname.includes(":")) {
+      const stripped: string = hostname.replace(/^\[|\]$/g, "");
+      if (stripped === "::1" || stripped === "::") {
+        return true;
+      }
+      if (stripped.startsWith("fe80:") || stripped.startsWith("fe80::")) {
+        return true;
+      }
+      if (IPV6_UNIQUE_LOCAL_REGEX.test(stripped)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+}

package/Server/Utils/StartServer.ts

@@ -34,6 +34,7 @@ import "./Process";
 import Response from "./Response";
 import SpanUtil from "./Telemetry/SpanUtil";
 import TelemetryContext from "./Telemetry/TelemetryContext";
+import mountVendorAssets from "./VendorAssets";
 import { api } from "@opentelemetry/sdk-node";
 import StatusCode from "../../Types/API/StatusCode";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
@@ -303,6 +304,13 @@ const init: InitFunction = async (
     statusOptions: data.statusOptions,
   });
 
+  /*
+   * Ahead of the frontend static mounts and every catch-all below them, so a
+   * service that answers "/*" with its index page cannot swallow a request for
+   * a stylesheet.
+   */
+  mountVendorAssets(app);
+
   if (isFrontendApp) {
     app.use(ExpressStatic("/usr/src/app/public"));
 

package/Server/Utils/StatusPageSubscriberWebhook.ts

@@ -4,6 +4,7 @@ import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../Types/API/HTTPResponse";
 import { JSONObject } from "../../Types/JSON";
 import logger from "./Logger";
+import SSRFProtection from "./SSRFProtection";
 
 export interface StatusPageWebhookPayload extends JSONObject {
   eventType: string;
@@ -21,6 +22,30 @@ export default class StatusPageSubscriberWebhookUtil {
   }): Promise<HTTPResponse<JSONObject> | HTTPErrorResponse> {
     logger.debug("Sending status page subscriber webhook notification.");
 
+    /*
+     * The subscriber webhook target is attacker-controllable: any unauthenticated
+     * visitor can register a subscriber with an arbitrary webhook URL on a public
+     * status page. Validate it against the SSRF blocklist before every send (not
+     * just at create time) so previously-stored URLs and DNS-rebinding cannot make
+     * the server reach internal services or the cloud metadata endpoint.
+     */
+    try {
+      await SSRFProtection.validateWebhookTargetIsSafe(data.webhookUrl);
+    } catch (err) {
+      logger.warn(
+        "Refusing to send status page subscriber webhook: unsafe URL.",
+      );
+      logger.warn(err);
+      return new HTTPErrorResponse(
+        400,
+        {
+          message:
+            err instanceof Error ? err.message : "Webhook URL is not allowed.",
+        },
+        {},
+      );
+    }
+
     const apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse =
       await API.post({
         url: data.webhookUrl,
@@ -28,6 +53,11 @@ export default class StatusPageSubscriberWebhookUtil {
         options: {
           retries: 3,
           exponentialBackoff: true,
+          /*
+           * Do not follow redirects: a validated public host could otherwise
+           * 3xx-redirect the server to an internal address, bypassing the check.
+           */
+          doNotFollowRedirects: true,
         },
       });