@oneuptime/common 12.0.5 → 12.0.6

package/Server/Utils/Monitor/MonitorMetricUtil.ts

@@ -1,6 +1,7 @@
 import logger from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import TelemetryUtil from "../Telemetry/Telemetry";
+import MetricResourceAttributeUtil from "../../../Utils/Metrics/MetricResourceAttributeUtil";
 import MetricService from "../../Services/MetricService";
 import GlobalConfigService from "../../Services/GlobalConfigService";
 import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
@@ -8,6 +9,7 @@ import DataToProcess from "./DataToProcess";
 import { MetricPointType } from "../../../Models/AnalyticsModels/Metric";
 import ServiceType from "../../../Types/Telemetry/ServiceType";
 import MetricType from "../../../Models/DatabaseModels/MetricType";
+import Label from "../../../Models/DatabaseModels/Label";
 import BasicInfrastructureMetrics, {
   NetworkInterfaceMetrics,
 } from "../../../Types/Infrastructure/BasicMetrics";
@@ -234,6 +236,47 @@ export default class MonitorMetricUtil {
     data.metricNameServiceNameMap[data.metricName] = metricType;
   }
 
+  /**
+   * Stamp every metric row produced by one monitor check with the monitor's
+   * label and custom field attributes.
+   *
+   * Done as a single pass over the finished rows rather than threaded through
+   * the ~30 emission sites below: every metric from one check describes the
+   * same monitor, so there is nothing per-metric to decide, and one pass is
+   * far easier to keep correct than thirty call sites.
+   *
+   * Resource attributes are merged LAST. Custom code monitors let a user
+   * supply their own attribute names, and those must not be able to shadow the
+   * oneuptime.* namespace.
+   */
+  public static applyResourceAttributesToMetricRows(data: {
+    metricRows: Array<JSONObject>;
+    labels?: Array<Label> | undefined;
+    customFields?: JSONObject | undefined;
+  }): void {
+    const resourceAttributes: JSONObject =
+      MetricResourceAttributeUtil.getResourceAttributes({
+        labels: data.labels,
+        customFields: data.customFields,
+      });
+
+    if (Object.keys(resourceAttributes).length === 0) {
+      // Nothing to stamp; leave the rows (and their attributeKeys) untouched.
+      return;
+    }
+
+    for (const metricRow of data.metricRows) {
+      const attributes: JSONObject =
+        MetricResourceAttributeUtil.mergeResourceAttributes(
+          (metricRow["attributes"] as JSONObject) || {},
+          resourceAttributes,
+        );
+
+      metricRow["attributes"] = attributes;
+      metricRow["attributeKeys"] = TelemetryUtil.getAttributeKeys(attributes);
+    }
+  }
+
   @CaptureSpan()
   public static async saveMonitorMetrics(data: {
     monitorId: ObjectID;
@@ -241,6 +284,15 @@ export default class MonitorMetricUtil {
     dataToProcess: DataToProcess;
     probeName: string | undefined;
     monitorName: string | undefined;
+    /*
+     * The monitor's own taxonomy, passed in by the caller which has already
+     * loaded the monitor — this is the hottest Postgres path in the product,
+     * so nothing here re-reads it. Both are optional: callers that do not
+     * select them simply record no oneuptime.label.* / oneuptime.customField.*
+     * attributes.
+     */
+    monitorLabels?: Array<Label> | undefined;
+    monitorCustomFields?: JSONObject | undefined;
   }): Promise<void> {
     if (!data.monitorId) {
       return;
@@ -1340,6 +1392,12 @@ export default class MonitorMetricUtil {
       metricNameServiceNameMap[prefixedName] = metricType;
     }
 
+    this.applyResourceAttributesToMetricRows({
+      metricRows: metricRows,
+      labels: data.monitorLabels,
+      customFields: data.monitorCustomFields,
+    });
+
     if (metricRows.length > 0) {
       await MetricService.insertJsonRows(metricRows);
     }

package/Server/Utils/Monitor/MonitorResource.ts

@@ -138,6 +138,18 @@ export default class MonitorResourceUtil {
         _id: true,
         name: true,
         minimumProbeAgreement: true,
+        /*
+         * Recorded as oneuptime.label.* / oneuptime.customField.* attributes on
+         * every monitor metric this result produces, so response time and
+         * uptime are groupable by a project's own taxonomy. Selected here
+         * rather than re-read inside MonitorMetricUtil: this is the hottest
+         * Postgres path in the product and it already loads the monitor.
+         */
+        labels: {
+          _id: true,
+          name: true,
+        },
+        customFields: true,
       },
       props: {
         isRoot: true,
@@ -480,6 +492,8 @@ export default class MonitorResourceUtil {
           dataToProcess: dataToProcess,
           probeName: probeName || undefined,
           monitorName: monitorName || undefined,
+          monitorLabels: monitor.labels || undefined,
+          monitorCustomFields: monitor.customFields || undefined,
         });
       } catch (err) {
         logger.error("Unable to save metrics");

package/Server/Utils/Response.ts

@@ -24,6 +24,7 @@ import ListData from "../../Types/ListData";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Route from "../../Types/API/Route";
 import CaptureSpan from "./Telemetry/CaptureSpan";
+import { IsBillingEnabled } from "../EnvironmentConfig";
 
 export default class Response {
   @CaptureSpan()
@@ -94,7 +95,17 @@ export default class Response {
   ): void {
     const oneUptimeResponse: OneUptimeResponse = res as OneUptimeResponse;
 
-    oneUptimeResponse.render(path, vars);
+    /*
+     * Analytics is opt-in per render, and off unless this is the hosted
+     * product. A self-hosted install has no reason to load Google Tag Manager
+     * from googletagmanager.com, and an air-gapped one cannot - it would just
+     * be another request left hanging. Same default the frontend index pages
+     * already use; passing the flag explicitly still wins.
+     */
+    oneUptimeResponse.render(path, {
+      enableGoogleTagManager: IsBillingEnabled,
+      ...vars,
+    });
   }
 
   @CaptureSpan()

package/Server/Utils/SSRFProtection.ts

@@ -0,0 +1,237 @@
+import URL from "../../Types/API/URL";
+import BadDataException from "../../Types/Exception/BadDataException";
+import dns from "dns";
+
+const IPV4_LITERAL_REGEX: RegExp = /^(\d{1,3}\.){3}\d{1,3}$/;
+const IPV6_UNIQUE_LOCAL_REGEX: RegExp = /^f[cd][0-9a-f]{2}:/;
+
+/*
+ * Guards outbound HTTP(S) requests whose target is (fully or partly)
+ * attacker-controlled — status page subscriber webhooks, project webhook
+ * notifications, etc. — against Server-Side Request Forgery. It rejects URLs
+ * that point at loopback, RFC-1918 private ranges, link-local (including the
+ * 169.254.169.254 cloud metadata endpoint), CGNAT, and IPv6 loopback /
+ * link-local / unique-local addresses, resolving DNS hostnames first so a
+ * public-looking name that maps to an internal address is still blocked.
+ *
+ * This is a best-effort, TOCTOU-susceptible check: a hostname can resolve to a
+ * different address between validation and the actual request (DNS rebinding).
+ * Callers should therefore ALSO disable redirect-following on the request so a
+ * validated public host cannot 3xx-redirect the server to an internal target.
+ */
+export default class SSRFProtection {
+  /*
+   * Returns the bare, lowercased host of a URL — no port, no brackets — or an
+   * empty string if it cannot be parsed. Host-pinning allowlists (Slack, Teams)
+   * must compare against THIS, never against the whole URL string: a substring
+   * check on the full URL is satisfied by an attacker-controlled path or query
+   * (`http://169.254.169.254/?x=office.com`) and pins nothing.
+   */
+  public static getBareHostname(rawUrl: string | URL): string {
+    let parsed: URL;
+    try {
+      parsed = URL.fromString(rawUrl.toString());
+    } catch {
+      return "";
+    }
+
+    return SSRFProtection.extractHost(parsed.hostname.hostname.toLowerCase());
+  }
+
+  /*
+   * True when the URL's host is exactly one of `allowedDomains` or a subdomain
+   * of one, and the scheme is https. Suffix matching is anchored on a leading
+   * dot so `office.com.attacker.tld` and `evil-office.com` are both rejected.
+   */
+  public static isUrlOnAllowedDomain(
+    rawUrl: string | URL,
+    allowedDomains: Array<string>,
+  ): boolean {
+    let parsed: URL;
+    try {
+      parsed = URL.fromString(rawUrl.toString());
+    } catch {
+      return false;
+    }
+
+    if (parsed.protocol.toString().toLowerCase() !== "https://") {
+      return false;
+    }
+
+    const hostname: string = SSRFProtection.getBareHostname(rawUrl);
+
+    if (!hostname) {
+      return false;
+    }
+
+    return allowedDomains.some((domain: string) => {
+      const allowed: string = domain.toLowerCase();
+      return hostname === allowed || hostname.endsWith(`.${allowed}`);
+    });
+  }
+
+  public static async validateWebhookTargetIsSafe(
+    rawUrl: string | URL,
+  ): Promise<void> {
+    let parsed: URL;
+    try {
+      parsed = URL.fromString(rawUrl.toString());
+    } catch {
+      throw new BadDataException("Webhook URL is not a valid URL");
+    }
+
+    const protocolValue: string = parsed.protocol.toString().toLowerCase();
+    if (protocolValue !== "http://" && protocolValue !== "https://") {
+      throw new BadDataException(
+        "Webhook URL must use http or https protocol.",
+      );
+    }
+
+    const rawHost: string = parsed.hostname.hostname.toLowerCase();
+
+    if (!rawHost) {
+      throw new BadDataException("Webhook URL must include a host.");
+    }
+
+    /*
+     * OneUptime's URL parser keeps the port glued to the host (e.g.
+     * "169.254.169.254:80"). Strip it before the checks below, otherwise a
+     * literal-with-port slips past the IPv4 blocklist and, because it contains
+     * a ":", is mistaken for an IP literal and skips DNS resolution entirely.
+     */
+    const hostname: string = SSRFProtection.extractHost(rawHost);
+
+    if (!hostname) {
+      throw new BadDataException("Webhook URL must include a host.");
+    }
+
+    if (SSRFProtection.isBlockedHostnameLiteral(hostname)) {
+      throw new BadDataException(
+        "Webhook URL points to a private, loopback, or link-local address and is not allowed.",
+      );
+    }
+
+    if (!SSRFProtection.isIpLiteral(hostname)) {
+      let resolved: Array<{ address: string }> = [];
+      try {
+        resolved = await dns.promises.lookup(hostname, { all: true });
+      } catch {
+        throw new BadDataException(
+          "Webhook URL hostname could not be resolved via DNS.",
+        );
+      }
+
+      for (const entry of resolved) {
+        if (
+          SSRFProtection.isBlockedHostnameLiteral(entry.address.toLowerCase())
+        ) {
+          throw new BadDataException(
+            "Webhook URL resolves to a private, loopback, or link-local address and is not allowed.",
+          );
+        }
+      }
+    }
+  }
+
+  /*
+   * Extracts the bare host (IPv4, IPv6, or hostname) from a "host[:port]"
+   * string, handling bracketed IPv6 (`[::1]`, `[::1]:8080`) and unbracketed
+   * IPv6 literals (which contain multiple colons and carry no port).
+   */
+  private static extractHost(hostWithPort: string): string {
+    const host: string = hostWithPort.trim();
+
+    if (host.startsWith("[")) {
+      const closingBracketIndex: number = host.indexOf("]");
+      if (closingBracketIndex !== -1) {
+        return host.slice(1, closingBracketIndex);
+      }
+      return host.replace(/^\[|\]$/g, "");
+    }
+
+    const colonCount: number = (host.match(/:/g) || []).length;
+
+    if (colonCount > 1) {
+      // Unbracketed IPv6 literal — colons are part of the address, not a port.
+      return host;
+    }
+
+    if (colonCount === 1) {
+      // host:port — keep only the host part.
+      return host.split(":")[0] || "";
+    }
+
+    return host;
+  }
+
+  private static isIpLiteral(hostname: string): boolean {
+    return IPV4_LITERAL_REGEX.test(hostname) || hostname.includes(":");
+  }
+
+  private static isBlockedHostnameLiteral(hostname: string): boolean {
+    if (
+      hostname === "localhost" ||
+      hostname.endsWith(".localhost") ||
+      hostname === "metadata.google.internal"
+    ) {
+      return true;
+    }
+
+    const ipv4Match: RegExpMatchArray | null = hostname.match(
+      /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
+    );
+    if (ipv4Match) {
+      const octets: Array<number> = [
+        Number(ipv4Match[1]),
+        Number(ipv4Match[2]),
+        Number(ipv4Match[3]),
+        Number(ipv4Match[4]),
+      ];
+
+      if (
+        octets.some((o: number) => {
+          return o < 0 || o > 255;
+        })
+      ) {
+        return true;
+      }
+      if (octets[0] === 0) {
+        return true;
+      }
+      if (octets[0] === 127) {
+        return true;
+      }
+      if (octets[0] === 10) {
+        return true;
+      }
+      if (octets[0] === 172 && (octets[1]! & 0xf0) === 16) {
+        return true;
+      }
+      if (octets[0] === 192 && octets[1] === 168) {
+        return true;
+      }
+      if (octets[0] === 169 && octets[1] === 254) {
+        return true;
+      }
+      if (octets[0] === 100 && (octets[1]! & 0xc0) === 64) {
+        return true;
+      }
+      return false;
+    }
+
+    if (hostname.includes(":")) {
+      const stripped: string = hostname.replace(/^\[|\]$/g, "");
+      if (stripped === "::1" || stripped === "::") {
+        return true;
+      }
+      if (stripped.startsWith("fe80:") || stripped.startsWith("fe80::")) {
+        return true;
+      }
+      if (IPV6_UNIQUE_LOCAL_REGEX.test(stripped)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+}

package/Server/Utils/StartServer.ts

@@ -34,6 +34,7 @@ import "./Process";
 import Response from "./Response";
 import SpanUtil from "./Telemetry/SpanUtil";
 import TelemetryContext from "./Telemetry/TelemetryContext";
+import mountVendorAssets from "./VendorAssets";
 import { api } from "@opentelemetry/sdk-node";
 import StatusCode from "../../Types/API/StatusCode";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
@@ -303,6 +304,13 @@ const init: InitFunction = async (
     statusOptions: data.statusOptions,
   });
 
+  /*
+   * Ahead of the frontend static mounts and every catch-all below them, so a
+   * service that answers "/*" with its index page cannot swallow a request for
+   * a stylesheet.
+   */
+  mountVendorAssets(app);
+
   if (isFrontendApp) {
     app.use(ExpressStatic("/usr/src/app/public"));
 

package/Server/Utils/StatusPageSubscriberWebhook.ts

@@ -4,6 +4,7 @@ import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../Types/API/HTTPResponse";
 import { JSONObject } from "../../Types/JSON";
 import logger from "./Logger";
+import SSRFProtection from "./SSRFProtection";
 
 export interface StatusPageWebhookPayload extends JSONObject {
   eventType: string;
@@ -21,6 +22,30 @@ export default class StatusPageSubscriberWebhookUtil {
   }): Promise<HTTPResponse<JSONObject> | HTTPErrorResponse> {
     logger.debug("Sending status page subscriber webhook notification.");
 
+    /*
+     * The subscriber webhook target is attacker-controllable: any unauthenticated
+     * visitor can register a subscriber with an arbitrary webhook URL on a public
+     * status page. Validate it against the SSRF blocklist before every send (not
+     * just at create time) so previously-stored URLs and DNS-rebinding cannot make
+     * the server reach internal services or the cloud metadata endpoint.
+     */
+    try {
+      await SSRFProtection.validateWebhookTargetIsSafe(data.webhookUrl);
+    } catch (err) {
+      logger.warn(
+        "Refusing to send status page subscriber webhook: unsafe URL.",
+      );
+      logger.warn(err);
+      return new HTTPErrorResponse(
+        400,
+        {
+          message:
+            err instanceof Error ? err.message : "Webhook URL is not allowed.",
+        },
+        {},
+      );
+    }
+
     const apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse =
       await API.post({
         url: data.webhookUrl,
@@ -28,6 +53,11 @@ export default class StatusPageSubscriberWebhookUtil {
         options: {
           retries: 3,
           exponentialBackoff: true,
+          /*
+           * Do not follow redirects: a validated public host could otherwise
+           * 3xx-redirect the server to an internal address, bypassing the check.
+           */
+          doNotFollowRedirects: true,
         },
       });
 

package/Server/Utils/Telemetry/CaptureSpan.ts

@@ -38,35 +38,47 @@ function CaptureSpan(data?: {
       data?.name || `${className}.${propertyKey}`;
 
     descriptor.value = function (...args: any[]) {
-      if (DisableTelemetry) {
+      /*
+       * Skip the span machinery entirely when telemetry is disabled OR no
+       * span exporter is installed. Without an exporter the span is never
+       * shipped anywhere, but creating it still costs attribute flattening,
+       * a span allocation, and an AsyncLocalStorage context transition —
+       * decorated methods sit on ingest hot paths that run millions of
+       * times per minute, so this must be a plain method call there.
+       */
+      if (DisableTelemetry || !Telemetry.isSpanExportEnabled()) {
         return originalMethod.apply(this, args);
       }
 
-      let functionArguments: JSONObject = {};
+      /*
+       * Only pay for attribute flattening when there is something to
+       * flatten — the overwhelmingly common bare @CaptureSpan() form has
+       * neither captured arguments nor static attributes.
+       */
+      let spanAttributes: { [key: string]: any } | undefined = undefined;
 
-      if (data?.captureArguments) {
-        functionArguments = args.reduce(
-          (acc: { [key: string]: any }, arg: any, index: number) => {
-            acc[`arg${index}`] = arg;
-            return acc;
-          },
-          {},
-        );
-      }
+      if (data?.captureArguments || data?.attributes) {
+        let functionArguments: JSONObject = {};
+
+        if (data?.captureArguments) {
+          functionArguments = args.reduce(
+            (acc: { [key: string]: any }, arg: any, index: number) => {
+              acc[`arg${index}`] = arg;
+              return acc;
+            },
+            {},
+          );
+        }
 
-      const spanAttributes: { [key: string]: any } =
-        JSONFunctions.flattenObject({
+        spanAttributes = JSONFunctions.flattenObject({
           ...functionArguments,
           ...data?.attributes,
         }) as { [key: string]: any };
+      }
 
       return Telemetry.startActiveSpan({
         name: name,
-        options: {
-          attributes: {
-            ...spanAttributes,
-          },
-        },
+        options: spanAttributes ? { attributes: spanAttributes } : {},
         fn: (span: Span) => {
           let result: any = null;
           try {

package/Server/Utils/Telemetry/IngestionTimestamp.ts

@@ -0,0 +1,75 @@
+import OneUptimeDate from "../../../Types/Date";
+
+/*
+ * Per-second memo for the wall-clock stamps every ingested telemetry row
+ * carries (createdAt and retentionDate, both stored with second
+ * granularity).
+ *
+ * The Otel logs / traces / metrics row builders used to derive these per
+ * row: a current-Date allocation, a ClickHouse DateTime format, a
+ * moment-based add-days, and a second format — for every log record, span,
+ * and metric datapoint. All of that output only changes once per second
+ * (createdAt has no sub-second component) and once per distinct retention
+ * window, so a burst of rows in the same second re-derived identical
+ * strings millions of times. This memo pays the derivation once per second
+ * (and once per retention window within that second) instead.
+ *
+ * Not thread-shared state to worry about: workers are single-threaded, and
+ * the memo is replaced wholesale when the second rolls over, so the map of
+ * retention strings can never grow past the number of distinct retention
+ * windows seen within one second.
+ */
+
+export interface IngestionStamp {
+  /** Current time truncated to the second the stamp was minted. */
+  date: Date;
+  /** ClickHouse DateTime string ("YYYY-MM-DD HH:mm:ss", UTC) of `date`. */
+  db: string;
+}
+
+type CachedStamp = IngestionStamp & {
+  epochSecond: number;
+  retentionDbByDays: Map<number, string>;
+};
+
+let cachedStamp: CachedStamp | null = null;
+
+export function getIngestionStamp(): IngestionStamp {
+  const epochSecond: number = Math.floor(Date.now() / 1000);
+
+  if (!cachedStamp || cachedStamp.epochSecond !== epochSecond) {
+    const date: Date = new Date(epochSecond * 1000);
+    cachedStamp = {
+      epochSecond: epochSecond,
+      date: date,
+      db: OneUptimeDate.toClickhouseDateTime(date),
+      retentionDbByDays: new Map<number, string>(),
+    };
+  }
+
+  return cachedStamp;
+}
+
+/*
+ * ClickHouse DateTime string for `stamp.date + retentionDays`, memoized per
+ * (stamp second, retention window). Must be called with a stamp obtained
+ * from getIngestionStamp() in the same row-building pass, so the retention
+ * date stays consistent with the row's createdAt.
+ */
+export function getRetentionDateDb(
+  stamp: IngestionStamp,
+  retentionDays: number,
+): string {
+  const cached: CachedStamp = stamp as CachedStamp;
+
+  let db: string | undefined = cached.retentionDbByDays?.get(retentionDays);
+
+  if (db === undefined) {
+    db = OneUptimeDate.toClickhouseDateTime(
+      OneUptimeDate.addRemoveDays(stamp.date, retentionDays),
+    );
+    cached.retentionDbByDays?.set(retentionDays, db);
+  }
+
+  return db;
+}