@oneuptime/common 12.0.5 → 12.0.6

package/Tests/Server/Utils/SSRFProtection.test.ts

@@ -0,0 +1,193 @@
+import SSRFProtection from "../../../Server/Utils/SSRFProtection";
+import URL from "../../../Types/API/URL";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import dns from "dns";
+
+/*
+ * SSRFProtection is the single guard standing between attacker-controlled
+ * webhook URLs (any unauthenticated visitor can register a status page
+ * subscriber webhook) and the server's outbound HTTP client. These tests pin
+ * the blocklist so a regression cannot quietly re-open the path to the cloud
+ * metadata endpoint or internal services. DNS is mocked so the resolution
+ * branch is exercised deterministically and offline.
+ */
+
+/*
+ * dns.promises.lookup is heavily overloaded, so spyOn resolves to the wrong
+ * signature. Pin the one shape this module actually calls ({ all: true }).
+ */
+type LookupSpy = jest.SpiedFunction<
+  (
+    hostname: string,
+    options: { all: true },
+  ) => Promise<Array<{ address: string; family: number }>>
+>;
+
+describe("SSRFProtection.validateWebhookTargetIsSafe", () => {
+  let lookupSpy: LookupSpy;
+
+  beforeEach(() => {
+    lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+    // Default: hostnames resolve to a public address unless a test overrides it.
+    lookupSpy.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("blocks private, loopback, link-local and metadata literals", () => {
+    const blockedUrls: Array<string> = [
+      "http://127.0.0.1/webhook",
+      "http://127.0.0.1:8080/webhook",
+      "http://0.0.0.0/",
+      "http://10.0.0.5/incident",
+      "http://10.255.255.255/x",
+      "http://172.16.0.1/",
+      "http://172.31.255.1/",
+      "http://192.168.1.1/hook",
+      "http://100.64.0.1/",
+      "http://100.127.255.255/",
+      "http://localhost/",
+      "http://localhost:3000/",
+      "http://foo.localhost/",
+      "http://metadata.google.internal/computeMetadata/v1/",
+      "http://[::1]/",
+      "http://[::1]:8080/",
+      "http://[fe80::1]/",
+      "http://[fc00::1]/",
+      "http://[fd12:3456::1]/",
+    ];
+
+    test.each(blockedUrls)("rejects %s", async (url: string) => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(url),
+      ).rejects.toThrow();
+      expect(lookupSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("blocks the cloud metadata endpoint, including port bypass", () => {
+    test("rejects AWS metadata endpoint", async () => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
+        ),
+      ).rejects.toThrow();
+    });
+
+    test("rejects metadata endpoint with an explicit port (bypass attempt)", async () => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          "http://169.254.169.254:80/latest/meta-data/",
+        ),
+      ).rejects.toThrow();
+      // Must be caught as a literal, never treated as a resolvable host.
+      expect(lookupSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("allows public destinations", () => {
+    const allowedUrls: Array<string> = [
+      "http://8.8.8.8/webhook",
+      "https://1.1.1.1/",
+      "http://172.15.0.1/", // just outside the private 172.16-31 range
+      "http://172.32.0.1/",
+      "http://100.63.0.1/", // just below CGNAT 100.64/10
+      "http://100.128.0.1/", // just above CGNAT 100.64/10
+    ];
+
+    test.each(allowedUrls)("allows %s", async (url: string) => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(url),
+      ).resolves.toBeUndefined();
+    });
+
+    test("allows a public hostname (DNS resolves to a public IP)", async () => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          "https://hooks.example.com/webhook",
+        ),
+      ).resolves.toBeUndefined();
+      expect(lookupSpy).toHaveBeenCalledWith("hooks.example.com", {
+        all: true,
+      });
+    });
+
+    test("resolves a hostname even when a port is present", async () => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          "https://hooks.example.com:8443/webhook",
+        ),
+      ).resolves.toBeUndefined();
+      // Port must be stripped so the hostname (not "host:port") is resolved.
+      expect(lookupSpy).toHaveBeenCalledWith("hooks.example.com", {
+        all: true,
+      });
+    });
+
+    test("accepts a URL object as input", async () => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          URL.fromString("http://8.8.8.8/webhook"),
+        ),
+      ).resolves.toBeUndefined();
+    });
+  });
+
+  describe("blocks hostnames that resolve to internal addresses", () => {
+    test("rejects a hostname resolving to a private address (DNS rebinding)", async () => {
+      lookupSpy.mockResolvedValue([{ address: "10.0.0.5", family: 4 }]);
+
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          "https://rebind.attacker.example/",
+        ),
+      ).rejects.toThrow();
+    });
+
+    test("rejects a hostname-with-port resolving to the metadata IP", async () => {
+      lookupSpy.mockResolvedValue([{ address: "169.254.169.254", family: 4 }]);
+
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          "https://rebind.attacker.example:8080/",
+        ),
+      ).rejects.toThrow();
+    });
+
+    test("rejects when DNS resolution fails", async () => {
+      lookupSpy.mockRejectedValue(new Error("ENOTFOUND"));
+
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe(
+          "https://this-does-not-resolve.invalid/",
+        ),
+      ).rejects.toThrow();
+    });
+  });
+
+  describe("rejects unusable URLs", () => {
+    test("rejects a non-http(s) protocol", async () => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe("mongodb://8.8.8.8/"),
+      ).rejects.toThrow("http or https");
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe("ws://8.8.8.8/"),
+      ).rejects.toThrow("http or https");
+    });
+
+    test("rejects a URL with no host", async () => {
+      await expect(
+        SSRFProtection.validateWebhookTargetIsSafe("http:///no-host"),
+      ).rejects.toThrow();
+    });
+  });
+});

package/Tests/Server/Utils/StatusPageSubscriberWebhook.test.ts

@@ -0,0 +1,101 @@
+import StatusPageSubscriberWebhookUtil, {
+  StatusPageWebhookPayload,
+} from "../../../Server/Utils/StatusPageSubscriberWebhook";
+import API from "../../../Utils/API";
+import HTTPErrorResponse from "../../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../../Types/API/HTTPResponse";
+import URL from "../../../Types/API/URL";
+import { JSONObject } from "../../../Types/JSON";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import dns from "dns";
+
+/*
+ * Status page subscribers can be created by unauthenticated visitors, so the
+ * stored webhook URL is attacker-controlled. These tests pin the two
+ * properties that keep that from becoming SSRF: the send site refuses to issue
+ * the request at all for internal targets, and when it does send, it does not
+ * follow redirects (which would otherwise let a public host bounce the server
+ * to an internal address after validation passed).
+ */
+
+describe("StatusPageSubscriberWebhookUtil.sendWebhookNotification", () => {
+  let postSpy: jest.SpiedFunction<typeof API.post>;
+
+  const payload: StatusPageWebhookPayload = {
+    eventType: "IncidentCreated",
+    statusPageId: "status-page-id",
+    statusPageName: "Status Page",
+    statusPageUrl: "https://status.example.com",
+    unsubscribeUrl: "https://status.example.com/unsubscribe",
+    data: {},
+  };
+
+  beforeEach(() => {
+    jest
+      .spyOn(dns.promises, "lookup")
+      .mockResolvedValue([{ address: "93.184.216.34", family: 4 }] as never);
+
+    postSpy = jest
+      .spyOn(API, "post")
+      .mockResolvedValue(
+        new HTTPResponse<JSONObject>(200, {}, {}) as never,
+      ) as unknown as jest.SpiedFunction<typeof API.post>;
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("does not send to the cloud metadata endpoint", async () => {
+    const result: HTTPResponse<JSONObject> | HTTPErrorResponse =
+      await StatusPageSubscriberWebhookUtil.sendWebhookNotification({
+        webhookUrl: URL.fromString(
+          "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
+        ),
+        payload,
+      });
+
+    expect(postSpy).not.toHaveBeenCalled();
+    expect(result).toBeInstanceOf(HTTPErrorResponse);
+  });
+
+  test("does not send to a loopback or private address", async () => {
+    for (const unsafeUrl of [
+      "http://127.0.0.1:9200/",
+      "http://10.0.0.5/internal",
+      "http://localhost/admin",
+    ]) {
+      const result: HTTPResponse<JSONObject> | HTTPErrorResponse =
+        await StatusPageSubscriberWebhookUtil.sendWebhookNotification({
+          webhookUrl: URL.fromString(unsafeUrl),
+          payload,
+        });
+
+      expect(result).toBeInstanceOf(HTTPErrorResponse);
+    }
+
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test("sends to a public target without following redirects", async () => {
+    await StatusPageSubscriberWebhookUtil.sendWebhookNotification({
+      webhookUrl: URL.fromString("https://hooks.example.com/webhook"),
+      payload,
+    });
+
+    expect(postSpy).toHaveBeenCalledTimes(1);
+
+    const callArg: { options?: { doNotFollowRedirects?: boolean } } = postSpy
+      .mock.calls[0]![0] as {
+      options?: { doNotFollowRedirects?: boolean };
+    };
+    expect(callArg.options?.doNotFollowRedirects).toBe(true);
+  });
+});

package/Tests/Server/Utils/TailwindBuildCopy.test.ts

@@ -0,0 +1,225 @@
+import { afterAll, describe, expect, test } from "@jest/globals";
+import childProcess from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { VendorAssetsPath } from "../../../Server/Utils/VendorAssets";
+
+/*
+ * The five frontends no longer commit their own copy of Tailwind; the esbuild
+ * build copies the one under Common/Server/Static/Vendor into each
+ * public/assets/js. Their index.ejs is unchanged, so if that copy silently
+ * stops happening nothing fails loudly - the dashboard, accounts, admin, status
+ * page and public dashboard all just render unstyled, in production, with a 404
+ * in the console.
+ *
+ * So the real copyTailwindAsset runs here, against real directories, rather
+ * than the test reading the build script and hoping.
+ *
+ * It runs in a node subprocess because requiring esbuild-config.js pulls in
+ * esbuild, which refuses to load under jsdom (jsdom's TextEncoder does not
+ * produce a real Uint8Array and esbuild asserts on that). A `@jest-environment
+ * node` docblock does not help - Common's shared jest.setup.ts touches
+ * `window`. Spawning node is also how the build itself loads this module, so
+ * this exercises the shipped path rather than an approximation of it.
+ */
+
+const ESBUILD_CONFIG: string = path.resolve(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "UI",
+  "esbuild-config.js",
+);
+
+const CANONICAL: string = path.join(
+  VendorAssetsPath,
+  "tailwind",
+  "tailwind-3.4.5.js",
+);
+
+const REPOSITORY_ROOT: string = path.resolve(__dirname, "..", "..", "..", "..");
+
+const temporaryRoots: Array<string> = [];
+
+function makeOutdir(): string {
+  const root: string = fs.mkdtempSync(
+    path.join(os.tmpdir(), "oneuptime-tailwind-copy-"),
+  );
+
+  temporaryRoots.push(root);
+
+  /*
+   * Mirrors the real layout: esbuild's outdir is <public>/dist, and the copy
+   * lands in <public>/assets/js - a sibling of outdir, not a child.
+   */
+  return path.join(root, "public", "dist");
+}
+
+function copiedPath(outdir: string): string {
+  return path.join(path.dirname(outdir), "assets", "js", "tailwind-3.4.5.js");
+}
+
+type RunCopy = (outdir: string) => { ok: boolean; error: string };
+
+const runCopy: RunCopy = (outdir: string): { ok: boolean; error: string } => {
+  const script: string = `
+    const config = require(${JSON.stringify(ESBUILD_CONFIG)});
+    try {
+      config.copyTailwindAsset(${JSON.stringify(outdir)});
+      console.log(JSON.stringify({ ok: true, error: "" }));
+    } catch (error) {
+      console.log(JSON.stringify({ ok: false, error: String(error && error.message || error) }));
+    }
+  `;
+
+  const stdout: string = childProcess.execFileSync(
+    process.execPath,
+    ["-e", script],
+    { cwd: REPOSITORY_ROOT, encoding: "utf8" },
+  );
+
+  return JSON.parse(stdout.trim()) as { ok: boolean; error: string };
+};
+
+describe("the frontend build's Tailwind copy", () => {
+  afterAll(() => {
+    while (temporaryRoots.length > 0) {
+      fs.rmSync(temporaryRoots.pop() as string, {
+        recursive: true,
+        force: true,
+      });
+    }
+  });
+
+  test("is exported by the build config the frontends load", () => {
+    const exported: string = childProcess
+      .execFileSync(
+        process.execPath,
+        [
+          "-e",
+          `const c = require(${JSON.stringify(ESBUILD_CONFIG)});
+           console.log(JSON.stringify({
+             fn: typeof c.copyTailwindAsset,
+             filename: c.TAILWIND_FILENAME,
+           }));`,
+        ],
+        { cwd: REPOSITORY_ROOT, encoding: "utf8" },
+      )
+      .trim();
+
+    expect(JSON.parse(exported)).toEqual({
+      fn: "function",
+      filename: "tailwind-3.4.5.js",
+    });
+  });
+
+  test("puts the file where index.ejs looks for it", () => {
+    const outdir: string = makeOutdir();
+
+    expect(runCopy(outdir)).toEqual({ ok: true, error: "" });
+    expect(fs.existsSync(copiedPath(outdir))).toBe(true);
+  });
+
+  test("writes the canonical bytes, not a re-encoded copy", () => {
+    const outdir: string = makeOutdir();
+
+    runCopy(outdir);
+
+    expect(
+      fs.readFileSync(copiedPath(outdir)).equals(fs.readFileSync(CANONICAL)),
+    ).toBe(true);
+  });
+
+  test("creates assets/js when the frontend has no such directory yet", () => {
+    /*
+     * A clean checkout has no public/assets/js for some services - the copy has
+     * to create it rather than throw ENOENT and take the whole build down.
+     */
+    const outdir: string = makeOutdir();
+
+    expect(fs.existsSync(path.join(path.dirname(outdir), "assets"))).toBe(
+      false,
+    );
+
+    expect(runCopy(outdir).ok).toBe(true);
+  });
+
+  test("overwrites a stale copy from a previous build", () => {
+    const outdir: string = makeOutdir();
+    const destination: string = copiedPath(outdir);
+
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    fs.writeFileSync(destination, "/* stale */");
+
+    runCopy(outdir);
+
+    expect(
+      fs.readFileSync(destination).equals(fs.readFileSync(CANONICAL)),
+    ).toBe(true);
+  });
+
+  test("lands outside the outdir that build() wipes before every build", () => {
+    /*
+     * build() rm -rf's config.outdir first. assets/js has to be a sibling, not
+     * a child - if it were inside, each service's build would delete the copy
+     * and only the last frontend built would have a stylesheet.
+     */
+    const outdir: string = makeOutdir();
+
+    runCopy(outdir);
+
+    fs.mkdirSync(outdir, { recursive: true });
+    fs.rmSync(outdir, { recursive: true, force: true });
+
+    expect(fs.existsSync(copiedPath(outdir))).toBe(true);
+  });
+
+  test("names the file the same thing every index.ejs asks for", () => {
+    /*
+     * The version lives in the filename, so bumping Tailwind means editing five
+     * views. This is the tripwire for doing one without the other.
+     */
+    const featureSets: string = path.join(REPOSITORY_ROOT, "App", "FeatureSet");
+
+    const services: Array<[string, string]> = [
+      ["Dashboard", "dashboard"],
+      ["Accounts", "accounts"],
+      ["AdminDashboard", "admin"],
+      ["StatusPage", "status-page"],
+      ["PublicDashboard", "public-dashboard"],
+    ];
+
+    for (const [service, routePrefix] of services) {
+      const indexView: string = fs.readFileSync(
+        path.join(featureSets, service, "views", "index.ejs"),
+        "utf8",
+      );
+
+      const expectedUrl: string = `/${routePrefix}/assets/js/tailwind-3.4.5.js`;
+
+      expect([service, indexView.includes(expectedUrl)]).toEqual([
+        service,
+        true,
+      ]);
+    }
+  });
+
+  test("is wired into both build and watch, so no service can miss it", () => {
+    const source: string = fs.readFileSync(ESBUILD_CONFIG, "utf8");
+
+    /*
+     * `npm run build-frontends:prod` in the Dockerfile goes through build(),
+     * the dev watcher through watch(). Wiring only one means it works in
+     * development and 404s in the image, or the reverse.
+     */
+    const inBuild: RegExp =
+      /async function build\([\s\S]*?copyTailwindAsset\(config\.outdir\)/;
+    const inWatch: RegExp =
+      /async function watch\([\s\S]*?copyTailwindAsset\(config\.outdir\)/;
+
+    expect(inBuild.test(source)).toBe(true);
+    expect(inWatch.test(source)).toBe(true);
+  });
+});