@oneuptime/common 12.0.5 → 12.0.6

package/build/dist/Server/Utils/VendorAssets.js

@@ -0,0 +1,121 @@
+import { ExpressStatic, } from "./Express";
+import logger from "./Logger";
+import fs from "fs";
+import path from "path";
+/**
+ * Serves the browser libraries our server-rendered pages need, from this
+ * install rather than from a public CDN.
+ *
+ * An air-gapped deployment has no route to cdn.tailwindcss.com or
+ * cdnjs.cloudflare.com, and a `<script src>` pointed at one does not fail
+ * fast - the browser waits out the connect timeout with the parser blocked,
+ * so the page renders unstyled or not at all. Same class of bug as the Monaco
+ * loader (see CodeEditor/MonacoLoader.ts): the fix is to stop reaching off-box
+ * for anything the page cannot render without.
+ *
+ * Mounted by every service, because there is no single service that serves
+ * every one of these pages: Docs, the API reference and the SSO/on-call
+ * message views all come out of the App container, the marketing site out of
+ * Home, and nginx sends `/` to whichever of the two the install has (App when
+ * billing is off, which is every self-hosted install). A path only one of them
+ * answers would 404 for the other.
+ */
+/**
+ * Absolute, host-relative. Views hard-code this rather than take it as a
+ * render variable - the mount point is fixed, and threading a variable through
+ * every Response.render call site would be a lot of ceremony for a constant.
+ */
+export const VendorAssetsRoute = "/oneuptime-assets";
+/** Where the committed assets live on disk. */
+export const VendorAssetsPath = path.resolve(__dirname, "..", "Static", "Vendor");
+/**
+ * Mermaid is a dependency of Common already (Common/UI renders diagrams in
+ * markdown with it), so it is on disk in every image and there is no reason to
+ * commit a second copy. Resolved rather than hard-coded because npm may hoist
+ * it above Common's own node_modules.
+ */
+export function getMermaidDistPath() {
+    try {
+        return path.join(path.dirname(require.resolve("mermaid/package.json")), "dist");
+    }
+    catch (error) {
+        logger.error("mermaid could not be resolved. Diagrams in docs and blog posts will not render.");
+        logger.error(error);
+        return null;
+    }
+}
+/*
+ * Mermaid's dist directory also carries type definitions, sourcemaps and its
+ * own docs. Only the code the browser actually imports gets served - the
+ * entrypoint plus the diagram chunks it lazily pulls in.
+ */
+const MERMAID_SERVABLE_EXTENSIONS = [".js", ".mjs"];
+/*
+ * A year, for paths that cannot change meaning: tailwind and highlight name
+ * their version in the filename, and mermaid's chunks are content-hashed.
+ */
+const IMMUTABLE_CACHE_MAX_AGE_MILLISECONDS = 365 * 24 * 60 * 60 * 1000;
+/*
+ * An hour, for mermaid's two entrypoints. Those names are stable while
+ * everything they import is content-hashed, so a year-old cached copy of
+ * mermaid.esm.min.mjs would go on asking for chunk filenames that a mermaid
+ * upgrade has already deleted - and the diagrams would stay broken, for that
+ * one visitor, until the cache entry aged out.
+ */
+const REVALIDATE_CACHE_MAX_AGE_MILLISECONDS = 60 * 60 * 1000;
+/* Where mermaid puts the hashed chunks, relative to its own mount. */
+const MERMAID_CHUNK_PREFIX = "/chunks/";
+const mountVendorAssets = (app) => {
+    if (fs.existsSync(VendorAssetsPath)) {
+        app.use(VendorAssetsRoute, ExpressStatic(VendorAssetsPath, {
+            maxAge: IMMUTABLE_CACHE_MAX_AGE_MILLISECONDS,
+            index: false,
+            redirect: false,
+        }));
+    }
+    else {
+        /*
+         * Nothing to serve is worth shouting about: every page that references
+         * these paths is about to render without its stylesheet.
+         */
+        logger.error(`Vendored browser assets are missing at ${VendorAssetsPath}. Server-rendered pages will render unstyled.`);
+    }
+    const mermaidDistPath = getMermaidDistPath();
+    if (mermaidDistPath) {
+        const serveImmutable = ExpressStatic(mermaidDistPath, {
+            maxAge: IMMUTABLE_CACHE_MAX_AGE_MILLISECONDS,
+            index: false,
+            redirect: false,
+        });
+        const serveRevalidating = ExpressStatic(mermaidDistPath, {
+            maxAge: REVALIDATE_CACHE_MAX_AGE_MILLISECONDS,
+            index: false,
+            redirect: false,
+        });
+        app.use(`${VendorAssetsRoute}/mermaid`, (req, res, next) => {
+            const extension = path.extname(req.path).toLowerCase();
+            if (!MERMAID_SERVABLE_EXTENSIONS.includes(extension)) {
+                return next();
+            }
+            /* Express has already stripped the mount path, so this is "/chunks/...". */
+            if (req.path.startsWith(MERMAID_CHUNK_PREFIX)) {
+                return serveImmutable(req, res, next);
+            }
+            return serveRevalidating(req, res, next);
+        });
+    }
+    /*
+     * Terminates the prefix. Registered unconditionally, and last, because the
+     * alternative is worse than a 404: express static falls through on a miss,
+     * and the next thing to see the request is the frontend catch-all, which
+     * answers with the dashboard's index page - HTTP 200, Content-Type
+     * text/html. A <script> handed HTML fires onload, not onerror, so the docs'
+     * lazy grammar loader would count it as loaded and highlight nothing, with
+     * no error anywhere. Better to say plainly that the asset is not here.
+     */
+    app.use(VendorAssetsRoute, (_req, res) => {
+        res.status(404).send("Not found");
+    });
+};
+export default mountVendorAssets;
+//# sourceMappingURL=VendorAssets.js.map

package/build/dist/Server/Utils/VendorAssets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VendorAssets.js","sourceRoot":"","sources":["../../../../Server/Utils/VendorAssets.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,aAAa,GAGd,MAAM,WAAW,CAAC;AACnB,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAW,mBAAmB,CAAC;AAE7D,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAW,IAAI,CAAC,OAAO,CAClD,SAAS,EACT,IAAI,EACJ,QAAQ,EACR,QAAQ,CACT,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,EACrD,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,iFAAiF,CAClF,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,2BAA2B,GAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,oCAAoC,GAAW,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,qCAAqC,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE,sEAAsE;AACtE,MAAM,oBAAoB,GAAW,UAAU,CAAC;AAIhD,MAAM,iBAAiB,GAA8B,CACnD,GAAuB,EACjB,EAAE;IACR,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CACL,iBAAiB,EACjB,aAAa,CAAC,gBAAgB,EAAE;YAC9B,MAAM,EAAE,oCAAoC;YAC5C,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,KAAK;SAChB,CAAmB,CACrB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN;;;WAGG;QACH,MAAM,CAAC,KAAK,CACV,0CAA0C,gBAAgB,+CAA+C,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAkB,kBAAkB,EAAE,CAAC;IAE5D,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,cAAc,GAAmB,aAAa,CAAC,eAAe,EAAE;YACpE,MAAM,EAAE,oCAAoC;YAC5C,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,KAAK;SAChB,CAAmB,CAAC;QAErB,MAAM,iBAAiB,GAAmB,aAAa,CAAC,eAAe,EAAE;YACvE,MAAM,EAAE,qCAAqC;YAC7C,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,KAAK;SAChB,CAAmB,CAAC;QAErB,GAAG,CAAC,GAAG,CACL,GAAG,iBAAiB,UAAU,EAC9B,CAAC,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YAChE,MAAM,SAAS,GAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAE/D,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,4EAA4E;YAC5E,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9C,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAoB,EAAE,GAAoB,EAAE,EAAE;QACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/build/dist/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.js

@@ -16,6 +16,7 @@ import WorkspaceType from "../../../../Types/Workspace/WorkspaceType";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 import WorkspaceProjectAuthTokenService from "../../../Services/WorkspaceProjectAuthTokenService";
+import SSRFProtection from "../../SSRFProtection";
 import OneUptimeDate from "../../../../Types/Date";
 import { MicrosoftTeamsAppClientId, MicrosoftTeamsAppClientSecret, MicrosoftTeamsAppTenantId, } from "../../../EnvironmentConfig";
 // Import services for bot commands
@@ -45,6 +46,15 @@ import AccessTokenService from "../../../Services/AccessTokenService";
 const MICROSOFT_TEAMS_APP_TYPE = "SingleTenant";
 // Maximum number of pages to fetch when paginating teams
 const MICROSOFT_TEAMS_MAX_PAGES = 500;
+/*
+ * Hosts that may receive a Teams incoming webhook. Connector webhooks are
+ * issued on outlook.office.com / outlook.office365.com, and per-tenant ones on
+ * <tenant>.webhook.office.com — all covered by these two registrable domains.
+ */
+const MICROSOFT_TEAMS_WEBHOOK_DOMAINS = [
+    "office.com",
+    "office365.com",
+];
 class MicrosoftTeamsUtil extends WorkspaceBase {
     // Get or create Bot Framework adapter for a specific tenant
     static getBotAdapter() {
@@ -468,6 +478,13 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
         const apiResult = await API.post({
             url: data.url,
             data: payload,
+            options: {
+                /*
+                 * The host is pinned to Microsoft, but do not let a redirect from it
+                 * bounce this request to an internal address.
+                 */
+                doNotFollowRedirects: true,
+            },
         });
         if (!apiResult) {
             logger.error("Could not send message to Teams channel via incoming webhook.");
@@ -483,10 +500,14 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
         return apiResult;
     }
     static isValidMicrosoftTeamsIncomingWebhookUrl(incomingWebhookUrl) {
-        // Check if the URL contains outlook.office.com or office.com webhook pattern
-        const urlString = incomingWebhookUrl.toString();
-        return (urlString.includes("outlook.office.com") ||
-            urlString.includes("office.com"));
+        /*
+         * Pin on the URL's HOST, not on a substring of the whole URL. Subscribers
+         * (including unauthenticated ones on a public status page) supply this
+         * value and the server POSTs to it, so a substring check was satisfied by
+         * an attacker-controlled path or query — `http://169.254.169.254/?x=office.com`
+         * passed and turned this into an SSRF into the cloud metadata endpoint.
+         */
+        return SSRFProtection.isUrlOnAllowedDomain(incomingWebhookUrl, MICROSOFT_TEAMS_WEBHOOK_DOMAINS);
     }
     static async getUsernameFromUserId(data) {
         logger.debug("Getting username from user ID with data:", {