@oneuptime/common 12.0.6 → 12.0.8

package/Server/Utils/VM/VMAPI.ts

@@ -34,6 +34,20 @@ export default class VMUtil {
       }
     }
 
+    /*
+     * When we stringified the value ourselves just above, every placeholder in
+     * the text we are about to substitute into sits inside a JSON string
+     * literal — that is what JSON.stringify did to it. A resolved value
+     * carrying a quote or a newline therefore has to be escaped, or the
+     * JSON.parse at the bottom of this method fails and the caller silently
+     * receives a corrupted string where it asked for an object.
+     *
+     * This is separate from the caller's isJSON flag, which describes text the
+     * caller wrote and where a placeholder may legitimately stand in for a bare
+     * JSON value rather than sit inside a string.
+     */
+    const shouldEscapeForJSON: boolean = Boolean(isJSON) || didStringify;
+
     if (
       typeof valueToReplaceInPlace === "string" &&
       valueToReplaceInPlace.toString().includes("{{") &&
@@ -45,7 +59,7 @@ export default class VMUtil {
       valueToReplaceInPlaceCopy = VMUtil.expandEachLoops(
         storageMap,
         valueToReplaceInPlaceCopy,
-        isJSON,
+        shouldEscapeForJSON,
       );
 
       const variablesInArgument: Array<string> = [];
@@ -83,11 +97,21 @@ export default class VMUtil {
         if (valueToReplaceInPlaceCopy.trim() === "{{" + variable + "}}") {
           valueToReplaceInPlaceCopy = valueToReplaceInPlace;
         } else {
+          const replacement: string = shouldEscapeForJSON
+            ? VMUtil.serializeValueForJSON(valueToReplaceInPlace)
+            : `${valueToReplaceInPlace}`;
+
+          /*
+           * Function form, not the string form. String.replace treats $&, $1,
+           * $` and $' in the REPLACEMENT as substitution patterns, so a
+           * resolved value of "50$" or "a$&b" rewrote itself using the matched
+           * text. A function replacement is taken literally.
+           */
           valueToReplaceInPlaceCopy = valueToReplaceInPlaceCopy.replace(
             "{{" + variable + "}}",
-            isJSON
-              ? VMUtil.serializeValueForJSON(valueToReplaceInPlace)
-              : `${valueToReplaceInPlace}`,
+            () => {
+              return replacement;
+            },
           );
         }
       }
@@ -294,10 +318,14 @@ export default class VMUtil {
         replacement = `${foundValue}`;
       }
 
-      body = body.replace(
-        "{{" + variable + "}}",
-        isJSON ? VMUtil.serializeValueForJSON(replacement) : replacement,
-      );
+      const substitution: string = isJSON
+        ? VMUtil.serializeValueForJSON(replacement)
+        : replacement;
+
+      // Function form — see the note on the same call in replaceValueInPlace.
+      body = body.replace("{{" + variable + "}}", () => {
+        return substitution;
+      });
     }
 
     return body;
@@ -313,6 +341,15 @@ export default class VMUtil {
       value = JSON.stringify(value);
     } else {
       value = value
+        /*
+         * Backslash first, and only first. It was missing entirely, so a value
+         * like a Windows path or a regex ("C:\Users", "\d+") produced an
+         * invalid escape sequence in the surrounding document and the
+         * JSON.parse that followed threw. Escaping it after the others would
+         * instead double-escape the backslashes they just introduced.
+         */
+        .split("\\")
+        .join("\\\\")
         .split("\t")
         .join("\\t")
         .split("\n")
@@ -355,6 +392,17 @@ export default class VMUtil {
         if (indexString !== "last") {
           index = parseInt(indexString);
         } else {
+          /*
+           * `current[arrayKey].length` was read unguarded, so `items[last]`
+           * against a key that is missing (or is not an array) threw a
+           * TypeError out of deepFind and killed the entire run — the one
+           * resolution failure in here that was not silent. Fall through to the
+           * undefined return that every other miss produces.
+           */
+          if (!Array.isArray(current[arrayKey])) {
+            return undefined;
+          }
+
           index = current[arrayKey].length - 1;
         }
 

package/Server/Utils/VM/VMRunner.ts

@@ -10,6 +10,7 @@ import CaptureSpan from "../Telemetry/CaptureSpan";
 import Dictionary from "../../../Types/Dictionary";
 import GenericObject from "../../../Types/GenericObject";
 import vm, { Context } from "vm";
+import SSRFProtection from "../SSRFProtection";
 
 /**
  * Symbol used to retrieve the real (unwrapped) target from a sandbox proxy.
@@ -356,6 +357,51 @@ function unwrapProxy<T>(value: T): T {
 }
 
 export default class VMRunner {
+  /*
+   * Works out which URL the sandbox's axios call will actually dial, so the
+   * SSRF check and the request agree on the destination. axios accepts the
+   * target three different ways - a positional url, config.url on a
+   * `request()` call, and a relative url resolved against config.baseURL - and
+   * a check that only looked at the positional argument would miss two of them.
+   *
+   * Anything that does not end up an absolute http(s) URL is rejected rather
+   * than guessed at.
+   */
+  private static resolveEffectiveRequestUrl(data: {
+    method: string;
+    url: string;
+    config?: JSONObject | undefined;
+  }): string {
+    const baseUrl: string =
+      typeof data.config?.["baseURL"] === "string"
+        ? (data.config["baseURL"] as string)
+        : "";
+
+    let target: string = data.url || "";
+
+    if (data.method === "request" || !target) {
+      const configUrl: unknown = data.config?.["url"];
+      target = typeof configUrl === "string" ? configUrl : target;
+    }
+
+    let absolute: string = target;
+
+    const absoluteUrlRegex: RegExp = /^https?:\/\//i;
+
+    if (!absoluteUrlRegex.test(absolute)) {
+      if (!baseUrl) {
+        throw new Error("Request URL must be an absolute http or https URL.");
+      }
+      absolute = `${baseUrl.replace(/\/+$/, "")}/${absolute.replace(/^\/+/, "")}`;
+    }
+
+    if (!absoluteUrlRegex.test(absolute)) {
+      throw new Error("Request URL must be an absolute http or https URL.");
+    }
+
+    return absolute;
+  }
+
   @CaptureSpan()
   public static async runCodeInNodeVM(data: {
     code: string;
@@ -730,7 +776,7 @@ export default class VMRunner {
             hasBody && arg1 ? (JSON.parse(arg1) as JSONObject) : undefined;
 
           const configStr: string | undefined = hasBody ? arg2 : arg1;
-          const config: JSONObject | undefined = configStr
+          let config: JSONObject | undefined = configStr
             ? (JSON.parse(configStr) as JSONObject)
             : undefined;
 
@@ -783,6 +829,47 @@ export default class VMRunner {
             return plain;
           };
 
+          /*
+           * SSRF guard (GHSA-v5xh-rw9h-77fv).
+           *
+           * This bridge hands the host process's real axios to code the user
+           * wrote - the Custom JavaScript workflow component documents "you can
+           * use axios module" - so without a check here it is a strictly more
+           * capable version of the hole that was reported against the API
+           * components: arbitrary method, headers and body against the internal
+           * network, with the full response marshalled back into the sandbox
+           * and on into the workflow log.
+           *
+           * It has to live on THIS side of the isolate boundary. The
+           * sandbox-side axios shim is attacker-editable - user code can simply
+           * redefine it - so a check there guards nothing.
+           */
+          const effectiveUrl: string = VMRunner.resolveEffectiveRequestUrl({
+            method,
+            url,
+            config,
+          });
+
+          await SSRFProtection.validateWebhookTargetIsSafe(effectiveUrl);
+
+          /*
+           * The URL that was just validated has to be the URL that gets
+           * dialled. Each of these would otherwise steer the connection
+           * somewhere else entirely, past the check above:
+           *   proxy      - sends the request to an arbitrary host:port
+           *   socketPath - connects to a unix socket (/var/run/docker.sock)
+           *   transport / adapter - replaces the transport wholesale
+           * and a redirect would let a validated public host nominate an
+           * internal one on the second hop.
+           */
+          const safeConfig: JSONObject = config || {};
+          delete safeConfig["proxy"];
+          delete safeConfig["socketPath"];
+          delete safeConfig["transport"];
+          delete safeConfig["adapter"];
+          safeConfig["maxRedirects"] = 0;
+          config = safeConfig;
+
           try {
             let response: AxiosResponse;