@oneuptime/common 12.0.5 → 12.0.7

package/Server/Services/StatusPageDomainService.ts

@@ -1,18 +1,17 @@
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import GreenlockUtil from "../Utils/Greenlock/Greenlock";
 import logger, { LogAttributes } from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import DomainService from "./DomainService";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../Types/API/HTTPResponse";
-import URL from "../../Types/API/URL";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
-import API from "../../Utils/API";
 import AcmeCertificate from "../../Models/DatabaseModels/AcmeCertificate";
 import DomainModel from "../../Models/DatabaseModels/Domain";
 import StatusPageDomain from "../../Models/DatabaseModels/StatusPageDomain";
@@ -22,11 +21,60 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { StatusPageCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
 
+const STATUS_PAGE_DOMAIN_EGRESS_LABEL: string = "Status page domain";
+
 export class Service extends DatabaseService<StatusPageDomain> {
   public constructor() {
     super(StatusPageDomain);
   }
 
+  /*
+   * Normalize a submitted subdomain and reject anything that is not a plain
+   * DNS label chain.
+   *
+   * fullDomain is built as `${subdomain}.${baseDomain}` and then interpolated
+   * into "https://" + fullDomain + "/status-page-api/..." — and URL parsing
+   * treats everything before the first "/" as the host. Without this check a
+   * subdomain of "169.254.169.254/latest/meta-data/#" hands an attacker the
+   * host, the port and the path of a request the certificate cron then makes
+   * unattended, every 15 minutes, from inside the cluster.
+   */
+  private static normalizeAndValidateSubdomain(
+    subdomain: string | undefined,
+  ): string {
+    const normalized: string = subdomain?.trim().toLowerCase() || "";
+
+    // "@" is the documented way to ask for the root domain.
+    if (normalized === "" || normalized === "@") {
+      return "";
+    }
+
+    if (!Domain.isValidSubdomain(normalized)) {
+      throw new BadDataException(
+        `Subdomain ${normalized} is not valid. Use a plain subdomain such as "status" — schemes, ports, paths and "/" are not allowed.`,
+      );
+    }
+
+    return normalized;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<StatusPageDomain>,
+  ): Promise<OnUpdate<StatusPageDomain>> {
+    /*
+     * Create-time validation alone leaves the value editable afterwards —
+     * subdomain is ProjectMember-updatable.
+     */
+    if (updateBy.data.subdomain !== undefined) {
+      updateBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+        updateBy.data.subdomain as string,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<StatusPageDomain>,
@@ -48,14 +96,11 @@ export class Service extends DatabaseService<StatusPageDomain> {
       );
     }
 
-    let normalizedSubdomain: string =
-      createBy.data.subdomain?.trim().toLowerCase() || "";
-
-    if (normalizedSubdomain === "@") {
-      normalizedSubdomain = "";
-    }
+    createBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+      createBy.data.subdomain,
+    );
 
-    createBy.data.subdomain = normalizedSubdomain;
+    const normalizedSubdomain: string = createBy.data.subdomain;
 
     if (domain) {
       const baseDomain: string =
@@ -231,13 +276,13 @@ export class Service extends DatabaseService<StatusPageDomain> {
   ): Promise<boolean> {
     try {
       const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-        await API.get({
-          url: URL.fromString(
+        await Domain.getForDomainVerification({
+          url:
             "https://" +
-              fulldomain +
-              "/status-page-api/cname-verification/" +
-              token,
-          ),
+            fulldomain +
+            "/status-page-api/cname-verification/" +
+            token,
+          targetLabel: STATUS_PAGE_DOMAIN_EGRESS_LABEL,
         });
 
       if (result.isFailure()) {
@@ -320,13 +365,13 @@ export class Service extends DatabaseService<StatusPageDomain> {
 
       try {
         const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "http://" +
-                fullDomain +
-                "/status-page-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/status-page-api/cname-verification/" +
+              token,
+            targetLabel: STATUS_PAGE_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result", {
@@ -353,13 +398,13 @@ export class Service extends DatabaseService<StatusPageDomain> {
 
       try {
         const resultHttps: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "https://" +
-                fullDomain +
-                "/status-page-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/status-page-api/cname-verification/" +
+              token,
+            targetLabel: STATUS_PAGE_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result for https", {

package/Server/Services/StatusPageSubscriberService.ts

@@ -37,6 +37,7 @@ import NumberUtil from "../../Utils/Number";
 import SlackUtil from "../Utils/Workspace/Slack/Slack";
 import MicrosoftTeamsUtil from "../Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
 import StatusPageSubscriberWebhookUtil from "../Utils/StatusPageSubscriberWebhook";
+import SSRFProtection from "../Utils/SSRFProtection";
 import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "./StatusPageSubscriberNotificationTemplateService";
@@ -335,6 +336,18 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * Validate the generic subscriber webhook URL if provided. Subscriber
+     * creation is publicly accessible (Permission.Public), so an unauthenticated
+     * user can supply this URL. Reject targets that point at private, loopback,
+     * link-local, or cloud metadata addresses to prevent SSRF.
+     */
+    if (data.data.subscriberWebhook) {
+      await SSRFProtection.validateWebhookTargetIsSafe(
+        data.data.subscriberWebhook,
+      );
+    }
+
     data.data.subscriptionConfirmationToken = NumberUtil.getRandomNumber(
       100000,
       999999,

package/Server/Services/TeamMemberService.ts

@@ -120,10 +120,40 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       }
     }
 
-    if (!createBy.props.isRoot) {
+    /*
+     * Only internal writes (isRoot) and a master admin acting from the Admin
+     * Dashboard may create a membership that is already accepted - that is the
+     * "accept the invitation automatically" checkbox on the admin invite forms.
+     *
+     * Everyone else invites, and the invited person accepts for themselves. A
+     * project admin who could accept on someone's behalf would be able to pull
+     * an account into their project - and into whatever the team's permissions
+     * grant - without that person ever agreeing to it.
+     */
+    const canCreateAcceptedInvitation: boolean = Boolean(
+      createBy.props.isRoot || createBy.props.isMasterAdmin,
+    );
+
+    if (!canCreateAcceptedInvitation) {
       createBy.data.hasAcceptedInvitation = false;
     }
 
+    const isInvitationAcceptedOnCreate: boolean = Boolean(
+      createBy.data.hasAcceptedInvitation,
+    );
+
+    /*
+     * The acceptance timestamp is stamped here rather than taken from the
+     * request, so it can never disagree with hasAcceptedInvitation - a row that
+     * says "Member" with no accepted-at date, or an accepted-at date on a row
+     * that is still only invited.
+     */
+    if (isInvitationAcceptedOnCreate) {
+      createBy.data.invitationAcceptedAt = OneUptimeDate.getCurrentDate();
+    } else {
+      delete createBy.data.invitationAcceptedAt;
+    }
+
     if (createBy.miscDataProps && createBy.miscDataProps["email"]) {
       const email: Email = new Email(createBy.miscDataProps["email"] as string);
 
@@ -221,10 +251,18 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
                 .addQueryParam("email", email.toString(), true)
                 .toString(),
               isNewUser: isNewUser.toString(),
+              /*
+               * An auto-accepted member has nothing left to accept, so the
+               * template drops the "sign in to accept your invitation" framing
+               * and tells them they are already in.
+               */
+              isInvitationAccepted: isInvitationAcceptedOnCreate.toString(),
               projectName: project.name!,
               homeUrl: new URL(httpProtocol, host).toString(),
             },
-            subject: "You have been invited to " + project.name,
+            subject: isInvitationAcceptedOnCreate
+              ? "You have been added to " + project.name
+              : "You have been invited to " + project.name,
           },
           {
             projectId: createBy.data.projectId!,
@@ -283,6 +321,65 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     );
   }
 
+  /*
+   * The per-project notification defaults a member gets the moment their
+   * membership becomes accepted, whether that happened by them accepting the
+   * invitation or by a master admin accepting it for them on create. Without
+   * these, an auto-accepted member is a member who is never notified about
+   * anything.
+   *
+   * Skipped for an unverified email: UserService adds the defaults for every
+   * accepted membership once the address is verified.
+   *
+   * Best effort. Both helpers below are idempotent, and by the time either
+   * caller runs, the membership row is already committed - failing the write
+   * that created it would report "invite failed" for a member who exists.
+   */
+  @CaptureSpan()
+  private async addDefaultNotificationSettingsAndRules(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+    user?: User | undefined;
+  }): Promise<void> {
+    try {
+      const user: User | null =
+        data.user ||
+        (await UserService.findOneById({
+          id: data.userId,
+          select: {
+            email: true,
+            isEmailVerified: true,
+          },
+          props: {
+            isRoot: true,
+          },
+        }));
+
+      if (!user || !user.isEmailVerified || !user.email) {
+        return;
+      }
+
+      await UserNotificationSettingService.addDefaultNotificationSettingsForUser(
+        data.userId,
+        data.projectId,
+      );
+
+      await UserNotificationRuleService.addDefaultNotificationRuleForUser(
+        data.projectId,
+        data.userId,
+        user.email,
+      );
+    } catch (err) {
+      logger.error(
+        err as Error,
+        {
+          projectId: data.projectId.toString(),
+          userId: data.userId.toString(),
+        } as LogAttributes,
+      );
+    }
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     onCreate: OnCreate<TeamMember>,
@@ -297,6 +394,18 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       onCreate.createBy.data.projectId!,
     );
 
+    /*
+     * A membership created already accepted never goes through the
+     * accept-invitation update, so it would otherwise miss the defaults that
+     * hook adds.
+     */
+    if (createdItem.hasAcceptedInvitation) {
+      await this.addDefaultNotificationSettingsAndRules({
+        userId: onCreate.createBy.data.userId!,
+        projectId: onCreate.createBy.data.projectId!,
+      });
+    }
+
     // Activation event for marketing funnels, attributed to the inviter.
     ProductAnalytics.captureForUser({
       userId: onCreate.createBy.props.userId,
@@ -339,16 +448,12 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     for (const item of items) {
       await this.refreshTokens(item.userId!, item.projectId!);
 
-      if (updateBy.data.hasAcceptedInvitation && item.user?.isEmailVerified) {
-        await UserNotificationSettingService.addDefaultNotificationSettingsForUser(
-          item.userId!,
-          item.projectId!,
-        );
-        await UserNotificationRuleService.addDefaultNotificationRuleForUser(
-          item.projectId!,
-          item.userId!,
-          item.user?.email as Email,
-        );
+      if (updateBy.data.hasAcceptedInvitation) {
+        await this.addDefaultNotificationSettingsAndRules({
+          userId: item.userId!,
+          projectId: item.projectId!,
+          user: item.user,
+        });
       }
     }
 

package/Server/Services/TelemetryIngestionKeyService.ts

@@ -85,6 +85,7 @@ export class Service extends DatabaseService<Model> {
 
     let secretKeyObjectId: ObjectID;
     try {
+      ObjectID.validateUUID(secretKey);
       secretKeyObjectId = new ObjectID(secretKey);
     } catch {
       this.projectIdCache.set(cacheKey, null, NEGATIVE_TTL_MS);