@oneuptime/common 12.0.5 → 12.0.7

package/Tests/Server/Utils/VM/VMRunnerSsrf.test.ts

@@ -0,0 +1,194 @@
+import VMRunner from "../../../../Server/Utils/VM/VMRunner";
+import ReturnResult from "../../../../Types/IsolatedVM/ReturnResult";
+import { describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * GHSA-v5xh-rw9h-77fv fixed the API workflow components, but the Custom
+ * JavaScript component hands user-authored code the HOST process's axios
+ * (VMRunner bridges it into the isolate as `_axiosRef`), and the component docs
+ * say "you can use axios module". That is the same SSRF with more capability:
+ * arbitrary method, headers and body, with the response marshalled back to the
+ * author. Guarding only the API components would have been theatre.
+ *
+ * These tests drive the REAL isolate, so they prove the guard from the position
+ * an attacker actually occupies - inside the sandbox - rather than by calling a
+ * helper directly. Nothing here needs a network: every assertion is that the
+ * request was refused before a socket was opened.
+ */
+
+jest.setTimeout(60000);
+
+async function runInSandbox(code: string): Promise<ReturnResult> {
+  return VMRunner.runCodeInSandbox({
+    code,
+    options: { timeout: 15000 },
+  });
+}
+
+/*
+ * The sandbox surfaces a rejected request as a thrown error. Either the promise
+ * rejects or the returned result carries the message - accept both, and assert
+ * on the SSRF wording so a mere "connection refused" cannot pass for a block.
+ */
+async function errorFromSandbox(code: string): Promise<string> {
+  try {
+    const result: ReturnResult = await runInSandbox(code);
+    return JSON.stringify(result.returnValue ?? result.logMessages ?? "");
+  } catch (err) {
+    return (err as Error).message || String(err);
+  }
+}
+
+const REFUSAL: RegExp =
+  /not allowed|private, loopback, or link-local|absolute http|could not be resolved/i;
+
+describe("VMRunner sandbox axios bridge — SSRF guard", () => {
+  const internalTargets: Array<[string, string]> = [
+    ["AWS metadata endpoint", "http://169.254.169.254/latest/meta-data/"],
+    [
+      "AWS metadata credentials path",
+      "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
+    ],
+    ["GCP metadata by name", "http://metadata.google.internal/"],
+    ["loopback", "http://127.0.0.1:8080/"],
+    ["localhost", "http://localhost:9200/_cluster/health"],
+    ["RFC-1918", "http://10.0.0.5/internal"],
+    ["IPv6 loopback", "http://[::1]:5432/"],
+    ["IPv4-mapped metadata endpoint", "http://[::ffff:169.254.169.254]/"],
+  ];
+
+  test.each(internalTargets)(
+    "refuses axios.get to the %s",
+    async (_label: string, url: string) => {
+      const message: string = await errorFromSandbox(
+        `return await axios.get(${JSON.stringify(url)});`,
+      );
+      expect(message).toMatch(REFUSAL);
+    },
+  );
+
+  test.each(internalTargets)(
+    "refuses axios.post to the %s",
+    async (_label: string, url: string) => {
+      const message: string = await errorFromSandbox(
+        `return await axios.post(${JSON.stringify(url)}, { a: 1 });`,
+      );
+      expect(message).toMatch(REFUSAL);
+    },
+  );
+
+  test("refuses axios.request, where the URL lives in the config", async () => {
+    const message: string = await errorFromSandbox(
+      `return await axios.request({ method: 'get', url: 'http://169.254.169.254/latest/meta-data/' });`,
+    );
+    expect(message).toMatch(REFUSAL);
+  });
+
+  test("refuses a target assembled from baseURL and a relative path", async () => {
+    // The positional url is harmless on its own; baseURL is where it goes.
+    const message: string = await errorFromSandbox(
+      `return await axios.get('/latest/meta-data/', { baseURL: 'http://169.254.169.254' });`,
+    );
+    expect(message).toMatch(REFUSAL);
+  });
+
+  test("refuses a baseURL-only request()", async () => {
+    const message: string = await errorFromSandbox(
+      `return await axios.request({ method: 'get', baseURL: 'http://127.0.0.1:8080', url: '/admin' });`,
+    );
+    expect(message).toMatch(REFUSAL);
+  });
+
+  test.each(["head", "options", "put", "patch", "delete"])(
+    "refuses axios.%s to an internal address",
+    async (method: string) => {
+      const call: string =
+        method === "put" || method === "patch"
+          ? `axios.${method}('http://169.254.169.254/', {})`
+          : `axios.${method}('http://169.254.169.254/')`;
+      const message: string = await errorFromSandbox(`return await ${call};`);
+      expect(message).toMatch(REFUSAL);
+    },
+  );
+
+  test("refuses a non-http scheme", async () => {
+    const message: string = await errorFromSandbox(
+      `return await axios.get('file:///etc/passwd');`,
+    );
+    expect(message).toMatch(REFUSAL);
+  });
+
+  test("refuses a relative URL with no baseURL rather than guessing", async () => {
+    const message: string = await errorFromSandbox(
+      `return await axios.get('/latest/meta-data/');`,
+    );
+    expect(message).toMatch(REFUSAL);
+  });
+
+  /*
+   * A proxy or a unix socket steers the connection somewhere the validated URL
+   * never named — /var/run/docker.sock being the memorable one — so the guard
+   * strips them rather than trusting the URL alone.
+   */
+  test("a proxy in the config cannot steer a public URL at an internal host", async () => {
+    /*
+     * A public IP literal (no DNS) with a 1ms timeout, so this settles offline
+     * and instantly. The point is only that the metadata endpoint named in
+     * `proxy` is never what gets dialled.
+     */
+    const message: string = await errorFromSandbox(
+      `try { return await axios.get('http://8.8.8.8/', { timeout: 1, proxy: { host: '169.254.169.254', port: 80 } }); } catch (e) { return 'threw: ' + e.message; }`,
+    );
+    expect(message).not.toMatch(/169\.254\.169\.254/);
+  });
+
+  test("still lets an ordinary public URL past the guard", async () => {
+    /*
+     * 8.8.8.8 is never actually reached - the 1ms timeout sees to that. The
+     * assertion is that the failure is a TRANSPORT failure, not the SSRF guard,
+     * i.e. the block above is not simply refusing everything.
+     */
+    const message: string = await errorFromSandbox(
+      `try { return await axios.get('http://8.8.8.8/', { timeout: 1 }); } catch (e) { return 'threw: ' + e.message; }`,
+    );
+    expect(message).not.toMatch(REFUSAL);
+  });
+});
+
+/*
+ * The "is this already an absolute URL?" decision is what tells the guard
+ * whether to fold in baseURL before validating, so it has to be scheme
+ * case-insensitive and slash-tolerant — otherwise HTTP:// (uppercase) or a
+ * baseURL with stray slashes could be mis-classified and skip the check.
+ */
+describe("VMRunner sandbox axios bridge — URL absolutization", () => {
+  test("an uppercase scheme is still recognised as absolute and its host checked", async () => {
+    // HTTP:// (uppercase) must not slip past the loopback block.
+    const message: string = await errorFromSandbox(
+      `return await axios.get('HTTP://127.0.0.1:8080/admin');`,
+    );
+    expect(message).toMatch(REFUSAL);
+  });
+
+  test("a mixed-case scheme on a public host passes the guard, failing only at transport", async () => {
+    const message: string = await errorFromSandbox(
+      `try { return await axios.get('HtTpS://8.8.8.8/', { timeout: 1 }); } catch (e) { return 'threw: ' + e.message; }`,
+    );
+    expect(message).not.toMatch(REFUSAL);
+  });
+
+  test("stray slashes joining baseURL and a relative path do not evade the block", async () => {
+    // baseURL trailing slashes + a leading-slash relative path, internal host.
+    const message: string = await errorFromSandbox(
+      `return await axios.get('//latest/meta-data/', { baseURL: 'http://169.254.169.254//' });`,
+    );
+    expect(message).toMatch(REFUSAL);
+  });
+
+  test("a baseURL + relative path resolving to a public host clears the guard", async () => {
+    const message: string = await errorFromSandbox(
+      `try { return await axios.get('/path', { baseURL: 'http://8.8.8.8', timeout: 1 }); } catch (e) { return 'threw: ' + e.message; }`,
+    );
+    expect(message).not.toMatch(REFUSAL);
+  });
+});

package/Tests/Server/Utils/VendorAssetIntegrity.test.ts

@@ -0,0 +1,343 @@
+import { afterAll, describe, expect, test } from "@jest/globals";
+import fs from "fs";
+import path from "path";
+import {
+  VendorAssetsPath,
+  getMermaidDistPath,
+} from "../../../Server/Utils/VendorAssets";
+
+/*
+ * The vendored files are third-party build output that a human refreshes by
+ * hand (see Common/Server/Static/Vendor/README.md). Serving them with a 200 is
+ * not the same as them working: a highlight.js grammar compiled against a
+ * different core throws on registration, and a mermaid chunk the static mount
+ * declines to serve is a diagram that never appears. Neither failure shows up
+ * in a status code, and both are exactly what a careless refresh produces.
+ *
+ * So these tests execute the code and walk the module graph rather than
+ * stat-ing files.
+ */
+
+const HIGHLIGHT_PATH: string = path.join(VendorAssetsPath, "highlight");
+const LANGUAGES_PATH: string = path.join(HIGHLIGHT_PATH, "languages");
+
+/* /*! Highlight.js v11.11.1 (git: ...) */
+const CORE_VERSION_PATTERN: RegExp = /Highlight\.js v([0-9]+\.[0-9]+\.[0-9]+)/;
+
+/* /*! `python` grammar compiled for Highlight.js 11.11.1 */
+const GRAMMAR_HEADER_PATTERN: RegExp =
+  /`([a-z0-9-]+)` grammar compiled for Highlight\.js ([0-9]+\.[0-9]+\.[0-9]+)/;
+
+function grammarFiles(): Array<string> {
+  return fs.readdirSync(LANGUAGES_PATH).sort();
+}
+
+function readGrammar(file: string): string {
+  return fs.readFileSync(path.join(LANGUAGES_PATH, file), "utf8");
+}
+
+describe("vendored highlight.js", () => {
+  const core: string = fs.readFileSync(
+    path.join(HIGHLIGHT_PATH, "highlight.min.js"),
+    "utf8",
+  );
+
+  const coreVersion: string = (core.match(CORE_VERSION_PATTERN) || [])[1] || "";
+
+  test("the core bundle declares a version", () => {
+    expect(coreVersion).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+
+  test("every grammar was compiled against that exact core", () => {
+    /*
+     * highlight.js grammars are compiled against a specific core API. Mixing
+     * versions throws at registerLanguage, which takes out highlighting for the
+     * whole page - not just the one language. Refreshing the core without
+     * refreshing the grammars beside it is the obvious way to get there, and
+     * the version is right there in each file's banner.
+     */
+    const mismatched: Array<string> = [];
+
+    for (const file of grammarFiles()) {
+      const header: RegExpMatchArray | null = readGrammar(file).match(
+        GRAMMAR_HEADER_PATTERN,
+      );
+
+      if (!header) {
+        mismatched.push(`${file}: no version banner`);
+        continue;
+      }
+
+      if (header[2] !== coreVersion) {
+        mismatched.push(`${file}: ${header[2]} != core ${coreVersion}`);
+      }
+    }
+
+    expect(mismatched).toEqual([]);
+  });
+
+  test("every grammar file is named after the language it registers", () => {
+    /*
+     * The views build the URL from the langMap value - `.../languages/` + lang
+     * + `.min.js` - so a file whose name and grammar disagree is a request that
+     * 404s for one language while a different one sits there unreachable.
+     */
+    const misnamed: Array<string> = [];
+
+    for (const file of grammarFiles()) {
+      const contents: string = readGrammar(file);
+      const header: RegExpMatchArray | null = contents.match(
+        GRAMMAR_HEADER_PATTERN,
+      );
+      const registered: RegExpMatchArray | null = contents.match(
+        /registerLanguage\("([a-z0-9-]+)"/,
+      );
+
+      const expectedName: string = file.replace(/\.min\.js$/, "");
+
+      if (header && header[1] !== expectedName) {
+        misnamed.push(`${file}: banner says ${header[1]}`);
+      }
+
+      if (registered && registered[1] !== expectedName) {
+        misnamed.push(`${file}: registers ${registered[1]}`);
+      }
+    }
+
+    expect(misnamed).toEqual([]);
+  });
+
+  describe("actually running it", () => {
+    /*
+     * Common's Jest environment is jsdom, so the browser bundle can be
+     * evaluated as-is. Indirect eval puts `var hljs` on the global the way a
+     * <script> tag would; a direct eval would scope it to this function and the
+     * grammar files, which reach for the global, would throw.
+     */
+    const indirectEval: (source: string) => unknown = eval;
+
+    interface HighlightResult {
+      value: string;
+    }
+
+    interface HighlightJs {
+      highlight: (
+        code: string,
+        options: { language: string },
+      ) => HighlightResult;
+      listLanguages: () => Array<string>;
+      versionString: string;
+    }
+
+    indirectEval(core);
+
+    const hljs: HighlightJs = (globalThis as unknown as { hljs: HighlightJs })
+      .hljs;
+
+    afterAll(() => {
+      delete (globalThis as unknown as { hljs?: HighlightJs }).hljs;
+    });
+
+    test("the bundle evaluates and exposes the global the views call", () => {
+      expect(typeof hljs).toBe("object");
+      expect(typeof hljs.highlight).toBe("function");
+      expect(hljs.versionString).toBe(coreVersion);
+    });
+
+    test("every grammar registers without throwing, and highlights", () => {
+      /*
+       * A truncated or half-downloaded grammar - the realistic outcome of a
+       * refresh script that lost its network partway - parses as JavaScript
+       * often enough to pass a byte-count check and still fail here.
+       */
+      const broken: Array<string> = [];
+
+      for (const file of grammarFiles()) {
+        const language: string = file.replace(/\.min\.js$/, "");
+
+        try {
+          indirectEval(readGrammar(file));
+        } catch (error) {
+          broken.push(`${language}: registration threw - ${String(error)}`);
+          continue;
+        }
+
+        if (!hljs.listLanguages().includes(language)) {
+          broken.push(`${language}: did not appear in listLanguages()`);
+        }
+      }
+
+      expect(broken).toEqual([]);
+    });
+
+    test("highlights the languages the API reference loads eagerly", () => {
+      const samples: Array<[string, string]> = [
+        ["python", "def hello(name):\n    return f'hi {name}'"],
+        ["json", '{"id": 1, "name": "oneuptime"}'],
+        ["bash", 'if [ -f oneuptime.env ]; then echo "found"; fi'],
+        ["typescript", "const a: number = 1;"],
+        ["go", 'package main\nfunc main() { println("hi") }'],
+      ];
+
+      for (const [language, code] of samples) {
+        const highlighted: string = hljs.highlight(code, { language }).value;
+
+        expect([language, highlighted.includes("<span class=")]).toEqual([
+          language,
+          true,
+        ]);
+      }
+    });
+  });
+});
+
+describe("vendored mermaid", () => {
+  const mermaidDistPath: string | null = getMermaidDistPath();
+
+  /*
+   * Only .js and .mjs are served (VendorAssets.ts). mermaid's ES entrypoint is
+   * 26 KB of imports pointing at everything else it can draw, so "the
+   * entrypoint is served" says nothing about whether a diagram renders. If a
+   * release ever code-splits across an extension the filter declines, the docs
+   * page silently loses its diagrams.
+   */
+  const SERVABLE_EXTENSIONS: Array<string> = [".js", ".mjs"];
+
+  /*
+   * The `\(?` matters more than it looks. mermaid loads every diagram type
+   * through a dynamic import() - `import("./chunks/.../flowDiagram-X.mjs")` -
+   * and a pattern that only caught static `from "..."` sees 15 modules where
+   * the real graph is 47. Those dynamic ones ARE the diagrams; missing them
+   * would have left this test green while the docs page rendered nothing.
+   */
+  const IMPORT_SPECIFIER: RegExp =
+    /(?:from|import)\s*\(?\s*["'](\.[^"']+)["']/g;
+
+  function importsOf(file: string): Array<string> {
+    const specifiers: Array<string> = [];
+
+    for (const match of fs
+      .readFileSync(file, "utf8")
+      .matchAll(IMPORT_SPECIFIER)) {
+      if (match[1]) {
+        specifiers.push(match[1]);
+      }
+    }
+
+    return specifiers;
+  }
+
+  test("resolves out of node_modules", () => {
+    expect(mermaidDistPath).not.toBeNull();
+  });
+
+  test("the ES entrypoint the docs import exists and has imports to check", () => {
+    const entrypoint: string = path.join(
+      mermaidDistPath as string,
+      "mermaid.esm.min.mjs",
+    );
+
+    expect(fs.existsSync(entrypoint)).toBe(true);
+    expect(importsOf(entrypoint).length).toBeGreaterThan(5);
+  });
+
+  test("every module it reaches is on disk and has a servable extension", () => {
+    /*
+     * Walks the graph rather than checking the entrypoint's direct imports:
+     * mermaid's chunks import each other, and a blocked extension two levels
+     * down fails just as completely as one at the top.
+     */
+    const entrypoint: string = path.join(
+      mermaidDistPath as string,
+      "mermaid.esm.min.mjs",
+    );
+
+    const visited: Set<string> = new Set<string>([entrypoint]);
+    const queue: Array<string> = [entrypoint];
+    const problems: Array<string> = [];
+
+    while (queue.length > 0) {
+      const current: string = queue.shift() as string;
+
+      for (const specifier of importsOf(current)) {
+        const resolved: string = path.resolve(path.dirname(current), specifier);
+
+        const relative: string = path.relative(
+          mermaidDistPath as string,
+          resolved,
+        );
+
+        if (!SERVABLE_EXTENSIONS.includes(path.extname(resolved))) {
+          problems.push(`${relative}: extension is not served`);
+          continue;
+        }
+
+        if (!fs.existsSync(resolved)) {
+          problems.push(`${relative}: does not exist`);
+          continue;
+        }
+
+        if (relative.startsWith("..")) {
+          problems.push(`${relative}: escapes the served directory`);
+          continue;
+        }
+
+        if (!visited.has(resolved)) {
+          visited.add(resolved);
+          queue.push(resolved);
+        }
+      }
+    }
+
+    expect(problems).toEqual([]);
+
+    /*
+     * A floor, not a pin - mermaid's chunking changes between releases. It is
+     * here so that a regex that silently stops matching cannot turn this into
+     * a walk of one file that passes.
+     */
+    expect(visited.size).toBeGreaterThan(50);
+  });
+
+  test("the UMD bundle the blog loads is self-contained and sets a global", () => {
+    /*
+     * The blog appends it as a plain <script> and then calls
+     * window.mermaid.run(). It used to be mermaid 10 from jsdelivr; this is
+     * whatever version Common depends on, so the shape it exposes matters.
+     */
+    const umd: string = path.join(mermaidDistPath as string, "mermaid.min.js");
+
+    expect(fs.existsSync(umd)).toBe(true);
+
+    const contents: string = fs.readFileSync(umd, "utf8");
+
+    expect(contents).toContain("mermaid");
+    /* A UMD build inlines everything - no bare import of a sibling chunk. */
+    expect(importsOf(umd)).toEqual([]);
+  });
+
+  test("is the version Common depends on, not a second copy", () => {
+    const declared: string = (
+      JSON.parse(
+        fs.readFileSync(
+          path.join(path.dirname(mermaidDistPath as string), "package.json"),
+          "utf8",
+        ),
+      ) as { version: string }
+    ).version;
+
+    const commonPackage: { dependencies: Record<string, string> } = JSON.parse(
+      fs.readFileSync(
+        path.resolve(__dirname, "..", "..", "..", "package.json"),
+        "utf8",
+      ),
+    ) as { dependencies: Record<string, string> };
+
+    expect(commonPackage.dependencies["mermaid"]).toBeDefined();
+    expect(declared.split(".")[0]).toBe(
+      (commonPackage.dependencies["mermaid"] as string)
+        .replace(/[^0-9]/, "")
+        .split(".")[0],
+    );
+  });
+});