@oneuptime/common 12.0.6 → 12.0.8

package/Tests/Server/Utils/Dashboard/PublicDashboardResourceListPolicy.test.ts

@@ -694,7 +694,13 @@ describe("PublicDashboardResourceListPolicy", () => {
       );
     });
 
-    it("ignores a forged scalar All value for a stored multi-select", () => {
+    /*
+     * A stored multi-select reads only `selectedValues`. A scalar in the
+     * request is not a narrower selection the viewer is entitled to — it
+     * is a field this variable does not have — so it must not become a
+     * predicate, whatever it contains.
+     */
+    it("ignores a forged scalar value for a stored multi-select", () => {
       const storedVariables: Array<JSONObject> = [
         {
           id: "namespace",
@@ -712,26 +718,75 @@ describe("PublicDashboardResourceListPolicy", () => {
         requestedVariables: [
           {
             id: "namespace",
-            selectedValue: "",
+            selectedValue: "kube-system",
             selectedValues: [],
           },
         ],
       });
-      expect(forgedScalar.query["namespaceKey"]).toBe("production");
+      expect(forgedScalar.query["namespaceKey"]).toBeUndefined();
 
-      const compatiblePlaceholder: PublicDashboardResourceListPolicyResult =
+      const forgedScalarAlongsidePicks: PublicDashboardResourceListPolicyResult =
         build({
           componentType: DashboardComponentType.KubernetesPodList,
           storedVariables,
           requestedVariables: [
             {
               id: "namespace",
-              selectedValue: null,
-              selectedValues: [],
+              selectedValue: "kube-system",
+              selectedValues: ["prod"],
             },
           ],
         });
-      expect(compatiblePlaceholder.query["namespaceKey"]).toBe("production");
+      expect(forgedScalarAlongsidePicks.query["namespaceKey"]).toEqual(
+        new Includes(["prod"]),
+      );
+    });
+
+    /*
+     * The stored `defaultValue` is a single-select concept and never
+     * reaches a multi-select. A viewer who picks nothing — or who clears
+     * the popover, which is the same request on the wire — gets the
+     * unfiltered view the selector is showing them, not the author's
+     * default silently reapplied.
+     */
+    it("treats an empty multi-select as All rather than the stored default", () => {
+      const storedVariables: Array<JSONObject> = [
+        {
+          id: "namespace",
+          name: "Namespace",
+          type: DashboardVariableType.TelemetryAttribute,
+          attributeKey: "k8s.namespace.name",
+          isMultiSelect: true,
+          defaultValue: "production",
+        },
+      ];
+
+      const emptyList: PublicDashboardResourceListPolicyResult = build({
+        componentType: DashboardComponentType.KubernetesPodList,
+        storedVariables,
+        requestedVariables: [
+          {
+            id: "namespace",
+            selectedValue: null,
+            selectedValues: [],
+          },
+        ],
+      });
+      expect(emptyList.query["namespaceKey"]).toBeUndefined();
+
+      const omittedList: PublicDashboardResourceListPolicyResult = build({
+        componentType: DashboardComponentType.KubernetesPodList,
+        storedVariables,
+        requestedVariables: [{ id: "namespace", selectedValue: null }],
+      });
+      expect(omittedList.query["namespaceKey"]).toBeUndefined();
+
+      const noSelectionSent: PublicDashboardResourceListPolicyResult = build({
+        componentType: DashboardComponentType.KubernetesPodList,
+        storedVariables,
+        requestedVariables: [],
+      });
+      expect(noSelectionSent.query["namespaceKey"]).toBeUndefined();
     });
 
     it("ignores stale multi-value input for a stored single-select", () => {

package/Tests/Server/Utils/DataSource/EgressGuard.test.ts

@@ -643,3 +643,72 @@ describe("DataSourceEgressGuard.shouldBlockPrivateAddresses", () => {
     expect(verdict.blocked).toBe(false);
   });
 });
+
+/*
+ * The private-address policy reads BILLING_ENABLED from process.env at call
+ * time (SaaS blocks private ranges; a self-hosted install with billing off
+ * reaches its own 10.x/192.168.x). These tests pin that call-time behaviour so
+ * the two policy inputs (this flag and DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES)
+ * stay consistent and independently controllable.
+ */
+describe("DataSourceEgressGuard.shouldBlockPrivateAddresses - BILLING_ENABLED is read dynamically", () => {
+  const BILLING_ENV: string = "BILLING_ENABLED";
+  let savedBilling: string | undefined = undefined;
+
+  beforeEach(() => {
+    savedBilling = process.env[BILLING_ENV];
+  });
+
+  afterEach(() => {
+    if (savedBilling === undefined) {
+      delete process.env[BILLING_ENV];
+    } else {
+      process.env[BILLING_ENV] = savedBilling;
+    }
+  });
+
+  test("SaaS (BILLING_ENABLED=true) blocks private ranges by default", () => {
+    process.env[BILLING_ENV] = "true";
+    delete process.env[ENV_VAR_NAME];
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(true);
+  });
+
+  test("self-hosted (BILLING_ENABLED unset) allows private ranges by default", () => {
+    delete process.env[BILLING_ENV];
+    delete process.env[ENV_VAR_NAME];
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(false);
+  });
+
+  test("BILLING_ENABLED with any value other than 'true' counts as off", () => {
+    process.env[BILLING_ENV] = "1";
+    delete process.env[ENV_VAR_NAME];
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(false);
+  });
+
+  test("DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES=true blocks even when billing is off", () => {
+    delete process.env[BILLING_ENV];
+    process.env[ENV_VAR_NAME] = "true";
+    expect(DataSourceEgressGuard.shouldBlockPrivateAddresses()).toBe(true);
+  });
+
+  test("checkAddress follows the billing flag when no explicit policy is given", () => {
+    delete process.env[ENV_VAR_NAME];
+
+    process.env[BILLING_ENV] = "true";
+    expect(DataSourceEgressGuard.checkAddress("10.0.0.5").blocked).toBe(true);
+
+    delete process.env[BILLING_ENV];
+    expect(DataSourceEgressGuard.checkAddress("10.0.0.5").blocked).toBe(false);
+  });
+
+  test("a self-hosted install still cannot reach loopback or metadata ranges", () => {
+    delete process.env[BILLING_ENV];
+    delete process.env[ENV_VAR_NAME];
+
+    // Always-blocked ranges ignore the billing flag entirely.
+    expect(DataSourceEgressGuard.checkAddress("127.0.0.1").blocked).toBe(true);
+    expect(DataSourceEgressGuard.checkAddress("169.254.169.254").blocked).toBe(
+      true,
+    );
+  });
+});

package/Tests/Server/Utils/DataSource/EgressGuardPinning.test.ts

@@ -0,0 +1,330 @@
+import DataSourceEgressGuard, {
+  EgressLookupFunction,
+  EgressResolveFunction,
+  PinnedAgents,
+  ResolvedAddress,
+} from "../../../../Server/Utils/DataSource/EgressGuard";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The egress guard is only half a control on its own: validating an address
+ * and then letting the socket re-resolve the hostname leaves a DNS-rebind
+ * window, and a redirect walks around the check entirely. These tests pin the
+ * two pieces that close the first half — the pinned lookup handed to an
+ * http.Agent, and the guarded lookup handed to libraries that build their own
+ * URLs — plus the message labelling that lets one guard serve several
+ * subsystems.
+ *
+ * DNS is injected everywhere, so nothing here touches the network.
+ */
+
+type ResolverFor = (addresses: Array<ResolvedAddress>) => EgressResolveFunction;
+
+const resolverFor: ResolverFor = (
+  addresses: Array<ResolvedAddress>,
+): EgressResolveFunction => {
+  return (): Promise<Array<ResolvedAddress>> => {
+    return Promise.resolve(addresses);
+  };
+};
+
+interface LookupResult {
+  error: NodeJS.ErrnoException | null;
+  address: string | Array<{ address: string; family: number }>;
+  family?: number | undefined;
+}
+
+type CallLookup = (
+  lookup: EgressLookupFunction,
+  hostname: string,
+  options: { all?: boolean | undefined; family?: number | undefined },
+) => Promise<LookupResult>;
+
+const callLookup: CallLookup = (
+  lookup: EgressLookupFunction,
+  hostname: string,
+  options: { all?: boolean | undefined; family?: number | undefined },
+): Promise<LookupResult> => {
+  return new Promise((resolve: (value: LookupResult) => void) => {
+    lookup(
+      hostname,
+      options,
+      (
+        error: NodeJS.ErrnoException | null,
+        address: string | Array<{ address: string; family: number }>,
+        family?: number,
+      ) => {
+        resolve({ error, address, family });
+      },
+    );
+  });
+};
+
+describe("DataSourceEgressGuard.createPinnedLookup", () => {
+  const addresses: Array<ResolvedAddress> = [
+    { address: "93.184.216.34", family: 4 },
+    { address: "2606:2800:220:1:248:1893:25c8:1946", family: 6 },
+  ];
+
+  test("answers with every validated address when all is set", async () => {
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createPinnedLookup(addresses);
+
+    const result: LookupResult = await callLookup(lookup, "anything.example", {
+      all: true,
+    });
+
+    expect(result.error).toBeNull();
+    expect(result.address).toEqual([
+      { address: "93.184.216.34", family: 4 },
+      { address: "2606:2800:220:1:248:1893:25c8:1946", family: 6 },
+    ]);
+  });
+
+  test("answers with the first validated address when all is not set", async () => {
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createPinnedLookup(addresses);
+
+    const result: LookupResult = await callLookup(lookup, "anything.example", {
+      all: false,
+    });
+
+    expect(result.error).toBeNull();
+    expect(result.address).toBe("93.184.216.34");
+    expect(result.family).toBe(4);
+  });
+
+  test("ignores the hostname it is asked about — the pin is the point", async () => {
+    /*
+     * This is the anti-rebind property: once validated, the socket dials the
+     * checked address no matter what DNS would say a millisecond later.
+     */
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createPinnedLookup([
+        { address: "93.184.216.34", family: 4 },
+      ]);
+
+    const result: LookupResult = await callLookup(
+      lookup,
+      "rebind.attacker.example",
+      { all: false },
+    );
+
+    expect(result.address).toBe("93.184.216.34");
+  });
+});
+
+describe("DataSourceEgressGuard.createPinnedAgents", () => {
+  test("builds http and https agents that both carry the pinned lookup", async () => {
+    const agents: PinnedAgents = DataSourceEgressGuard.createPinnedAgents([
+      { address: "93.184.216.34", family: 4 },
+    ]);
+
+    const httpLookup: EgressLookupFunction = (
+      agents.httpAgent as unknown as {
+        options: { lookup: EgressLookupFunction };
+      }
+    ).options.lookup;
+    const httpsLookup: EgressLookupFunction = (
+      agents.httpsAgent as unknown as {
+        options: { lookup: EgressLookupFunction };
+      }
+    ).options.lookup;
+
+    expect(typeof httpLookup).toBe("function");
+    expect(typeof httpsLookup).toBe("function");
+
+    await expect(
+      callLookup(httpLookup, "example.com", { all: false }),
+    ).resolves.toMatchObject({ address: "93.184.216.34" });
+    await expect(
+      callLookup(httpsLookup, "example.com", { all: false }),
+    ).resolves.toMatchObject({ address: "93.184.216.34" });
+  });
+});
+
+describe("DataSourceEgressGuard.assertUrlAllowedAndPin", () => {
+  test("returns agents pinned to the validated address", async () => {
+    const result: { addresses: Array<ResolvedAddress> } & PinnedAgents =
+      await DataSourceEgressGuard.assertUrlAllowedAndPin(
+        "https://provider.example.com/v1",
+        {
+          blockPrivateAddresses: true,
+          resolveFunction: resolverFor([
+            { address: "93.184.216.34", family: 4 },
+          ]),
+        },
+      );
+
+    expect(result.addresses).toEqual([{ address: "93.184.216.34", family: 4 }]);
+    expect(result.httpAgent).toBeDefined();
+    expect(result.httpsAgent).toBeDefined();
+  });
+
+  test("rejects the metadata endpoint before any agent is built", async () => {
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowedAndPin(
+        "http://169.254.169.254/latest/meta-data/",
+        { blockPrivateAddresses: true },
+      ),
+    ).rejects.toThrow(BadDataException);
+  });
+
+  test("rejects a hostname that resolves to loopback", async () => {
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowedAndPin("https://rebind.example/", {
+        blockPrivateAddresses: true,
+        resolveFunction: resolverFor([{ address: "127.0.0.1", family: 4 }]),
+      }),
+    ).rejects.toThrow(BadDataException);
+  });
+});
+
+describe("DataSourceEgressGuard.createGuardedLookup", () => {
+  test("passes through the validated addresses for an allowed host", async () => {
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createGuardedLookup({
+        blockPrivateAddresses: true,
+        resolveFunction: resolverFor([{ address: "93.184.216.34", family: 4 }]),
+      });
+
+    const result: LookupResult = await callLookup(lookup, "idp.example.com", {
+      all: false,
+    });
+
+    expect(result.error).toBeNull();
+    expect(result.address).toBe("93.184.216.34");
+    expect(result.family).toBe(4);
+  });
+
+  test("errors instead of connecting when the host resolves to link-local", async () => {
+    /*
+     * This is the property that makes the OIDC fix work: openid-client picks
+     * the endpoint URLs out of a document the tenant controls, so the block
+     * has to happen at connect time, for whatever host it decided on.
+     */
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createGuardedLookup({
+        blockPrivateAddresses: true,
+        resolveFunction: resolverFor([
+          { address: "169.254.169.254", family: 4 },
+        ]),
+      });
+
+    const result: LookupResult = await callLookup(
+      lookup,
+      "token-endpoint.attacker.example",
+      { all: false },
+    );
+
+    expect(result.error).toBeInstanceOf(BadDataException);
+    expect(result.error?.message).toContain("link-local");
+  });
+
+  test("errors for a literal loopback host", async () => {
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createGuardedLookup({
+        blockPrivateAddresses: true,
+      });
+
+    const result: LookupResult = await callLookup(lookup, "127.0.0.1", {
+      all: false,
+    });
+
+    expect(result.error).toBeInstanceOf(BadDataException);
+  });
+
+  test("filters to the requested address family", async () => {
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createGuardedLookup({
+        blockPrivateAddresses: true,
+        resolveFunction: resolverFor([
+          { address: "93.184.216.34", family: 4 },
+          { address: "2606:2800:220:1:248:1893:25c8:1946", family: 6 },
+        ]),
+      });
+
+    const result: LookupResult = await callLookup(lookup, "idp.example.com", {
+      all: false,
+      family: 6,
+    });
+
+    expect(result.error).toBeNull();
+    expect(result.address).toBe("2606:2800:220:1:248:1893:25c8:1946");
+    expect(result.family).toBe(6);
+  });
+
+  test("reports ENOTFOUND when no address matches the requested family", async () => {
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createGuardedLookup({
+        blockPrivateAddresses: true,
+        resolveFunction: resolverFor([{ address: "93.184.216.34", family: 4 }]),
+      });
+
+    const result: LookupResult = await callLookup(lookup, "idp.example.com", {
+      all: false,
+      family: 6,
+    });
+
+    expect(result.error?.code).toBe("ENOTFOUND");
+  });
+
+  test("a mixed answer is refused outright — one bad record poisons the set", async () => {
+    const lookup: EgressLookupFunction =
+      DataSourceEgressGuard.createGuardedLookup({
+        blockPrivateAddresses: true,
+        resolveFunction: resolverFor([
+          { address: "93.184.216.34", family: 4 },
+          { address: "10.0.0.5", family: 4 },
+        ]),
+      });
+
+    const result: LookupResult = await callLookup(lookup, "idp.example.com", {
+      all: true,
+    });
+
+    expect(result.error).toBeInstanceOf(BadDataException);
+  });
+});
+
+describe("DataSourceEgressGuard error labelling", () => {
+  test("defaults to the data source wording", async () => {
+    await expect(
+      DataSourceEgressGuard.assertHostnameAllowed("127.0.0.1", {
+        blockPrivateAddresses: true,
+      }),
+    ).rejects.toThrow("Data source host 127.0.0.1 is not allowed");
+  });
+
+  test("names the subsystem when one is given", async () => {
+    await expect(
+      DataSourceEgressGuard.assertHostnameAllowed("127.0.0.1", {
+        blockPrivateAddresses: true,
+        targetLabel: "LLM provider",
+      }),
+    ).rejects.toThrow("LLM provider host 127.0.0.1 is not allowed");
+  });
+
+  test("names the subsystem for a resolved-address rejection too", async () => {
+    await expect(
+      DataSourceEgressGuard.assertHostnameAllowed("ollama.attacker.example", {
+        blockPrivateAddresses: true,
+        targetLabel: "LLM provider",
+        resolveFunction: resolverFor([
+          { address: "169.254.169.254", family: 4 },
+        ]),
+      }),
+    ).rejects.toThrow(
+      "LLM provider host ollama.attacker.example resolves to 169.254.169.254",
+    );
+  });
+
+  test("names the subsystem for a bad scheme", async () => {
+    await expect(
+      DataSourceEgressGuard.assertUrlAllowed("file:///etc/passwd", {
+        targetLabel: "OAuth token URL",
+      }),
+    ).rejects.toThrow("OAuth token URL URL must use http or https");
+  });
+});