@oneuptime/common 12.0.4 → 12.0.6

package/Server/Utils/VendorAssets.ts

@@ -0,0 +1,165 @@
+import {
+  ExpressApplication,
+  ExpressRequest,
+  ExpressResponse,
+  ExpressStatic,
+  NextFunction,
+  RequestHandler,
+} from "./Express";
+import logger from "./Logger";
+import fs from "fs";
+import path from "path";
+
+/**
+ * Serves the browser libraries our server-rendered pages need, from this
+ * install rather than from a public CDN.
+ *
+ * An air-gapped deployment has no route to cdn.tailwindcss.com or
+ * cdnjs.cloudflare.com, and a `<script src>` pointed at one does not fail
+ * fast - the browser waits out the connect timeout with the parser blocked,
+ * so the page renders unstyled or not at all. Same class of bug as the Monaco
+ * loader (see CodeEditor/MonacoLoader.ts): the fix is to stop reaching off-box
+ * for anything the page cannot render without.
+ *
+ * Mounted by every service, because there is no single service that serves
+ * every one of these pages: Docs, the API reference and the SSO/on-call
+ * message views all come out of the App container, the marketing site out of
+ * Home, and nginx sends `/` to whichever of the two the install has (App when
+ * billing is off, which is every self-hosted install). A path only one of them
+ * answers would 404 for the other.
+ */
+
+/**
+ * Absolute, host-relative. Views hard-code this rather than take it as a
+ * render variable - the mount point is fixed, and threading a variable through
+ * every Response.render call site would be a lot of ceremony for a constant.
+ */
+export const VendorAssetsRoute: string = "/oneuptime-assets";
+
+/** Where the committed assets live on disk. */
+export const VendorAssetsPath: string = path.resolve(
+  __dirname,
+  "..",
+  "Static",
+  "Vendor",
+);
+
+/**
+ * Mermaid is a dependency of Common already (Common/UI renders diagrams in
+ * markdown with it), so it is on disk in every image and there is no reason to
+ * commit a second copy. Resolved rather than hard-coded because npm may hoist
+ * it above Common's own node_modules.
+ */
+export function getMermaidDistPath(): string | null {
+  try {
+    return path.join(
+      path.dirname(require.resolve("mermaid/package.json")),
+      "dist",
+    );
+  } catch (error) {
+    logger.error(
+      "mermaid could not be resolved. Diagrams in docs and blog posts will not render.",
+    );
+    logger.error(error);
+    return null;
+  }
+}
+
+/*
+ * Mermaid's dist directory also carries type definitions, sourcemaps and its
+ * own docs. Only the code the browser actually imports gets served - the
+ * entrypoint plus the diagram chunks it lazily pulls in.
+ */
+const MERMAID_SERVABLE_EXTENSIONS: Array<string> = [".js", ".mjs"];
+
+/*
+ * A year, for paths that cannot change meaning: tailwind and highlight name
+ * their version in the filename, and mermaid's chunks are content-hashed.
+ */
+const IMMUTABLE_CACHE_MAX_AGE_MILLISECONDS: number = 365 * 24 * 60 * 60 * 1000;
+
+/*
+ * An hour, for mermaid's two entrypoints. Those names are stable while
+ * everything they import is content-hashed, so a year-old cached copy of
+ * mermaid.esm.min.mjs would go on asking for chunk filenames that a mermaid
+ * upgrade has already deleted - and the diagrams would stay broken, for that
+ * one visitor, until the cache entry aged out.
+ */
+const REVALIDATE_CACHE_MAX_AGE_MILLISECONDS: number = 60 * 60 * 1000;
+
+/* Where mermaid puts the hashed chunks, relative to its own mount. */
+const MERMAID_CHUNK_PREFIX: string = "/chunks/";
+
+export type MountVendorAssetsFunction = (app: ExpressApplication) => void;
+
+const mountVendorAssets: MountVendorAssetsFunction = (
+  app: ExpressApplication,
+): void => {
+  if (fs.existsSync(VendorAssetsPath)) {
+    app.use(
+      VendorAssetsRoute,
+      ExpressStatic(VendorAssetsPath, {
+        maxAge: IMMUTABLE_CACHE_MAX_AGE_MILLISECONDS,
+        index: false,
+        redirect: false,
+      }) as RequestHandler,
+    );
+  } else {
+    /*
+     * Nothing to serve is worth shouting about: every page that references
+     * these paths is about to render without its stylesheet.
+     */
+    logger.error(
+      `Vendored browser assets are missing at ${VendorAssetsPath}. Server-rendered pages will render unstyled.`,
+    );
+  }
+
+  const mermaidDistPath: string | null = getMermaidDistPath();
+
+  if (mermaidDistPath) {
+    const serveImmutable: RequestHandler = ExpressStatic(mermaidDistPath, {
+      maxAge: IMMUTABLE_CACHE_MAX_AGE_MILLISECONDS,
+      index: false,
+      redirect: false,
+    }) as RequestHandler;
+
+    const serveRevalidating: RequestHandler = ExpressStatic(mermaidDistPath, {
+      maxAge: REVALIDATE_CACHE_MAX_AGE_MILLISECONDS,
+      index: false,
+      redirect: false,
+    }) as RequestHandler;
+
+    app.use(
+      `${VendorAssetsRoute}/mermaid`,
+      (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        const extension: string = path.extname(req.path).toLowerCase();
+
+        if (!MERMAID_SERVABLE_EXTENSIONS.includes(extension)) {
+          return next();
+        }
+
+        /* Express has already stripped the mount path, so this is "/chunks/...". */
+        if (req.path.startsWith(MERMAID_CHUNK_PREFIX)) {
+          return serveImmutable(req, res, next);
+        }
+
+        return serveRevalidating(req, res, next);
+      },
+    );
+  }
+
+  /*
+   * Terminates the prefix. Registered unconditionally, and last, because the
+   * alternative is worse than a 404: express static falls through on a miss,
+   * and the next thing to see the request is the frontend catch-all, which
+   * answers with the dashboard's index page - HTTP 200, Content-Type
+   * text/html. A <script> handed HTML fires onload, not onerror, so the docs'
+   * lazy grammar loader would count it as loaded and highlight nothing, with
+   * no error anywhere. Better to say plainly that the asset is not here.
+   */
+  app.use(VendorAssetsRoute, (_req: ExpressRequest, res: ExpressResponse) => {
+    res.status(404).send("Not found");
+  });
+};
+
+export default mountVendorAssets;

package/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.ts

@@ -30,6 +30,7 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 import ObjectID from "../../../../Types/ObjectID";
 import WorkspaceProjectAuthTokenService from "../../../Services/WorkspaceProjectAuthTokenService";
+import SSRFProtection from "../../SSRFProtection";
 import WorkspaceProjectAuthToken, {
   MicrosoftTeamsChat,
   MicrosoftTeamsChatType,
@@ -113,6 +114,16 @@ const MICROSOFT_TEAMS_APP_TYPE: string = "SingleTenant";
 // Maximum number of pages to fetch when paginating teams
 const MICROSOFT_TEAMS_MAX_PAGES: number = 500;
 
+/*
+ * Hosts that may receive a Teams incoming webhook. Connector webhooks are
+ * issued on outlook.office.com / outlook.office365.com, and per-tenant ones on
+ * <tenant>.webhook.office.com — all covered by these two registrable domains.
+ */
+const MICROSOFT_TEAMS_WEBHOOK_DOMAINS: Array<string> = [
+  "office.com",
+  "office365.com",
+];
+
 export default class MicrosoftTeamsUtil extends WorkspaceBase {
   private static cachedAdapter: CloudAdapter | null = null;
   private static readonly WELCOME_CARD_STATE_KEY: string =
@@ -700,6 +711,13 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
       await API.post({
         url: data.url,
         data: payload,
+        options: {
+          /*
+           * The host is pinned to Microsoft, but do not let a redirect from it
+           * bounce this request to an internal address.
+           */
+          doNotFollowRedirects: true,
+        },
       });
 
     if (!apiResult) {
@@ -730,11 +748,16 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
   public static isValidMicrosoftTeamsIncomingWebhookUrl(
     incomingWebhookUrl: URL,
   ): boolean {
-    // Check if the URL contains outlook.office.com or office.com webhook pattern
-    const urlString: string = incomingWebhookUrl.toString();
-    return (
-      urlString.includes("outlook.office.com") ||
-      urlString.includes("office.com")
+    /*
+     * Pin on the URL's HOST, not on a substring of the whole URL. Subscribers
+     * (including unauthenticated ones on a public status page) supply this
+     * value and the server POSTs to it, so a substring check was satisfied by
+     * an attacker-controlled path or query — `http://169.254.169.254/?x=office.com`
+     * passed and turned this into an SSRF into the cloud metadata endpoint.
+     */
+    return SSRFProtection.isUrlOnAllowedDomain(
+      incomingWebhookUrl,
+      MICROSOFT_TEAMS_WEBHOOK_DOMAINS,
     );
   }
 

package/Server/Utils/Workspace/Slack/Slack.ts

@@ -2282,6 +2282,11 @@ export default class SlackUtil extends WorkspaceBase {
         options: {
           retries: 3,
           exponentialBackoff: true,
+          /*
+           * The host is pinned to hooks.slack.com, but do not let a redirect
+           * from it bounce this request to an internal address.
+           */
+          doNotFollowRedirects: true,
         },
       });
 

package/Server/Views/Partials/Head.ejs

@@ -1,9 +1,21 @@
-<link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link rel="preload" href="https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap" as="style">
-<link href="https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap"
-    rel="stylesheet">
+<link rel="preload" href="/oneuptime-assets/fonts/InterVariable.woff2" as="font" type="font/woff2" crossorigin>
 <style>
+    /*
+     * Inter is served from this install rather than from Google's font CDN.
+     * A stylesheet <link> to an unreachable host blocks first paint for the
+     * whole connect timeout, so on an air-gapped deployment the hosted version
+     * did not just lose the font - it held the page blank. The variable font
+     * covers 100-900 in one file.
+     */
+    @font-face {
+        font-family: 'Inter';
+        font-style: normal;
+        font-weight: 100 900;
+        font-display: swap;
+        src: url('/oneuptime-assets/fonts/InterVariable.woff2') format('woff2') tech('variations'),
+             url('/oneuptime-assets/fonts/InterVariable.woff2') format('woff2-variations');
+    }
+
     * {
         font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
     }
@@ -35,9 +47,10 @@
         width: auto;
     }
 </style>
-<link rel="preload" href="https://cdn.tailwindcss.com" as="script">
-<script src="https://cdn.tailwindcss.com"></script>
+<link rel="preload" href="/oneuptime-assets/tailwind/tailwind-3.4.5.js" as="script">
+<script src="/oneuptime-assets/tailwind/tailwind-3.4.5.js"></script>
 
+<% if(typeof enableGoogleTagManager !== 'undefined' ? enableGoogleTagManager : false){ %>
 <!-- Google Tag Manager -->
 <script>(function (w, d, s, l, i) {
         w[l] = w[l] || []; w[l].push({
@@ -48,6 +61,7 @@
                 'https://www.googletagmanager.com/gtm.js?id=' + i + dl; f.parentNode.insertBefore(j, f);
     })(window, document, 'script', 'dataLayer', 'GTM-PKQD5WH');</script>
 <!-- End Google Tag Manager -->
+<% } %>
 
 
 

package/Tests/App/AdminDashboard/AdminProjectsIdFilter.test.tsx

@@ -0,0 +1,207 @@
+import "@testing-library/jest-dom";
+import { render, waitFor } from "@testing-library/react";
+import React from "react";
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+import { Location, MemoryRouter } from "react-router-dom";
+
+/*
+ * Same story as the Users table: a master admin holding a project ID - from a
+ * billing record, a support ticket, a telemetry attribute - needs to reach the
+ * project. Search covers the project name only, so an ID was previously a dead
+ * end.
+ *
+ * The Projects page has a second axis this file has to hold steady: it rebuilds
+ * its form fields whenever the billing toggle flips, in an effect. The filters
+ * must not be collateral damage of that re-render, so every assertion here runs
+ * against the props captured after the effect has settled.
+ */
+
+jest.mock("react-i18next", () => {
+  return {
+    useTranslation: () => {
+      return {
+        t: (key: string): string => {
+          return key;
+        },
+      };
+    },
+  };
+});
+
+jest.mock("../../../UI/Utils/Permission", () => {
+  return {
+    __esModule: true,
+    default: {
+      getAllPermissions: () => {
+        return [];
+      },
+      getProjectPermissions: () => {
+        return [];
+      },
+      getGlobalPermissions: () => {
+        return [];
+      },
+    },
+  };
+});
+
+jest.mock("../../../UI/Utils/User", () => {
+  return {
+    __esModule: true,
+    default: {
+      isMasterAdmin: () => {
+        return true;
+      },
+      getUserId: () => {
+        return null;
+      },
+    },
+  };
+});
+
+type CapturedTableProps = {
+  filters?: Array<Filter<Project>> | undefined;
+  searchableFields?: Array<string> | undefined;
+  showViewIdButton?: boolean | undefined;
+};
+
+let capturedTableProps: CapturedTableProps | null = null;
+let renderCount: number = 0;
+
+jest.mock("../../../UI/Components/ModelTable/ModelTable", () => {
+  return {
+    __esModule: true,
+    default: (props: CapturedTableProps) => {
+      capturedTableProps = props;
+      renderCount = renderCount + 1;
+      return null;
+    },
+  };
+});
+
+import Projects from "../../../../App/FeatureSet/AdminDashboard/src/Pages/Projects/Index";
+import Filter from "../../../UI/Components/ModelFilter/Filter";
+import FieldType from "../../../UI/Components/Types/FieldType";
+import Navigation from "../../../UI/Utils/Navigation";
+import Project from "../../../Models/DatabaseModels/Project";
+import { getFilterKeys } from "../../../UI/Components/ModelTable/FilterDataToQuery";
+
+type FilterTitledFunction = (title: string) => Filter<Project>;
+
+const filterTitled: FilterTitledFunction = (title: string): Filter<Project> => {
+  const filter: Filter<Project> | undefined = (
+    capturedTableProps?.filters || []
+  ).find((candidate: Filter<Project>) => {
+    return candidate.title === title;
+  });
+
+  if (!filter) {
+    throw new Error(
+      `No "${title}" filter. Filters: ${(capturedTableProps?.filters || [])
+        .map((candidate: Filter<Project>) => {
+          return candidate.title;
+        })
+        .join(", ")}`,
+    );
+  }
+
+  return filter;
+};
+
+describe("Admin > Projects page", () => {
+  beforeEach(async () => {
+    capturedTableProps = null;
+    renderCount = 0;
+
+    /*
+     * The page reads the current route to build the row's view link. In the
+     * app the router pushes this in; under test nothing does.
+     */
+    Navigation.setLocation({
+      pathname: "/admin/projects",
+      search: "",
+      hash: "",
+      state: null,
+      key: "test",
+    } as Location);
+
+    render(
+      <MemoryRouter>
+        <Projects />
+      </MemoryRouter>,
+    );
+
+    // The form-field effect renders a second time; wait it out.
+    await waitFor(() => {
+      expect(renderCount).toBeGreaterThan(1);
+    });
+  });
+
+  describe("the Project ID filter", () => {
+    test("is offered as a filter", () => {
+      expect(() => {
+        return filterTitled("Project ID");
+      }).not.toThrow();
+    });
+
+    test("filters on the project's own id column", () => {
+      expect(filterTitled("Project ID").field).toEqual({ _id: true });
+    });
+
+    /*
+     * ObjectID routes to the free-text input with the operator menu. A
+     * Dropdown or Entity type would render a picker instead, which is useless
+     * to someone who has the ID and not the name.
+     */
+    test("renders as a typed-in ID, not a picker", () => {
+      expect(filterTitled("Project ID").type).toBe(FieldType.ObjectID);
+    });
+
+    /*
+     * Undeclared keys are stripped from the outgoing query by
+     * `sanitizeFilterData`, so this is what stops the filter being silently
+     * dropped between the modal and the request.
+     */
+    test("declares _id as an allowed filter key", () => {
+      expect(
+        getFilterKeys<Project>(capturedTableProps!.filters || []),
+      ).toContain("_id");
+    });
+
+    test("comes first, where an admin pasting an ID will look", () => {
+      expect(capturedTableProps!.filters?.[0]?.title).toBe("Project ID");
+    });
+
+    /*
+     * The page re-renders on its own whenever the billing toggle flips. The
+     * filter list is rebuilt inline on each of those renders, so this guards
+     * against it being tangled up with the form-field state that does change.
+     */
+    test("survives the page's own re-renders", () => {
+      expect(renderCount).toBeGreaterThan(1);
+      expect(filterTitled("Project ID").field).toEqual({ _id: true });
+    });
+  });
+
+  describe("what it must not have displaced", () => {
+    test("keeps the filters the page already had", () => {
+      expect(
+        (capturedTableProps!.filters || []).map((filter: Filter<Project>) => {
+          return filter.title;
+        }),
+      ).toEqual(["Project ID", "Name", "Created At"]);
+    });
+
+    /*
+     * `_id` deliberately stays out of free-text search: a hex id contains most
+     * characters somewhere, so searching "a" would match nearly every project.
+     */
+    test("leaves the search box searching names", () => {
+      expect(capturedTableProps!.searchableFields).toEqual(["name"]);
+    });
+
+    test("still lets an admin read a row's id", () => {
+      expect(capturedTableProps!.showViewIdButton).toBe(true);
+    });
+  });
+});