@oneuptime/common 12.0.6 → 12.0.7

package/Tests/Server/Services/UserWebhookSSRF.test.ts

@@ -0,0 +1,174 @@
+import UserWebhookService from "../../../Server/Services/UserWebhookService";
+import SSRFProtection from "../../../Server/Utils/SSRFProtection";
+import URL from "../../../Types/API/URL";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import dns from "dns";
+
+/*
+ * UserWebhookService used to carry its own copy of the SSRF blocklist, and the
+ * copy had drifted weaker than the original: it compared the host with the
+ * port still attached (so "169.254.169.254:80" slipped through), never
+ * resolved DNS, and only ran on create. Nothing depended on it — every sender
+ * goes through WebhookService, which calls the real guard — but a weakened
+ * lookalike reads as "this is checked".
+ *
+ * These tests assert both hooks now call the canonical guard, including the
+ * cases the local copy got wrong.
+ */
+
+type LookupSpy = jest.SpiedFunction<
+  (
+    hostname: string,
+    options: { all: true },
+  ) => Promise<Array<{ address: string; family: number }>>
+>;
+
+interface WebhookCreate {
+  data: { webhookUrl?: URL | undefined; name?: string | undefined };
+}
+
+interface WebhookUpdate {
+  data: { webhookUrl?: URL | undefined };
+}
+
+type CallCreate = (create: WebhookCreate) => Promise<unknown>;
+
+const callOnBeforeCreate: CallCreate = (
+  create: WebhookCreate,
+): Promise<unknown> => {
+  return (
+    UserWebhookService as unknown as {
+      onBeforeCreate: (c: WebhookCreate) => Promise<unknown>;
+    }
+  ).onBeforeCreate(create);
+};
+
+type CallUpdate = (update: WebhookUpdate) => Promise<unknown>;
+
+const callOnBeforeUpdate: CallUpdate = (
+  update: WebhookUpdate,
+): Promise<unknown> => {
+  return (
+    UserWebhookService as unknown as {
+      onBeforeUpdate: (u: WebhookUpdate) => Promise<unknown>;
+    }
+  ).onBeforeUpdate(update);
+};
+
+let lookupSpy: LookupSpy;
+
+beforeEach(() => {
+  lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+  lookupSpy.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("UserWebhookService no longer carries its own SSRF check", () => {
+  test("the weakened local helper is gone", () => {
+    expect(
+      (UserWebhookService as unknown as { validateWebhookUrl?: unknown })
+        .validateWebhookUrl,
+    ).toBeUndefined();
+  });
+
+  test("onBeforeCreate delegates to SSRFProtection", async () => {
+    const guardSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      SSRFProtection,
+      "validateWebhookTargetIsSafe",
+    );
+
+    await callOnBeforeCreate({
+      data: {
+        webhookUrl: URL.fromString("https://hooks.example.com/x"),
+        name: "test",
+      },
+    });
+
+    expect(guardSpy).toHaveBeenCalled();
+  });
+});
+
+describe("UserWebhookService rejects internal webhook URLs on create", () => {
+  const blockedUrls: Array<string> = [
+    "http://127.0.0.1/webhook",
+    "http://169.254.169.254/latest/meta-data/",
+    // The port-glue case the local copy let through.
+    "http://169.254.169.254:80/latest/meta-data/",
+    "http://localhost:3000/webhook",
+    "http://10.0.0.5/webhook",
+    "http://[::1]/webhook",
+  ];
+
+  test.each(blockedUrls)("rejects %s", async (rawUrl: string) => {
+    await expect(
+      callOnBeforeCreate({
+        data: { webhookUrl: URL.fromString(rawUrl), name: "test" },
+      }),
+    ).rejects.toThrow();
+  });
+
+  test("rejects a public hostname that resolves to an internal address", async () => {
+    // The DNS branch the local copy never had.
+    lookupSpy.mockResolvedValue([{ address: "169.254.169.254", family: 4 }]);
+
+    await expect(
+      callOnBeforeCreate({
+        data: {
+          webhookUrl: URL.fromString("https://rebind.attacker.example/x"),
+          name: "test",
+        },
+      }),
+    ).rejects.toThrow();
+  });
+
+  test("allows a public webhook URL", async () => {
+    await expect(
+      callOnBeforeCreate({
+        data: {
+          webhookUrl: URL.fromString("https://hooks.example.com/x"),
+          name: "test",
+        },
+      }),
+    ).resolves.toBeDefined();
+  });
+});
+
+describe("UserWebhookService validates on update too", () => {
+  const blockedUrls: Array<string> = [
+    "http://127.0.0.1/webhook",
+    "http://169.254.169.254:80/latest/meta-data/",
+    "http://10.0.0.5/webhook",
+  ];
+
+  test.each(blockedUrls)(
+    "rejects an update repointing the webhook at %s",
+    async (rawUrl: string) => {
+      await expect(
+        callOnBeforeUpdate({ data: { webhookUrl: URL.fromString(rawUrl) } }),
+      ).rejects.toThrow();
+    },
+  );
+
+  test("allows an update to a public URL", async () => {
+    await expect(
+      callOnBeforeUpdate({
+        data: { webhookUrl: URL.fromString("https://hooks.example.com/x") },
+      }),
+    ).resolves.toBeDefined();
+  });
+
+  test("leaves an update that does not touch the URL alone", async () => {
+    await expect(callOnBeforeUpdate({ data: {} })).resolves.toBeDefined();
+    expect(lookupSpy).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Services/WebPushEndpointAllowlist.test.ts

@@ -0,0 +1,133 @@
+import PushNotificationService from "../../../Server/Services/PushNotificationService";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * A Web Push subscription is a JSON blob the browser hands the client, which
+ * OneUptime stores verbatim in UserPush.deviceToken and later passes to
+ * web-push. web-push POSTs to whatever "endpoint" names — host, port and path
+ * — so an attacker who can register a device controls the destination of a
+ * request the server makes from inside its own network.
+ *
+ * Only the browser vendors' push services are legitimate destinations, so the
+ * check is an allowlist. It parses with the WHATWG parser on purpose: that is
+ * the parser web-push uses, so what is validated is what gets dialed.
+ */
+
+type Assert = (endpoint: unknown) => void;
+
+const assertAllowed: Assert = (endpoint: unknown): void => {
+  PushNotificationService.assertWebPushEndpointIsAllowed(endpoint);
+};
+
+describe("Web push endpoint allowlist accepts the real push services", () => {
+  const allowedEndpoints: Array<string> = [
+    "https://updates.push.services.mozilla.com/wpush/v2/gAAAAA",
+    "https://push.services.mozilla.com/wpush/v2/gAAAAA",
+    "https://fcm.googleapis.com/fcm/send/abc123",
+    "https://fcm.googleapis.com/wp/abc123",
+    "https://android.googleapis.com/gcm/send/abc123",
+    "https://web.push.apple.com/QLtc-abc123",
+    "https://par02p.notify.windows.com/w/?token=abc",
+    "https://notify.windows.com/w/?token=abc",
+  ];
+
+  test.each(allowedEndpoints)("allows %s", (endpoint: string) => {
+    expect(() => {
+      return assertAllowed(endpoint);
+    }).not.toThrow();
+  });
+});
+
+describe("Web push endpoint allowlist blocks internal targets", () => {
+  const blockedEndpoints: Array<string> = [
+    "http://127.0.0.1:8080/push",
+    "https://127.0.0.1:8080/push",
+    "http://169.254.169.254/latest/meta-data/",
+    "https://169.254.169.254/latest/meta-data/",
+    "http://localhost:9200/_search",
+    "https://10.0.0.5/internal",
+    "https://[::1]/push",
+    "https://metadata.google.internal/computeMetadata/v1/",
+  ];
+
+  test.each(blockedEndpoints)("blocks %s", (endpoint: string) => {
+    expect(() => {
+      return assertAllowed(endpoint);
+    }).toThrow();
+  });
+});
+
+describe("Web push endpoint allowlist resists lookalike hosts", () => {
+  const lookalikes: Array<string> = [
+    // Suffix matching must be anchored on a dot.
+    "https://evilfcm.googleapis.com/fcm/send/x",
+    "https://notfcm.googleapis.com/fcm/send/x",
+    // The allowed name as a prefix of an attacker's domain.
+    "https://fcm.googleapis.com.attacker.example/fcm/send/x",
+    "https://push.apple.com.attacker.example/x",
+    // The allowed name in the path or the query, not the host.
+    "https://attacker.example/fcm.googleapis.com",
+    "https://attacker.example/?x=https://fcm.googleapis.com",
+    // The allowed name as userinfo — the classic parser differential.
+    "https://fcm.googleapis.com@attacker.example/x",
+    "https://push.apple.com:443@attacker.example/x",
+    "https://fcm.googleapis.com:80@169.254.169.254/latest/meta-data/",
+  ];
+
+  test.each(lookalikes)("blocks %s", (endpoint: string) => {
+    expect(() => {
+      return assertAllowed(endpoint);
+    }).toThrow();
+  });
+
+  test("a userinfo lookalike is refused because the real host is read", () => {
+    /*
+     * Guard against a regression to a parser that splits on ":" before "@":
+     * that reads the host as "push.apple.com" while the socket goes to
+     * 169.254.169.254.
+     */
+    expect(() => {
+      return assertAllowed(
+        "https://push.apple.com:80@169.254.169.254/latest/meta-data/",
+      );
+    }).toThrow("169.254.169.254");
+  });
+});
+
+describe("Web push endpoint allowlist rejects unusable endpoints", () => {
+  test("requires https", () => {
+    expect(() => {
+      return assertAllowed("http://fcm.googleapis.com/fcm/send/x");
+    }).toThrow("https");
+  });
+
+  test("rejects a non-http scheme", () => {
+    expect(() => {
+      return assertAllowed("file:///etc/passwd");
+    }).toThrow();
+
+    expect(() => {
+      return assertAllowed("gopher://fcm.googleapis.com/x");
+    }).toThrow();
+  });
+
+  test("rejects a missing or non-string endpoint", () => {
+    expect(() => {
+      return assertAllowed(undefined);
+    }).toThrow();
+
+    expect(() => {
+      return assertAllowed("");
+    }).toThrow();
+
+    expect(() => {
+      return assertAllowed({ endpoint: "https://fcm.googleapis.com/x" });
+    }).toThrow();
+  });
+
+  test("rejects an unparseable endpoint", () => {
+    expect(() => {
+      return assertAllowed("not a url");
+    }).toThrow();
+  });
+});