@oneuptime/common 12.0.6 → 12.0.8

package/Tests/Server/Services/TelemetryEntityManualCreate.test.ts

@@ -0,0 +1,248 @@
+import TelemetryEntity from "../../../Models/DatabaseModels/TelemetryEntity";
+import TelemetryEntityService from "../../../Server/Services/TelemetryEntityService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import ObjectID from "../../../Types/ObjectID";
+import EntitySource from "../../../Types/Telemetry/EntitySource";
+import EntityType from "../../../Types/Telemetry/EntityType";
+import { keyForManualEntity } from "../../../Utils/Telemetry/EntityKey";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * TelemetryEntityService.onBeforeCreate is the whole of the manual-CI
+ * write path: it is what decides a create is manual, validates it, and
+ * derives the identity the registry needs from the two fields a human can
+ * supply. It also has to leave machine creates — ingest and the inventory
+ * mirror, which arrive with their keys already computed — completely alone.
+ *
+ * Every assertion below is one of those two duties.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "0f8b9c0d-e1a2-4b3c-8d5e-6f7a8b9c0d1e",
+);
+
+type CallCreate = (createBy: CreateBy<TelemetryEntity>) => Promise<unknown>;
+
+const callOnBeforeCreate: CallCreate = (
+  createBy: CreateBy<TelemetryEntity>,
+): Promise<unknown> => {
+  return (
+    TelemetryEntityService as unknown as {
+      onBeforeCreate: (c: CreateBy<TelemetryEntity>) => Promise<unknown>;
+    }
+  ).onBeforeCreate(createBy);
+};
+
+/*
+ * Explicitly admits `undefined` per field. The suite needs to build creates
+ * with a field genuinely absent (that is what the validation tests are), and
+ * `Partial<TelemetryEntity>` rejects an explicit undefined under this
+ * project's `exactOptionalPropertyTypes`.
+ */
+interface ManualCreateOverrides {
+  projectId?: ObjectID | undefined;
+  entityType?: EntityType | undefined;
+  displayName?: string | undefined;
+  description?: string | undefined;
+}
+
+function manualCreate(
+  overrides: ManualCreateOverrides = {},
+): CreateBy<TelemetryEntity> {
+  const data: TelemetryEntity = new TelemetryEntity();
+  data.projectId = PROJECT_ID;
+  data.entityType = EntityType.ExternalService;
+  data.displayName = "Stripe Payments API";
+  Object.assign(data, overrides);
+
+  return { data, props: { isRoot: true } } as CreateBy<TelemetryEntity>;
+}
+
+describe("manual entity creation", () => {
+  test("a create with no entity key is treated as manual", async () => {
+    const createBy: CreateBy<TelemetryEntity> = manualCreate();
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.source).toBe(EntitySource.Manual);
+  });
+
+  test("derives the entity key from project, type and name", async () => {
+    const createBy: CreateBy<TelemetryEntity> = manualCreate();
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.entityKey).toBe(
+      keyForManualEntity(
+        PROJECT_ID.toString(),
+        EntityType.ExternalService,
+        "Stripe Payments API",
+      ),
+    );
+  });
+
+  test("records the canonicalized name as the identifying attribute", async () => {
+    const createBy: CreateBy<TelemetryEntity> = manualCreate({
+      displayName: "  Stripe Payments API  ",
+    });
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.identifyingAttributes).toEqual({
+      "oneuptime.entity.name": "stripe payments api",
+    });
+  });
+
+  test("trims the stored display name but keeps its original casing", async () => {
+    const createBy: CreateBy<TelemetryEntity> = manualCreate({
+      displayName: "  Stripe Payments API  ",
+    });
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.displayName).toBe("Stripe Payments API");
+  });
+
+  test("two names differing only by case resolve to one identity", async () => {
+    const first: CreateBy<TelemetryEntity> = manualCreate({
+      displayName: "Stripe API",
+    });
+    const second: CreateBy<TelemetryEntity> = manualCreate({
+      displayName: "stripe api",
+    });
+
+    await callOnBeforeCreate(first);
+    await callOnBeforeCreate(second);
+
+    /*
+     * The unique index on (projectId, entityType, entityKey) then rejects
+     * the second as a duplicate rather than admitting a near-identical row.
+     */
+    expect(second.data.entityKey).toBe(first.data.entityKey);
+  });
+
+  test("stamps first and last seen so the row sorts with the rest", async () => {
+    const createBy: CreateBy<TelemetryEntity> = manualCreate();
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.firstSeenAt).toBeInstanceOf(Date);
+    expect(createBy.data.lastSeenAt).toBeInstanceOf(Date);
+  });
+
+  test("accepts every manually creatable type", async () => {
+    for (const entityType of [
+      EntityType.ExternalService,
+      EntityType.ExternalDatabase,
+      EntityType.Appliance,
+    ]) {
+      const createBy: CreateBy<TelemetryEntity> = manualCreate({ entityType });
+      await callOnBeforeCreate(createBy);
+
+      expect(createBy.data.entityType).toBe(entityType);
+      expect(createBy.data.entityKey).toBeTruthy();
+    }
+  });
+});
+
+describe("manual entity validation", () => {
+  test("rejects a type that OneUptime discovers on its own", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ entityType: EntityType.Service })),
+    ).rejects.toThrow(/cannot be created manually/);
+  });
+
+  test("rejects an inventory-mirrored type", async () => {
+    /*
+     * These arrive from the mirror with a precomputed key; a hand-made one
+     * would be a permanent duplicate of the row the mirror maintains.
+     */
+    await expect(
+      callOnBeforeCreate(
+        manualCreate({ entityType: EntityType.NetworkDevice }),
+      ),
+    ).rejects.toThrow(/cannot be created manually/);
+  });
+
+  test("rejects a missing name", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ displayName: undefined })),
+    ).rejects.toThrow(/Name is required/);
+  });
+
+  test("rejects a whitespace-only name", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ displayName: "   " })),
+    ).rejects.toThrow(/Name is required/);
+  });
+
+  test("rejects a missing entity type", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ entityType: undefined })),
+    ).rejects.toThrow(/Entity Type is required/);
+  });
+
+  test("rejects a missing project", async () => {
+    await expect(
+      callOnBeforeCreate(manualCreate({ projectId: undefined })),
+    ).rejects.toThrow(/Project ID is required/);
+  });
+});
+
+describe("machine creates are left alone", () => {
+  test("a discovered create keeps its precomputed key and source", async () => {
+    const data: TelemetryEntity = new TelemetryEntity();
+    data.projectId = PROJECT_ID;
+    data.entityType = EntityType.KubernetesPod;
+    data.entityKey = "210dac24142f1baa";
+    data.source = EntitySource.Discovered;
+    data.displayName = "checkout-7d9f";
+    data.identifyingAttributes = { "k8s.pod.name": "checkout-7d9f" };
+
+    const createBy: CreateBy<TelemetryEntity> = {
+      data,
+      props: { isRoot: true },
+    } as CreateBy<TelemetryEntity>;
+
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.entityKey).toBe("210dac24142f1baa");
+    expect(createBy.data.source).toBe(EntitySource.Discovered);
+    expect(createBy.data.identifyingAttributes).toEqual({
+      "k8s.pod.name": "checkout-7d9f",
+    });
+  });
+
+  test("a discovered create of an otherwise un-creatable type is not rejected", async () => {
+    /*
+     * The manual-type restriction must apply to users, not to ingest — which
+     * legitimately creates services, pods and hosts.
+     */
+    const data: TelemetryEntity = new TelemetryEntity();
+    data.projectId = PROJECT_ID;
+    data.entityType = EntityType.Service;
+    data.entityKey = "abcdef0123456789";
+    data.source = EntitySource.Discovered;
+
+    await expect(
+      callOnBeforeCreate({
+        data,
+        props: { isRoot: true },
+      } as CreateBy<TelemetryEntity>),
+    ).resolves.toBeDefined();
+  });
+
+  test("an inventory mirror create keeps its precomputed key and source", async () => {
+    const data: TelemetryEntity = new TelemetryEntity();
+    data.projectId = PROJECT_ID;
+    data.entityType = EntityType.NetworkDevice;
+    data.entityKey = "9f8e7d6c5b4a3210";
+    data.source = EntitySource.Inventory;
+    data.displayName = "core-switch-1";
+
+    const createBy: CreateBy<TelemetryEntity> = {
+      data,
+      props: { isRoot: true },
+    } as CreateBy<TelemetryEntity>;
+
+    await callOnBeforeCreate(createBy);
+
+    expect(createBy.data.entityKey).toBe("9f8e7d6c5b4a3210");
+    expect(createBy.data.source).toBe(EntitySource.Inventory);
+  });
+});

package/Tests/Server/Services/UserWebhookSSRF.test.ts

@@ -0,0 +1,174 @@
+import UserWebhookService from "../../../Server/Services/UserWebhookService";
+import SSRFProtection from "../../../Server/Utils/SSRFProtection";
+import URL from "../../../Types/API/URL";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import dns from "dns";
+
+/*
+ * UserWebhookService used to carry its own copy of the SSRF blocklist, and the
+ * copy had drifted weaker than the original: it compared the host with the
+ * port still attached (so "169.254.169.254:80" slipped through), never
+ * resolved DNS, and only ran on create. Nothing depended on it — every sender
+ * goes through WebhookService, which calls the real guard — but a weakened
+ * lookalike reads as "this is checked".
+ *
+ * These tests assert both hooks now call the canonical guard, including the
+ * cases the local copy got wrong.
+ */
+
+type LookupSpy = jest.SpiedFunction<
+  (
+    hostname: string,
+    options: { all: true },
+  ) => Promise<Array<{ address: string; family: number }>>
+>;
+
+interface WebhookCreate {
+  data: { webhookUrl?: URL | undefined; name?: string | undefined };
+}
+
+interface WebhookUpdate {
+  data: { webhookUrl?: URL | undefined };
+}
+
+type CallCreate = (create: WebhookCreate) => Promise<unknown>;
+
+const callOnBeforeCreate: CallCreate = (
+  create: WebhookCreate,
+): Promise<unknown> => {
+  return (
+    UserWebhookService as unknown as {
+      onBeforeCreate: (c: WebhookCreate) => Promise<unknown>;
+    }
+  ).onBeforeCreate(create);
+};
+
+type CallUpdate = (update: WebhookUpdate) => Promise<unknown>;
+
+const callOnBeforeUpdate: CallUpdate = (
+  update: WebhookUpdate,
+): Promise<unknown> => {
+  return (
+    UserWebhookService as unknown as {
+      onBeforeUpdate: (u: WebhookUpdate) => Promise<unknown>;
+    }
+  ).onBeforeUpdate(update);
+};
+
+let lookupSpy: LookupSpy;
+
+beforeEach(() => {
+  lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+  lookupSpy.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("UserWebhookService no longer carries its own SSRF check", () => {
+  test("the weakened local helper is gone", () => {
+    expect(
+      (UserWebhookService as unknown as { validateWebhookUrl?: unknown })
+        .validateWebhookUrl,
+    ).toBeUndefined();
+  });
+
+  test("onBeforeCreate delegates to SSRFProtection", async () => {
+    const guardSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      SSRFProtection,
+      "validateWebhookTargetIsSafe",
+    );
+
+    await callOnBeforeCreate({
+      data: {
+        webhookUrl: URL.fromString("https://hooks.example.com/x"),
+        name: "test",
+      },
+    });
+
+    expect(guardSpy).toHaveBeenCalled();
+  });
+});
+
+describe("UserWebhookService rejects internal webhook URLs on create", () => {
+  const blockedUrls: Array<string> = [
+    "http://127.0.0.1/webhook",
+    "http://169.254.169.254/latest/meta-data/",
+    // The port-glue case the local copy let through.
+    "http://169.254.169.254:80/latest/meta-data/",
+    "http://localhost:3000/webhook",
+    "http://10.0.0.5/webhook",
+    "http://[::1]/webhook",
+  ];
+
+  test.each(blockedUrls)("rejects %s", async (rawUrl: string) => {
+    await expect(
+      callOnBeforeCreate({
+        data: { webhookUrl: URL.fromString(rawUrl), name: "test" },
+      }),
+    ).rejects.toThrow();
+  });
+
+  test("rejects a public hostname that resolves to an internal address", async () => {
+    // The DNS branch the local copy never had.
+    lookupSpy.mockResolvedValue([{ address: "169.254.169.254", family: 4 }]);
+
+    await expect(
+      callOnBeforeCreate({
+        data: {
+          webhookUrl: URL.fromString("https://rebind.attacker.example/x"),
+          name: "test",
+        },
+      }),
+    ).rejects.toThrow();
+  });
+
+  test("allows a public webhook URL", async () => {
+    await expect(
+      callOnBeforeCreate({
+        data: {
+          webhookUrl: URL.fromString("https://hooks.example.com/x"),
+          name: "test",
+        },
+      }),
+    ).resolves.toBeDefined();
+  });
+});
+
+describe("UserWebhookService validates on update too", () => {
+  const blockedUrls: Array<string> = [
+    "http://127.0.0.1/webhook",
+    "http://169.254.169.254:80/latest/meta-data/",
+    "http://10.0.0.5/webhook",
+  ];
+
+  test.each(blockedUrls)(
+    "rejects an update repointing the webhook at %s",
+    async (rawUrl: string) => {
+      await expect(
+        callOnBeforeUpdate({ data: { webhookUrl: URL.fromString(rawUrl) } }),
+      ).rejects.toThrow();
+    },
+  );
+
+  test("allows an update to a public URL", async () => {
+    await expect(
+      callOnBeforeUpdate({
+        data: { webhookUrl: URL.fromString("https://hooks.example.com/x") },
+      }),
+    ).resolves.toBeDefined();
+  });
+
+  test("leaves an update that does not touch the URL alone", async () => {
+    await expect(callOnBeforeUpdate({ data: {} })).resolves.toBeDefined();
+    expect(lookupSpy).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Services/WebPushEndpointAllowlist.test.ts

@@ -0,0 +1,133 @@
+import PushNotificationService from "../../../Server/Services/PushNotificationService";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * A Web Push subscription is a JSON blob the browser hands the client, which
+ * OneUptime stores verbatim in UserPush.deviceToken and later passes to
+ * web-push. web-push POSTs to whatever "endpoint" names — host, port and path
+ * — so an attacker who can register a device controls the destination of a
+ * request the server makes from inside its own network.
+ *
+ * Only the browser vendors' push services are legitimate destinations, so the
+ * check is an allowlist. It parses with the WHATWG parser on purpose: that is
+ * the parser web-push uses, so what is validated is what gets dialed.
+ */
+
+type Assert = (endpoint: unknown) => void;
+
+const assertAllowed: Assert = (endpoint: unknown): void => {
+  PushNotificationService.assertWebPushEndpointIsAllowed(endpoint);
+};
+
+describe("Web push endpoint allowlist accepts the real push services", () => {
+  const allowedEndpoints: Array<string> = [
+    "https://updates.push.services.mozilla.com/wpush/v2/gAAAAA",
+    "https://push.services.mozilla.com/wpush/v2/gAAAAA",
+    "https://fcm.googleapis.com/fcm/send/abc123",
+    "https://fcm.googleapis.com/wp/abc123",
+    "https://android.googleapis.com/gcm/send/abc123",
+    "https://web.push.apple.com/QLtc-abc123",
+    "https://par02p.notify.windows.com/w/?token=abc",
+    "https://notify.windows.com/w/?token=abc",
+  ];
+
+  test.each(allowedEndpoints)("allows %s", (endpoint: string) => {
+    expect(() => {
+      return assertAllowed(endpoint);
+    }).not.toThrow();
+  });
+});
+
+describe("Web push endpoint allowlist blocks internal targets", () => {
+  const blockedEndpoints: Array<string> = [
+    "http://127.0.0.1:8080/push",
+    "https://127.0.0.1:8080/push",
+    "http://169.254.169.254/latest/meta-data/",
+    "https://169.254.169.254/latest/meta-data/",
+    "http://localhost:9200/_search",
+    "https://10.0.0.5/internal",
+    "https://[::1]/push",
+    "https://metadata.google.internal/computeMetadata/v1/",
+  ];
+
+  test.each(blockedEndpoints)("blocks %s", (endpoint: string) => {
+    expect(() => {
+      return assertAllowed(endpoint);
+    }).toThrow();
+  });
+});
+
+describe("Web push endpoint allowlist resists lookalike hosts", () => {
+  const lookalikes: Array<string> = [
+    // Suffix matching must be anchored on a dot.
+    "https://evilfcm.googleapis.com/fcm/send/x",
+    "https://notfcm.googleapis.com/fcm/send/x",
+    // The allowed name as a prefix of an attacker's domain.
+    "https://fcm.googleapis.com.attacker.example/fcm/send/x",
+    "https://push.apple.com.attacker.example/x",
+    // The allowed name in the path or the query, not the host.
+    "https://attacker.example/fcm.googleapis.com",
+    "https://attacker.example/?x=https://fcm.googleapis.com",
+    // The allowed name as userinfo — the classic parser differential.
+    "https://fcm.googleapis.com@attacker.example/x",
+    "https://push.apple.com:443@attacker.example/x",
+    "https://fcm.googleapis.com:80@169.254.169.254/latest/meta-data/",
+  ];
+
+  test.each(lookalikes)("blocks %s", (endpoint: string) => {
+    expect(() => {
+      return assertAllowed(endpoint);
+    }).toThrow();
+  });
+
+  test("a userinfo lookalike is refused because the real host is read", () => {
+    /*
+     * Guard against a regression to a parser that splits on ":" before "@":
+     * that reads the host as "push.apple.com" while the socket goes to
+     * 169.254.169.254.
+     */
+    expect(() => {
+      return assertAllowed(
+        "https://push.apple.com:80@169.254.169.254/latest/meta-data/",
+      );
+    }).toThrow("169.254.169.254");
+  });
+});
+
+describe("Web push endpoint allowlist rejects unusable endpoints", () => {
+  test("requires https", () => {
+    expect(() => {
+      return assertAllowed("http://fcm.googleapis.com/fcm/send/x");
+    }).toThrow("https");
+  });
+
+  test("rejects a non-http scheme", () => {
+    expect(() => {
+      return assertAllowed("file:///etc/passwd");
+    }).toThrow();
+
+    expect(() => {
+      return assertAllowed("gopher://fcm.googleapis.com/x");
+    }).toThrow();
+  });
+
+  test("rejects a missing or non-string endpoint", () => {
+    expect(() => {
+      return assertAllowed(undefined);
+    }).toThrow();
+
+    expect(() => {
+      return assertAllowed("");
+    }).toThrow();
+
+    expect(() => {
+      return assertAllowed({ endpoint: "https://fcm.googleapis.com/x" });
+    }).toThrow();
+  });
+
+  test("rejects an unparseable endpoint", () => {
+    expect(() => {
+      return assertAllowed("not a url");
+    }).toThrow();
+  });
+});