@oneuptime/common 12.0.6 → 12.0.8

package/Tests/Server/Types/Workflow/Components/ApiComponentHeaders.test.ts

@@ -0,0 +1,192 @@
+/*
+ * Request headers on the API components reach sanitizeArgs in three shapes: a
+ * JSON string (every workflow written before the key/value editor), an object
+ * (what the key/value editor produces), and whatever a {{...}} substitution
+ * left behind. Every consumer downstream casts the result to
+ * Dictionary<string> and spreads it into the outgoing request, so the shape
+ * has to be settled here.
+ */
+
+jest.mock("../../../../../Utils/API", () => {
+  return {
+    __esModule: true,
+    default: {
+      get: jest.fn(),
+      post: jest.fn(),
+      put: jest.fn(),
+      patch: jest.fn(),
+      delete: jest.fn(),
+    },
+  };
+});
+
+import ApiGet from "../../../../../Server/Types/Workflow/Components/API/Get";
+import { ApiComponentUtils } from "../../../../../Server/Types/Workflow/Components/API/Utils";
+import ComponentCode, {
+  RunOptions,
+} from "../../../../../Server/Types/Workflow/ComponentCode";
+import Exception from "../../../../../Types/Exception/Exception";
+import { JSONObject } from "../../../../../Types/JSON";
+import ObjectID from "../../../../../Types/ObjectID";
+import IconProp from "../../../../../Types/Icon/IconProp";
+import ComponentMetadata, {
+  Argument,
+  ComponentInputType,
+  ComponentType,
+} from "../../../../../Types/Workflow/Component";
+import APIComponents from "../../../../../Types/Workflow/Components/API";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+import dns from "dns";
+
+type MakeOptionsFunction = () => RunOptions;
+
+const makeOptions: MakeOptionsFunction = (): RunOptions => {
+  return {
+    log: jest.fn() as RunOptions["log"],
+    workflowLogId: ObjectID.generate(),
+    workflowId: ObjectID.generate(),
+    projectId: ObjectID.generate(),
+    onError: ((exception: Exception): Exception => {
+      return exception;
+    }) as RunOptions["onError"],
+    executeWorkflow: async (): Promise<void> => {},
+  };
+};
+
+type SanitizeFunction = (headers: unknown) => Promise<JSONObject>;
+
+const sanitizeHeaders: SanitizeFunction = async (
+  headers: unknown,
+): Promise<JSONObject> => {
+  const component: ComponentCode = new ApiGet();
+
+  const result: { args: JSONObject } = await ApiComponentUtils.sanitizeArgs(
+    component.getMetadata(),
+    {
+      url: "https://api.example.com/thing",
+      "request-headers": headers as JSONObject,
+    },
+    makeOptions(),
+  );
+
+  return result.args["request-headers"] as JSONObject;
+};
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  jest
+    .spyOn(dns.promises, "lookup")
+    .mockResolvedValue([{ address: "93.184.216.34", family: 4 }] as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("ApiComponentUtils.sanitizeArgs — header shapes", () => {
+  test("parses the legacy JSON-string shape", async () => {
+    await expect(
+      sanitizeHeaders('{"Authorization": "Bearer abc"}'),
+    ).resolves.toEqual({
+      Authorization: "Bearer abc",
+    });
+  });
+
+  test("parses a JSON5 string, which has always been accepted here", async () => {
+    await expect(
+      sanitizeHeaders("{Authorization: 'Bearer abc'}"),
+    ).resolves.toEqual({
+      Authorization: "Bearer abc",
+    });
+  });
+
+  test("passes the object shape through", async () => {
+    await expect(
+      sanitizeHeaders({ Authorization: "Bearer abc" }),
+    ).resolves.toEqual({ Authorization: "Bearer abc" });
+  });
+
+  test("flattens numbers and booleans the key/value editor can emit", async () => {
+    await expect(
+      sanitizeHeaders({ "X-Retries": 3, "X-Debug": true }),
+    ).resolves.toEqual({
+      "X-Retries": "3",
+      "X-Debug": "true",
+    });
+  });
+
+  test("drops null and undefined values instead of sending 'null'", async () => {
+    await expect(
+      sanitizeHeaders({ "X-A": "keep", "X-B": null }),
+    ).resolves.toEqual({ "X-A": "keep" });
+  });
+
+  test("serializes a nested value rather than sending [object Object]", async () => {
+    await expect(sanitizeHeaders({ "X-Meta": { a: 1 } })).resolves.toEqual({
+      "X-Meta": '{"a":1}',
+    });
+  });
+
+  test("rejects an array, which would spread into per-index junk headers", async () => {
+    await expect(sanitizeHeaders("[1, 2]")).rejects.toThrow(
+      /Request headers must be a JSON object/,
+    );
+  });
+
+  test("rejects a bare scalar", async () => {
+    await expect(sanitizeHeaders("42")).rejects.toThrow(
+      /Request headers must be a JSON object/,
+    );
+  });
+
+  test("leaves the request alone when no headers were given", async () => {
+    const component: ComponentCode = new ApiGet();
+
+    const result: { args: JSONObject } = await ApiComponentUtils.sanitizeArgs(
+      component.getMetadata(),
+      { url: "https://api.example.com/thing" },
+      makeOptions(),
+    );
+
+    expect(result.args["request-headers"]).toBeUndefined();
+  });
+});
+
+describe("API component metadata — headers are treated as secret", () => {
+  /*
+   * The key/value grid makes pasting a bearer token into a header the obvious
+   * thing to do. Without isSensitive the resolved value is written verbatim
+   * into the WorkflowLog for anyone who can read the project.
+   */
+  test("every API component marks request-headers sensitive", () => {
+    const componentsWithHeaders: Array<ComponentMetadata> =
+      APIComponents.filter((component: ComponentMetadata) => {
+        return component.arguments.some((arg: Argument) => {
+          return arg.id === "request-headers";
+        });
+      });
+
+    expect(componentsWithHeaders.length).toBe(5);
+
+    for (const component of componentsWithHeaders) {
+      const headerArgument: Argument = component.arguments.find(
+        (arg: Argument) => {
+          return arg.id === "request-headers";
+        },
+      ) as Argument;
+
+      expect(headerArgument.isSensitive).toBe(true);
+      expect(headerArgument.type).toBe(ComponentInputType.StringDictionary);
+    }
+  });
+
+  test("the components are the five request verbs", () => {
+    expect(
+      APIComponents.filter((component: ComponentMetadata) => {
+        return component.componentType === ComponentType.Component;
+      }).length,
+    ).toBeGreaterThanOrEqual(5);
+
+    expect(APIComponents[0]?.iconProp).toBe(IconProp.Globe);
+  });
+});

package/Tests/Server/Types/Workflow/Components/ApiComponentSsrf.test.ts

@@ -0,0 +1,215 @@
+import ApiDelete from "../../../../../Server/Types/Workflow/Components/API/Delete";
+import ApiGet from "../../../../../Server/Types/Workflow/Components/API/Get";
+import ApiPatch from "../../../../../Server/Types/Workflow/Components/API/Patch";
+import ApiPost from "../../../../../Server/Types/Workflow/Components/API/Post";
+import ApiPut from "../../../../../Server/Types/Workflow/Components/API/Put";
+import ComponentCode, {
+  RunOptions,
+} from "../../../../../Server/Types/Workflow/ComponentCode";
+import HTTPResponse from "../../../../../Types/API/HTTPResponse";
+import Exception from "../../../../../Types/Exception/Exception";
+import { JSONObject } from "../../../../../Types/JSON";
+import ObjectID from "../../../../../Types/ObjectID";
+import API from "../../../../../Utils/API";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+import dns from "dns";
+
+/*
+ * GHSA-v5xh-rw9h-77fv: the API workflow components sent a request to whatever
+ * URL the workflow author typed in, with no blocklist. Any member of any
+ * project could point one at http://169.254.169.254/latest/meta-data/ and read
+ * the cloud instance credentials straight out of the component's
+ * "response-body" return value, or sweep the cluster's internal services by
+ * watching the status codes.
+ *
+ * These tests pin the guard at the one place all five verbs share
+ * (ApiComponentUtils.sanitizeArgs) - for every verb, so a new component cannot
+ * be added that quietly skips it.
+ */
+
+jest.mock("../../../../../Utils/API", () => {
+  return {
+    __esModule: true,
+    default: {
+      get: jest.fn(),
+      post: jest.fn(),
+      put: jest.fn(),
+      patch: jest.fn(),
+      delete: jest.fn(),
+    },
+  };
+});
+
+type ApiMethodName = "get" | "post" | "put" | "patch" | "delete";
+
+type LookupSpy = jest.SpiedFunction<
+  (
+    hostname: string,
+    options: { all: true },
+  ) => Promise<Array<{ address: string; family: number }>>
+>;
+
+const apiComponents: Array<[string, ApiMethodName, () => ComponentCode]> = [
+  [
+    "Get",
+    "get",
+    (): ComponentCode => {
+      return new ApiGet();
+    },
+  ],
+  [
+    "Post",
+    "post",
+    (): ComponentCode => {
+      return new ApiPost();
+    },
+  ],
+  [
+    "Put",
+    "put",
+    (): ComponentCode => {
+      return new ApiPut();
+    },
+  ],
+  [
+    "Patch",
+    "patch",
+    (): ComponentCode => {
+      return new ApiPatch();
+    },
+  ],
+  [
+    "Delete",
+    "delete",
+    (): ComponentCode => {
+      return new ApiDelete();
+    },
+  ],
+];
+
+function makeOptions(): RunOptions {
+  return {
+    log: jest.fn() as RunOptions["log"],
+    workflowLogId: ObjectID.generate(),
+    workflowId: ObjectID.generate(),
+    projectId: ObjectID.generate(),
+    onError: ((exception: Exception): Exception => {
+      return exception;
+    }) as RunOptions["onError"],
+    executeWorkflow: async (): Promise<void> => {},
+  };
+}
+
+function getApiMock(apiMethodName: ApiMethodName): jest.Mock {
+  return API[apiMethodName] as unknown as jest.Mock;
+}
+
+let lookupSpy: LookupSpy;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+  lookupSpy.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe.each(apiComponents)(
+  "API %s workflow component SSRF guard",
+  (
+    _label: string,
+    apiMethodName: ApiMethodName,
+    createComponent: () => ComponentCode,
+  ) => {
+    const blockedUrls: Array<[string, string]> = [
+      ["cloud metadata endpoint", "http://169.254.169.254/latest/meta-data/"],
+      [
+        "cloud metadata endpoint on an explicit port",
+        "http://169.254.169.254:80/latest/meta-data/",
+      ],
+      ["GCP metadata by name", "http://metadata.google.internal/"],
+      ["loopback", "http://127.0.0.1:8080/admin"],
+      ["localhost", "http://localhost:3000/api/status"],
+      ["RFC-1918 10/8", "http://10.0.0.5/internal"],
+      ["RFC-1918 172.16/12", "http://172.16.4.1/internal"],
+      ["RFC-1918 192.168/16", "http://192.168.1.1/router"],
+      ["CGNAT", "http://100.64.0.1/"],
+      ["IPv6 loopback", "http://[::1]:9200/_cluster/health"],
+      ["IPv6 link-local", "http://[fe80::1]/"],
+      ["IPv6 unique-local", "http://[fd00::1]/"],
+      ["the unspecified address", "http://0.0.0.0/"],
+    ];
+
+    test.each(blockedUrls)(
+      "refuses to request %s and never reaches the HTTP client",
+      async (_reason: string, url: string) => {
+        await expect(
+          createComponent().run({ url }, makeOptions()),
+        ).rejects.toThrow();
+
+        expect(getApiMock(apiMethodName)).not.toHaveBeenCalled();
+      },
+    );
+
+    test("refuses a public hostname that resolves to an internal address", async () => {
+      // The DNS-rebinding shape: the name looks fine, the answer does not.
+      lookupSpy.mockResolvedValue([{ address: "169.254.169.254", family: 4 }]);
+
+      await expect(
+        createComponent().run(
+          { url: "https://metadata.attacker.example/latest/meta-data/" },
+          makeOptions(),
+        ),
+      ).rejects.toThrow();
+
+      expect(getApiMock(apiMethodName)).not.toHaveBeenCalled();
+    });
+
+    test("refuses a non-http scheme", async () => {
+      await expect(
+        createComponent().run({ url: "file:///etc/passwd" }, makeOptions()),
+      ).rejects.toThrow();
+
+      expect(getApiMock(apiMethodName)).not.toHaveBeenCalled();
+    });
+
+    test("still allows an ordinary public URL", async () => {
+      getApiMock(apiMethodName).mockResolvedValue(
+        new HTTPResponse<JSONObject>(200, { ok: true }, {}),
+      );
+
+      const result: { returnValues: JSONObject } = await createComponent().run(
+        { url: "https://api.example.com/v1/deploy" },
+        makeOptions(),
+      );
+
+      expect(getApiMock(apiMethodName)).toHaveBeenCalledTimes(1);
+      expect(result.returnValues["response-status"]).toBe(200);
+    });
+
+    test("sends the allowed request with redirects turned off", async () => {
+      getApiMock(apiMethodName).mockResolvedValue(
+        new HTTPResponse<JSONObject>(200, { ok: true }, {}),
+      );
+
+      await createComponent().run(
+        { url: "https://api.example.com/v1/deploy" },
+        makeOptions(),
+      );
+
+      const request: { options?: { doNotFollowRedirects?: boolean } } =
+        getApiMock(apiMethodName).mock.calls[0]![0] as {
+          options?: { doNotFollowRedirects?: boolean };
+        };
+
+      /*
+       * Validating the URL is only half the fix. Following a 3xx would let a
+       * host that passes the blocklist hand the server an internal address
+       * afterwards, which is the same vulnerability one hop later.
+       */
+      expect(request.options?.doNotFollowRedirects).toBe(true);
+    });
+  },
+);