@oneuptime/common 12.0.6 → 12.0.7

package/Server/Types/Workflow/Components/BaseModel/LogComponentError.ts

@@ -0,0 +1,89 @@
+import BaseModel from "../../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import logger from "../../../../Utils/Logger";
+import { RunOptions } from "../../ComponentCode";
+import {
+  ID_ARGUMENT_KEY,
+  PRIMARY_KEY_COLUMN,
+  describeModelColumns,
+} from "./ModelArguments";
+
+/*
+ * TypeORM's EntityPropertyNotFoundError reads
+ * `Property "foo" was not found in "Monitor". Make sure your query is correct.`
+ * On its own that tells a workflow builder nothing they can act on: it names
+ * neither the argument at fault nor anything they can pick from, and it says
+ * "query" even when the offending key was in Data. Everything the builder
+ * needs is already on the model, so the components append it.
+ */
+const UNKNOWN_PROPERTY_PATTERN: RegExp =
+  /Property "([^"]+)" was not found in "([^"]+)"/;
+
+type BuildColumnHintFunction = (
+  message: string,
+  model: BaseModel,
+) => string | null;
+
+export const buildColumnHint: BuildColumnHintFunction = (
+  message: string,
+  model: BaseModel,
+): string | null => {
+  const match: RegExpMatchArray | null = message.match(
+    UNKNOWN_PROPERTY_PATTERN,
+  );
+
+  if (!match) {
+    return null;
+  }
+
+  const property: string = match[1] as string;
+  const modelName: string = model.singularName || (match[2] as string);
+
+  if (property === ID_ARGUMENT_KEY) {
+    return `Tip: "${ID_ARGUMENT_KEY}" is not a column on ${modelName}. Use "${PRIMARY_KEY_COLUMN}" instead. Columns you can use: ${describeModelColumns(
+      model,
+    )}.`;
+  }
+
+  return `Tip: "${property}" is not a column on ${modelName}. Check every key in this component's Query, Select and Data arguments. Columns you can use: ${describeModelColumns(
+    model,
+  )}.`;
+};
+
+type LogComponentErrorFunction = (data: {
+  error: unknown;
+  model: BaseModel | null;
+  log: RunOptions["log"];
+}) => void;
+
+/*
+ * Every database component failed the same way before this: two lines in the
+ * workflow log and, for all but Create One, nothing at all in the server log.
+ */
+const logComponentError: LogComponentErrorFunction = (data: {
+  error: unknown;
+  model: BaseModel | null;
+  log: RunOptions["log"];
+}): void => {
+  const { error, model, log } = data;
+
+  logger.error(error);
+
+  const errorMessage: unknown = (error as { message?: unknown } | null)
+    ?.message;
+
+  const message: string =
+    typeof errorMessage === "string" && errorMessage
+      ? errorMessage
+      : JSON.stringify(error, null, 2);
+
+  log("Error running component");
+  log(message);
+
+  const hint: string | null = model ? buildColumnHint(message, model) : null;
+
+  if (hint) {
+    log(hint);
+  }
+};
+
+export default logComponentError;

package/Server/Types/Workflow/Components/BaseModel/ModelArguments.ts

@@ -0,0 +1,208 @@
+import BaseModel from "../../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { TableColumnMetadata } from "../../../../../Types/Database/TableColumn";
+import TableColumnType from "../../../../../Types/Database/TableColumnType";
+import { JSONObject, JSONValue } from "../../../../../Types/JSON";
+import ObjectID from "../../../../../Types/ObjectID";
+
+/*
+ * Workflow builders write "id", because that is what an ID is called
+ * everywhere they can see one: in the dashboard, in the API docs, and on the
+ * model itself (`monitor.id`). On a database model, though, "id" is only a
+ * TypeScript accessor - the persisted primary key column is "_id"
+ * (DatabaseBaseModel._id). A query, select or data object keyed on "id"
+ * therefore reached TypeORM verbatim and threw
+ * `Property "id" was not found in "Monitor". Make sure your query is correct.`,
+ * which is what https://github.com/OneUptime/oneuptime/issues/3132 reported.
+ *
+ * The create path has accepted "id" all along - DatabaseBaseModel._fromJSON
+ * rewrites it to "_id" - so the fix is to make every other workflow argument
+ * agree with create, rather than to take the alias away from create.
+ */
+
+export const ID_ARGUMENT_KEY: string = "id";
+export const PRIMARY_KEY_COLUMN: string = "_id";
+
+/*
+ * Only alias when the model actually looks like a DatabaseBaseModel: it has
+ * the "_id" primary key and no column of its own literally called "id".
+ * No model ships an "id" column today, but a model that grew one would mean
+ * something different by "id" and must keep it.
+ */
+type ModelAliasesIdFunction = (model: BaseModel) => boolean;
+
+const modelAliasesId: ModelAliasesIdFunction = (model: BaseModel): boolean => {
+  return (
+    model.hasColumn(PRIMARY_KEY_COLUMN) && !model.hasColumn(ID_ARGUMENT_KEY)
+  );
+};
+
+/*
+ * A nested object is only worth walking into when it is a map of column names.
+ * Serialized values - ObjectID, Date, and every QueryHelper operator - travel
+ * as `{ "_type": "...", "value": ... }` and are values, not column maps, so
+ * key rewriting has to stop at them.
+ */
+type IsColumnMapFunction = (value: JSONValue) => boolean;
+
+const isColumnMap: IsColumnMapFunction = (value: JSONValue): boolean => {
+  if (value === null || value === undefined || typeof value !== "object") {
+    return false;
+  }
+
+  if (Array.isArray(value) || value instanceof Date) {
+    return false;
+  }
+
+  return (value as JSONObject)["_type"] === undefined;
+};
+
+type NormalizeValueFunction = (
+  value: JSONValue,
+  columnName: string,
+  model: BaseModel,
+) => JSONValue;
+
+/*
+ * Relations are queried and selected one level deep - `{"project": {"id":
+ * true}}` - so the alias has to follow the relation into the related model
+ * rather than stopping at the top level.
+ */
+const normalizeValue: NormalizeValueFunction = (
+  value: JSONValue,
+  columnName: string,
+  model: BaseModel,
+): JSONValue => {
+  if (!isColumnMap(value)) {
+    return value;
+  }
+
+  const metadata: TableColumnMetadata | undefined =
+    model.getTableColumnMetadata(columnName);
+
+  if (
+    !metadata ||
+    !metadata.modelType ||
+    (metadata.type !== TableColumnType.Entity &&
+      metadata.type !== TableColumnType.EntityArray)
+  ) {
+    return value;
+  }
+
+  return normalizeModelKeys(value as JSONObject, new metadata.modelType());
+};
+
+type NormalizeModelKeysFunction = (
+  json: JSONObject,
+  model: BaseModel,
+) => JSONObject;
+
+/*
+ * Returns a copy of `json` with the "id" alias resolved to the "_id" column,
+ * including inside related-model objects one level down. Everything else is
+ * copied through untouched - this deliberately does not validate column names,
+ * so an argument that works today keeps working.
+ */
+export const normalizeModelKeys: NormalizeModelKeysFunction = (
+  json: JSONObject,
+  model: BaseModel,
+): JSONObject => {
+  const normalized: JSONObject = {};
+  const aliasesId: boolean = modelAliasesId(model);
+
+  /*
+   * Someone who spells out "_id" meant "_id". If both spellings are present
+   * the explicit column wins and the alias is dropped, so the result never
+   * depends on key order.
+   */
+  const explicitPrimaryKeyGiven: boolean =
+    json[PRIMARY_KEY_COLUMN] !== undefined;
+
+  for (const key of Object.keys(json)) {
+    let columnName: string = key;
+
+    if (key === ID_ARGUMENT_KEY && aliasesId) {
+      if (explicitPrimaryKeyGiven) {
+        continue;
+      }
+
+      columnName = PRIMARY_KEY_COLUMN;
+    }
+
+    normalized[columnName] = normalizeValue(
+      json[key] as JSONValue,
+      columnName,
+      model,
+    );
+  }
+
+  return normalized;
+};
+
+type ApplyTenantColumnFunction = (
+  json: JSONObject,
+  model: BaseModel,
+  tenantId: ObjectID,
+) => JSONObject;
+
+/*
+ * Stamps the record being written with the project the workflow runs in.
+ *
+ * Setting the scalar tenant column is not enough on its own. Every tenant
+ * model also exposes that same physical column through its many-to-one
+ * relation - Monitor.project is @JoinColumn({name: "projectId"}) - and TypeORM
+ * reads the relation property first, writing the column once. So a payload
+ * carrying {"project": "<some other project>"} silently beat the stamp and
+ * moved the record into that project. The relation keys pointing at the tenant
+ * column are therefore dropped before the scalar is written.
+ */
+export const applyTenantColumn: ApplyTenantColumnFunction = (
+  json: JSONObject,
+  model: BaseModel,
+  tenantId: ObjectID,
+): JSONObject => {
+  const tenantColumn: string | null = model.getTenantColumn();
+
+  if (!tenantColumn) {
+    return json;
+  }
+
+  const stamped: JSONObject = {};
+
+  for (const key of Object.keys(json)) {
+    if (key === tenantColumn) {
+      continue;
+    }
+
+    const metadata: TableColumnMetadata | undefined =
+      model.getTableColumnMetadata(key);
+
+    if (metadata && metadata.manyToOneRelationColumn === tenantColumn) {
+      continue;
+    }
+
+    stamped[key] = json[key];
+  }
+
+  stamped[tenantColumn] = tenantId;
+
+  return stamped;
+};
+
+type DescribeModelColumnsFunction = (model: BaseModel) => string;
+
+/*
+ * The raw TypeORM failure ("Property "foo" was not found in "Monitor") names
+ * neither the argument at fault nor anything the builder can pick from, so the
+ * components append the real column list to it.
+ */
+export const describeModelColumns: DescribeModelColumnsFunction = (
+  model: BaseModel,
+): string => {
+  const columns: Array<string> = [...model.getTableColumns().columns].sort(
+    (a: string, b: string): number => {
+      return a.localeCompare(b);
+    },
+  );
+
+  return columns.join(", ");
+};

package/Server/Types/Workflow/Components/BaseModel/OnTriggerBaseModel.ts

@@ -24,6 +24,7 @@ import ComponentMetadata, {
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import Workflow from "../../../../../Models/DatabaseModels/Workflow";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { normalizeModelKeys } from "./ModelArguments";
 
 export default class OnTriggerBaseModel<
   TBaseModel extends BaseModel,
@@ -156,6 +157,16 @@ export default class OnTriggerBaseModel<
           (select as any)[key] = false;
         }
       }
+
+      /*
+       * "id" is only a TypeScript accessor on the model - the column is "_id".
+       * Selecting "id" reached TypeORM verbatim and threw, and this trigger
+       * has no error port, so it took the whole workflow run down with it.
+       */
+      select = normalizeModelKeys(
+        select as JSONObject,
+        this.service!.getModel(),
+      ) as Select<TBaseModel>;
     }
 
     const model: TBaseModel | null = await this.service!.findOneById({

package/Server/Types/Workflow/Components/BaseModel/UpdateManyBaseModel.ts

@@ -14,6 +14,8 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { applyTenantColumn, normalizeModelKeys } from "./ModelArguments";
+import logComponentError from "./LogComponentError";
 
 export default class UpdateManyBaseModel<
   TBaseModel extends BaseModel,
@@ -92,11 +94,14 @@ export default class UpdateManyBaseModel<
         );
       }
 
-      if (this.modelService.getModel().getTenantColumn()) {
-        (args["data"] as JSONObject)[
-          this.modelService.getModel().getTenantColumn() as string
-        ] = options.projectId;
-      }
+      args["data"] = applyTenantColumn(
+        normalizeModelKeys(
+          args["data"] as JSONObject,
+          this.modelService.getModel(),
+        ),
+        this.modelService.getModel(),
+        options.projectId,
+      );
 
       if (!args["query"]) {
         throw options.onError(new BadDataException("Query is undefined."));
@@ -137,22 +142,28 @@ export default class UpdateManyBaseModel<
         args["limit"] = LIMIT_PER_PROJECT;
       }
 
-      let query: Query<TBaseModel> = args["query"] as Query<TBaseModel>;
-
-      if (query) {
-        query = JSONFunctions.deserialize(
+      const query: Query<TBaseModel> = JSONFunctions.deserialize(
+        normalizeModelKeys(
           args["query"] as JSONObject,
-        ) as Query<TBaseModel>;
-      }
-
+          this.modelService.getModel(),
+        ),
+      ) as Query<TBaseModel>;
+
+      /*
+       * The tenant column goes on the deserialized query, not on args["query"].
+       * JSONFunctions.deserialize returns a new object, so writing the tenant
+       * column to args afterwards left the query that actually ran unscoped -
+       * and an update as root is not re-scoped by the permission layer, so an
+       * Update Many could reach rows in other projects.
+       */
       if (this.modelService.getModel().getTenantColumn()) {
-        (args["query"] as JSONObject)[
+        (query as JSONObject)[
           this.modelService.getModel().getTenantColumn() as string
         ] = options.projectId;
       }
 
-      await this.modelService.updateBy({
-        query: query || {},
+      const itemsUpdated: number = await this.modelService.updateBy({
+        query: query,
         data: args["data"] as QueryDeepPartialEntity<TBaseModel>,
         limit: new PositiveNumber(args["limit"] as number),
         skip: new PositiveNumber(args["skip"] as number),
@@ -162,13 +173,25 @@ export default class UpdateManyBaseModel<
         },
       });
 
+      options.log(
+        `Updated ${itemsUpdated} ${
+          this.modelService.getModel().singularName || "record"
+        }(s).`,
+      );
+
       return {
-        returnValues: {},
+        returnValues: {
+          "items-updated": itemsUpdated,
+        },
         executePort: successPort,
       };
     } catch (err: any) {
-      options.log("Error running component");
-      options.log(err.message ? err.message : JSON.stringify(err, null, 2));
+      logComponentError({
+        error: err,
+        model: this.modelService?.getModel() || null,
+        log: options.log,
+      });
+
       return {
         returnValues: {},
         executePort: errorPort,

package/Server/Types/Workflow/Components/BaseModel/UpdateOneBaseModel.ts

@@ -12,6 +12,8 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { applyTenantColumn, normalizeModelKeys } from "./ModelArguments";
+import logComponentError from "./LogComponentError";
 
 export default class UpdateOneBaseModel<
   TBaseModel extends BaseModel,
@@ -90,11 +92,14 @@ export default class UpdateOneBaseModel<
         );
       }
 
-      if (this.modelService.getModel().getTenantColumn()) {
-        (args["data"] as JSONObject)[
-          this.modelService.getModel().getTenantColumn() as string
-        ] = options.projectId;
-      }
+      args["data"] = applyTenantColumn(
+        normalizeModelKeys(
+          args["data"] as JSONObject,
+          this.modelService.getModel(),
+        ),
+        this.modelService.getModel(),
+        options.projectId,
+      );
 
       if (!args["query"]) {
         throw options.onError(new BadDataException("Query is undefined."));
@@ -110,22 +115,26 @@ export default class UpdateOneBaseModel<
         );
       }
 
+      const query: Query<TBaseModel> = JSONFunctions.deserialize(
+        normalizeModelKeys(
+          args["query"] as JSONObject,
+          this.modelService.getModel(),
+        ),
+      ) as Query<TBaseModel>;
+
+      /*
+       * The tenant column goes on the deserialized query, not on args["query"]
+       * - JSONFunctions.deserialize returns a new object, so anything written
+       * to args after it runs never reaches the database.
+       */
       if (this.modelService.getModel().getTenantColumn()) {
-        (args["query"] as JSONObject)[
+        (query as JSONObject)[
           this.modelService.getModel().getTenantColumn() as string
         ] = options.projectId;
       }
 
-      let query: Query<TBaseModel> = args["query"] as Query<TBaseModel>;
-
-      if (query) {
-        query = JSONFunctions.deserialize(
-          args["query"] as JSONObject,
-        ) as Query<TBaseModel>;
-      }
-
-      await this.modelService.updateOneBy({
-        query: query || {},
+      const itemsUpdated: number = await this.modelService.updateOneBy({
+        query: query,
         data: args["data"] as QueryDeepPartialEntity<TBaseModel>,
         props: {
           isRoot: true,
@@ -133,13 +142,30 @@ export default class UpdateOneBaseModel<
         },
       });
 
+      /*
+       * A query that matches nothing is not an error, but reporting it as a
+       * bare success left builders with no way to tell "updated" from "found
+       * nothing to update".
+       */
+      options.log(
+        `Updated ${itemsUpdated} ${
+          this.modelService.getModel().singularName || "record"
+        }(s).`,
+      );
+
       return {
-        returnValues: {},
+        returnValues: {
+          "items-updated": itemsUpdated,
+        },
         executePort: successPort,
       };
     } catch (err: any) {
-      options.log("Error running component");
-      options.log(err.message ? err.message : JSON.stringify(err, null, 2));
+      logComponentError({
+        error: err,
+        model: this.modelService?.getModel() || null,
+        log: options.log,
+      });
+
       return {
         returnValues: {},
         executePort: errorPort,

package/Server/Types/Workflow/Components/Discord/SendMessageToChannel.ts

@@ -1,4 +1,7 @@
 import ComponentCode, { RunOptions, RunReturnType } from "../../ComponentCode";
+import IncomingWebhookUtils, {
+  DISCORD_WEBHOOK_DOMAINS,
+} from "../IncomingWebhookUtils";
 import HTTPErrorResponse from "../../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../../Types/API/HTTPResponse";
 import URL from "../../../../../Types/API/URL";
@@ -59,15 +62,12 @@ export default class SendMessageToChannel extends ComponentCode {
       throw options.onError(new BadDataException("Discord message not found"));
     }
 
-    if (!args["webhook-url"]) {
-      throw options.onError(
-        new BadDataException("Discord Webhook URL not found"),
-      );
-    }
-
-    args["webhook-url"] = URL.fromString(
-      args["webhook-url"]?.toString() as string,
-    );
+    args["webhook-url"] = IncomingWebhookUtils.getPinnedWebhookUrl({
+      args,
+      options,
+      allowedDomains: DISCORD_WEBHOOK_DOMAINS,
+      vendorName: "Discord",
+    });
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -78,6 +78,13 @@ export default class SendMessageToChannel extends ComponentCode {
         data: {
           content: args["text"] as string,
         },
+        /*
+         * The host is pinned above; following a redirect would hand the
+         * destination back to whoever controls that host.
+         */
+        options: {
+          doNotFollowRedirects: true,
+        },
       });
 
       if (apiResult instanceof HTTPErrorResponse) {

package/Server/Types/Workflow/Components/IncomingWebhookUtils.ts

@@ -0,0 +1,66 @@
+import { RunOptions } from "../ComponentCode";
+import URL from "../../../../Types/API/URL";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../../Types/JSON";
+import SSRFProtection from "../../../Utils/SSRFProtection";
+
+/*
+ * The Slack / Discord / Microsoft Teams workflow components each take a
+ * free-text "webhook-url" argument off the workflow graph, which any project
+ * member can author and which can additionally be templated from trigger data.
+ * They then POST to it from the API server - the same SSRF primitive that
+ * GHSA-v5xh-rw9h-77fv reported against the API components.
+ *
+ * These are chat webhooks, so unlike the generic API components there is a
+ * vendor host to pin to, and a pin is strictly better than a blocklist: it
+ * cannot be walked around with DNS rebinding, an alternate IP notation, or a
+ * redirect. Nothing legitimate is lost - a self-hosted OneUptime still posts to
+ * hooks.slack.com like everyone else.
+ */
+
+export const DISCORD_WEBHOOK_DOMAINS: Array<string> = [
+  "discord.com",
+  "discordapp.com",
+];
+
+export class IncomingWebhookUtils {
+  /*
+   * Reads the component's "webhook-url" argument, requires it to be on one of
+   * `allowedDomains`, and returns it parsed. Throws through options.onError so
+   * the workflow stops with a message the author can act on.
+   *
+   * Validates the RAW string: URL.fromString defaults an unrecognized scheme to
+   * https, so converting first would let "gopher://..." arrive looking clean.
+   */
+  public static getPinnedWebhookUrl(data: {
+    args: JSONObject;
+    options: RunOptions;
+    allowedDomains: Array<string>;
+    vendorName: string;
+  }): URL {
+    const rawUrl: unknown = data.args["webhook-url"];
+
+    if (!rawUrl) {
+      throw data.options.onError(
+        new BadDataException(`${data.vendorName} Webhook URL not found`),
+      );
+    }
+
+    if (
+      !SSRFProtection.isUrlOnAllowedDomain(
+        rawUrl.toString(),
+        data.allowedDomains,
+      )
+    ) {
+      throw data.options.onError(
+        new BadDataException(
+          `${data.vendorName} Webhook URL must be an https URL on ${data.allowedDomains.join(" or ")}.`,
+        ),
+      );
+    }
+
+    return URL.fromString(rawUrl.toString());
+  }
+}
+
+export default IncomingWebhookUtils;

package/Server/Types/Workflow/Components/MicrosoftTeams/SendMessageToChannel.ts

@@ -1,4 +1,6 @@
 import ComponentCode, { RunOptions, RunReturnType } from "../../ComponentCode";
+import IncomingWebhookUtils from "../IncomingWebhookUtils";
+import { MICROSOFT_TEAMS_WEBHOOK_DOMAINS } from "../../../../Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
 import HTTPErrorResponse from "../../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../../Types/API/HTTPResponse";
 import URL from "../../../../../Types/API/URL";
@@ -60,15 +62,12 @@ export default class SendMessageToChannel extends ComponentCode {
       );
     }
 
-    if (!args["webhook-url"]) {
-      throw options.onError(
-        new BadDataException("Microsoft teams Webhook URL not found"),
-      );
-    }
-
-    args["webhook-url"] = URL.fromString(
-      args["webhook-url"]?.toString() as string,
-    );
+    args["webhook-url"] = IncomingWebhookUtils.getPinnedWebhookUrl({
+      args,
+      options,
+      allowedDomains: MICROSOFT_TEAMS_WEBHOOK_DOMAINS,
+      vendorName: "Microsoft Teams",
+    });
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -100,6 +99,13 @@ export default class SendMessageToChannel extends ComponentCode {
             },
           ],
         },
+        /*
+         * The host is pinned above; following a redirect would hand the
+         * destination back to whoever controls that host.
+         */
+        options: {
+          doNotFollowRedirects: true,
+        },
       });
 
       if (apiResult instanceof HTTPErrorResponse) {