@oneuptime/common 12.0.7 → 12.0.9

package/Tests/Server/Utils/ClientIp.test.ts

@@ -0,0 +1,438 @@
+import { TrustedProxyHops } from "../../../Server/EnvironmentConfig";
+import {
+  ClientIpRequestLike,
+  normalizeIpCandidate,
+  resolveClientIp,
+} from "../../../Server/Utils/ClientIp";
+import { describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * The header these tests keep building is the one our Nginx produces:
+ * `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for` KEEPS whatever
+ * the caller sent and appends the address it saw. So for a caller who sends
+ * nothing, the app sees ["<caller>"]; for a caller who sends "9.9.9.9", the app
+ * sees ["9.9.9.9", "<caller>"]. Everything left of the last entry is the
+ * caller's own writing.
+ */
+
+const ALLOWLISTED: string = "203.0.113.7";
+const ATTACKER: string = "198.51.100.5";
+
+type BuildRequestFunction = (options?: {
+  forwardedFor?: string | Array<string> | undefined;
+  remoteAddress?: string | undefined;
+  ip?: string | undefined;
+}) => ClientIpRequestLike;
+
+const buildRequest: BuildRequestFunction = (options?: {
+  forwardedFor?: string | Array<string> | undefined;
+  remoteAddress?: string | undefined;
+  ip?: string | undefined;
+}): ClientIpRequestLike => {
+  const headers: Record<string, string | Array<string>> = {};
+
+  if (options?.forwardedFor !== undefined) {
+    headers["x-forwarded-for"] = options.forwardedFor;
+  }
+
+  return {
+    headers,
+    socket: { remoteAddress: options?.remoteAddress },
+    ip: options?.ip,
+  } as unknown as ClientIpRequestLike;
+};
+
+/*
+ * What Nginx hands the app for a caller at `peer` who sent `spoofed` in their
+ * own X-Forwarded-For.
+ */
+type ForwardedByNginxFunction = (
+  peer: string,
+  spoofed?: string | undefined,
+) => string;
+
+const forwardedByNginx: ForwardedByNginxFunction = (
+  peer: string,
+  spoofed?: string | undefined,
+): string => {
+  return spoofed === undefined ? peer : `${spoofed}, ${peer}`;
+};
+
+describe("resolveClientIp", () => {
+  describe("the spoofing bypass", () => {
+    it("ignores a caller-supplied entry that names an allowlisted address", () => {
+      /*
+       * The advisory's exact request: attacker sends
+       * `X-Forwarded-For: 203.0.113.7`, Nginx appends their real address.
+       * Reading the left of that header returns the allowlisted value and the
+       * IP control is gone.
+       */
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: forwardedByNginx(ATTACKER, ALLOWLISTED),
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ATTACKER);
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).not.toBe(
+        ALLOWLISTED,
+      );
+    });
+
+    it("ignores a whole forged chain, however long", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ALLOWLISTED}, 10.0.0.1, 192.168.1.1, 172.16.0.1, ${ATTACKER}`,
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ATTACKER);
+    });
+
+    it("cannot be moved by padding the chain with extra entries", () => {
+      /*
+       * Position is counted from the right, so no amount of caller-supplied
+       * prefix shifts the entry we read.
+       */
+      for (let padding: number = 0; padding < 12; padding++) {
+        const prefix: string = Array.from({ length: padding }, () => {
+          return ALLOWLISTED;
+        }).join(", ");
+
+        const req: ClientIpRequestLike = buildRequest({
+          forwardedFor: forwardedByNginx(
+            ATTACKER,
+            padding === 0 ? undefined : prefix,
+          ),
+        });
+
+        expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ATTACKER);
+      }
+    });
+
+    it("ignores a forged entry appended to the right of a repeated header", () => {
+      /*
+       * Node joins repeated headers in wire order, so a caller who sends the
+       * header twice still lands entirely to the left of the Nginx entry.
+       */
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: [ALLOWLISTED, `${ALLOWLISTED}, ${ATTACKER}`],
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ATTACKER);
+    });
+
+    it("does not let a trailing comma slide a forged entry into position", () => {
+      /*
+       * A caller sending "203.0.113.7," makes Nginx produce
+       * "203.0.113.7,, 198.51.100.5" -- an empty entry in the middle. The
+       * rightmost entry is still theirs.
+       */
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ALLOWLISTED},, ${ATTACKER}`,
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ATTACKER);
+    });
+
+    it("fails closed rather than reading further left when the trusted entry is junk", () => {
+      /*
+       * If the entry at the trusted position does not parse we return nothing
+       * -- walking left to find something parseable would walk straight into
+       * caller-supplied data.
+       */
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ALLOWLISTED}, unknown`,
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBeUndefined();
+    });
+
+    it("fails closed when the trusted position holds an empty entry", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ALLOWLISTED}, `,
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBeUndefined();
+    });
+  });
+
+  describe("the ordinary case", () => {
+    it("returns the address Nginx appended for an honest caller", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: forwardedByNginx(ALLOWLISTED),
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ALLOWLISTED);
+    });
+
+    it("tolerates whitespace around entries", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `  ${ATTACKER}  ,   ${ALLOWLISTED}   `,
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ALLOWLISTED);
+    });
+
+    it("uses the transport peer when there is no X-Forwarded-For", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        remoteAddress: "10.1.2.3",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe("10.1.2.3");
+    });
+
+    it("uses the transport peer when X-Forwarded-For is present but empty", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: "   ",
+        remoteAddress: "10.1.2.3",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe("10.1.2.3");
+    });
+
+    it("falls back to req.ip when there is no socket address", () => {
+      const req: ClientIpRequestLike = buildRequest({ ip: "10.1.2.3" });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe("10.1.2.3");
+    });
+
+    it("returns undefined when nothing identifies the caller", () => {
+      expect(
+        resolveClientIp(buildRequest(), { trustedProxyHops: 1 }),
+      ).toBeUndefined();
+    });
+
+    it("returns undefined for a request with no headers object at all", () => {
+      expect(
+        resolveClientIp({} as unknown as ClientIpRequestLike, {
+          trustedProxyHops: 1,
+        }),
+      ).toBeUndefined();
+    });
+  });
+
+  describe("hop counts", () => {
+    it("reads one further left for each additional trusted proxy", () => {
+      /*
+       * Client -> CDN -> Nginx -> app. The CDN appends the client, Nginx
+       * appends the CDN, so the client sits second from the right.
+       */
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ATTACKER}, ${ALLOWLISTED}, 172.16.0.9`,
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe("172.16.0.9");
+      expect(resolveClientIp(req, { trustedProxyHops: 2 })).toBe(ALLOWLISTED);
+      expect(resolveClientIp(req, { trustedProxyHops: 3 })).toBe(ATTACKER);
+    });
+
+    it("ignores X-Forwarded-For entirely at zero hops", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ALLOWLISTED}, ${ATTACKER}`,
+        remoteAddress: "10.1.2.3",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 0 })).toBe("10.1.2.3");
+    });
+
+    it("uses the peer, not the header, when the chain is shorter than the hop count", () => {
+      /*
+       * The request did not traverse the proxies we expect -- a direct call to
+       * the app port, or a misconfigured deployment. Nothing in the header is
+       * corroborated by a proxy of ours, so none of it is used.
+       */
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: ALLOWLISTED,
+        remoteAddress: "10.1.2.3",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 2 })).toBe("10.1.2.3");
+      expect(resolveClientIp(req, { trustedProxyHops: 5 })).toBe("10.1.2.3");
+    });
+
+    it("treats a negative or fractional hop count as zero hops", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ALLOWLISTED}, ${ATTACKER}`,
+        remoteAddress: "10.1.2.3",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: -1 })).toBe("10.1.2.3");
+      expect(resolveClientIp(req, { trustedProxyHops: NaN })).toBe("10.1.2.3");
+      expect(resolveClientIp(req, { trustedProxyHops: Infinity })).toBe(
+        "10.1.2.3",
+      );
+    });
+
+    it("uses the configured hop count when no option is given", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: forwardedByNginx(ATTACKER, ALLOWLISTED),
+      });
+
+      expect(resolveClientIp(req)).toBe(
+        resolveClientIp(req, { trustedProxyHops: TrustedProxyHops }),
+      );
+    });
+  });
+
+  describe("TRUSTED_PROXY_HOPS", () => {
+    /*
+     * The config is read at module load, so each case re-imports the module
+     * with a different environment.
+     */
+    type LoadHopsFunction = (rawValue: string | undefined) => Promise<number>;
+
+    const loadHops: LoadHopsFunction = async (
+      rawValue: string | undefined,
+    ): Promise<number> => {
+      const previous: string | undefined = process.env["TRUSTED_PROXY_HOPS"];
+
+      if (rawValue === undefined) {
+        delete process.env["TRUSTED_PROXY_HOPS"];
+      } else {
+        process.env["TRUSTED_PROXY_HOPS"] = rawValue;
+      }
+
+      jest.resetModules();
+
+      const reloaded: { TrustedProxyHops: number } = (await import(
+        "../../../Server/EnvironmentConfig"
+      )) as unknown as { TrustedProxyHops: number };
+
+      const loaded: number = reloaded.TrustedProxyHops;
+
+      if (previous === undefined) {
+        delete process.env["TRUSTED_PROXY_HOPS"];
+      } else {
+        process.env["TRUSTED_PROXY_HOPS"] = previous;
+      }
+
+      return loaded;
+    };
+
+    it("defaults to the one Nginx every shipped topology puts in front", async () => {
+      expect(await loadHops(undefined)).toBe(1);
+      expect(await loadHops("")).toBe(1);
+      expect(await loadHops("   ")).toBe(1);
+    });
+
+    it("accepts a whole non-negative count", async () => {
+      expect(await loadHops("0")).toBe(0);
+      expect(await loadHops("1")).toBe(1);
+      expect(await loadHops("2")).toBe(2);
+      expect(await loadHops(" 3 ")).toBe(3);
+    });
+
+    it("falls back to the shipped topology on a nonsense value", async () => {
+      /*
+       * Deliberately NOT 0: falling back to 0 would attribute every request
+       * to the gateway's own address, which does not deny access so much as
+       * make every allowlist meaningless.
+       */
+      expect(await loadHops("banana")).toBe(1);
+      expect(await loadHops("-1")).toBe(1);
+      expect(await loadHops("1.5")).toBe(1);
+      expect(await loadHops("Infinity")).toBe(1);
+    });
+  });
+
+  describe("address shapes", () => {
+    it("unwraps the IPv4-mapped IPv6 form Node reports on a dual-stack socket", () => {
+      /*
+       * Left as ::ffff:10.1.2.3 this would never match an IPv4 allowlist
+       * entry or a CIDR rule.
+       */
+      const req: ClientIpRequestLike = buildRequest({
+        remoteAddress: "::ffff:10.1.2.3",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe("10.1.2.3");
+    });
+
+    it("strips a port from an IPv4 entry", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: `${ALLOWLISTED}:51234`,
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe(ALLOWLISTED);
+    });
+
+    it("strips brackets and port from an IPv6 entry", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: "[2001:db8::1]:443",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe("2001:db8::1");
+    });
+
+    it("returns a bare IPv6 address unchanged", () => {
+      const req: ClientIpRequestLike = buildRequest({
+        forwardedFor: "2001:db8::1",
+      });
+
+      expect(resolveClientIp(req, { trustedProxyHops: 1 })).toBe("2001:db8::1");
+    });
+  });
+});
+
+describe("normalizeIpCandidate", () => {
+  it("accepts plain addresses", () => {
+    expect(normalizeIpCandidate("203.0.113.7")).toBe("203.0.113.7");
+    expect(normalizeIpCandidate("2001:db8::1")).toBe("2001:db8::1");
+    expect(normalizeIpCandidate("::1")).toBe("::1");
+  });
+
+  it("trims whitespace and stray quotes", () => {
+    expect(normalizeIpCandidate('  "203.0.113.7"  ')).toBe("203.0.113.7");
+  });
+
+  it("unwraps IPv4-mapped IPv6", () => {
+    expect(normalizeIpCandidate("::ffff:203.0.113.7")).toBe("203.0.113.7");
+    expect(normalizeIpCandidate("::FFFF:203.0.113.7")).toBe("203.0.113.7");
+  });
+
+  it("keeps an IPv6 address that merely starts with ::ffff but is not IPv4-mapped", () => {
+    expect(normalizeIpCandidate("::ffff:1:2:3")).toBe("::ffff:1:2:3");
+  });
+
+  it("strips ports", () => {
+    expect(normalizeIpCandidate("203.0.113.7:51234")).toBe("203.0.113.7");
+    expect(normalizeIpCandidate("[2001:db8::1]:443")).toBe("2001:db8::1");
+    expect(normalizeIpCandidate("[2001:db8::1]")).toBe("2001:db8::1");
+  });
+
+  it("rejects values that are not addresses", () => {
+    /*
+     * `unknown` is Nginx's placeholder; `_hidden` and `unknown` are RFC 7239
+     * obfuscated identifiers. None of them is an address, and none of them
+     * may be returned to a caller that is about to make an access decision.
+     */
+    expect(normalizeIpCandidate("unknown")).toBeNull();
+    expect(normalizeIpCandidate("_hidden")).toBeNull();
+    expect(normalizeIpCandidate("localhost")).toBeNull();
+    expect(normalizeIpCandidate("203.0.113.999")).toBeNull();
+    expect(normalizeIpCandidate("203.0.113")).toBeNull();
+    expect(normalizeIpCandidate("not an ip")).toBeNull();
+    expect(normalizeIpCandidate("")).toBeNull();
+    expect(normalizeIpCandidate("   ")).toBeNull();
+    expect(normalizeIpCandidate(undefined)).toBeNull();
+    expect(normalizeIpCandidate(null)).toBeNull();
+  });
+
+  it("rejects an absurdly long value without trying to parse it", () => {
+    expect(normalizeIpCandidate(":".repeat(5000))).toBeNull();
+    expect(normalizeIpCandidate(`${"0".repeat(100)}203.0.113.7`)).toBeNull();
+  });
+
+  it("accepts the longest real address", () => {
+    expect(
+      normalizeIpCandidate("2001:0db8:85a3:0000:0000:8a2e:0370:7334"),
+    ).toBe("2001:0db8:85a3:0000:0000:8a2e:0370:7334");
+  });
+
+  it("rejects a string that merely contains an address", () => {
+    /*
+     * IP.isIPv6's pattern is unanchored, so a substring would satisfy it on
+     * its own. The character-class guard is what stops that.
+     */
+    expect(normalizeIpCandidate("evil 2001:db8::1 evil")).toBeNull();
+    expect(normalizeIpCandidate("x2001:db8::1")).toBeNull();
+    expect(normalizeIpCandidate("2001:db8::1/64")).toBeNull();
+  });
+});

package/Tests/Server/Utils/Dashboard/PublicDashboardResourceListPolicy.test.ts

@@ -7,13 +7,20 @@ import Search from "../../../../Types/BaseDatabase/Search";
 import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
 import { LIMIT_PER_PROJECT } from "../../../../Types/Database/LimitMax";
 import DashboardComponentType from "../../../../Types/Dashboard/DashboardComponentType";
+import {
+  SloWidgetDisplayType,
+  SloWidgetMetric,
+} from "../../../../Types/Dashboard/DashboardComponents/DashboardSloComponent";
 import { DashboardVariableType } from "../../../../Types/Dashboard/DashboardVariable";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 import { JSONObject } from "../../../../Types/JSON";
+import ObjectID from "../../../../Types/ObjectID";
 
 const RANGE_START: Date = new Date("2026-08-09T10:00:00.000Z");
 const RANGE_END: Date = new Date("2026-08-09T11:00:00.000Z");
 
+const SLO_ID: ObjectID = ObjectID.generate();
+
 function range(): InBetween<Date> {
   return new InBetween<Date>(RANGE_START, RANGE_END);
 }
@@ -504,6 +511,25 @@ const MAPPING_CASES: Array<MappingCase> = [
     expectedSort: { time: SortOrder.Descending },
     expectedLimit: 50,
   },
+  {
+    name: "slo",
+    componentType: DashboardComponentType.Slo,
+    resourceType: "slo",
+    argumentsObject: {
+      serviceLevelObjectiveId: SLO_ID.toString(),
+      sloMetric: SloWidgetMetric.BurnRate,
+      displayType: SloWidgetDisplayType.Chart,
+      widgetTitle: "Checkout availability",
+      /*
+       * A widget can only ever name ONE SLO, so a stray maxRows must not be
+       * able to turn its read into a page of the project's other SLOs.
+       */
+      maxRows: 500,
+    },
+    expectedQuery: { _id: SLO_ID },
+    expectedSort: { name: SortOrder.Ascending },
+    expectedLimit: 1,
+  },
 ];
 
 describe("PublicDashboardResourceListPolicy", () => {
@@ -571,6 +597,151 @@ describe("PublicDashboardResourceListPolicy", () => {
     });
   });
 
+  describe("SLO widgets", () => {
+    const sloArguments: JSONObject = {
+      serviceLevelObjectiveId: SLO_ID.toString(),
+    };
+
+    it("publishes only the seven numbers the widget renders", () => {
+      const select: JSONObject = build({
+        componentType: DashboardComponentType.Slo,
+        argumentsObject: sloArguments,
+      }).select;
+
+      expect(select).toEqual({
+        _id: true,
+        name: true,
+        targetPercentage: true,
+        currentSliPercentage: true,
+        errorBudgetRemainingPercentage: true,
+        errorBudgetRemainingSeconds: true,
+        currentBurnRate: true,
+        sloStatus: true,
+      });
+
+      /*
+       * The definition of an SLO is not publishable even though its headline
+       * numbers are: which monitors it watches, how it is evaluated, and who
+       * created it all stay behind the session.
+       */
+      for (const privateColumn of [
+        "description",
+        "slug",
+        "monitors",
+        "monitorLabels",
+        "autoAddedMonitors",
+        "downtimeMonitorStatuses",
+        "labels",
+        "metricQueryConfig",
+        "sliType",
+        "windowType",
+        "windowDays",
+        "timezone",
+        "projectId",
+        "createdByUserId",
+        "createdByUser",
+        "lastEvaluatedAt",
+        "nextEvaluationAt",
+      ]) {
+        expect(select[privateColumn]).toBeUndefined();
+      }
+    });
+
+    it("ignores the caller's query entirely", () => {
+      const result: PublicDashboardResourceListPolicyResult = build({
+        componentType: DashboardComponentType.Slo,
+        argumentsObject: sloArguments,
+        requestedQuery: {
+          _id: ObjectID.generate().toString(),
+          projectId: ObjectID.generate().toString(),
+          name: "probe",
+          isEnabled: true,
+        },
+      });
+
+      expect(result.query).toEqual({ _id: SLO_ID });
+      expect(result.limit).toBe(1);
+    });
+
+    it("fails closed when the widget names no SLO", () => {
+      for (const brokenArguments of [
+        {},
+        { serviceLevelObjectiveId: "" },
+        { serviceLevelObjectiveId: "   " },
+        { serviceLevelObjectiveId: null },
+      ] as Array<JSONObject>) {
+        expect(() => {
+          return build({
+            componentType: DashboardComponentType.Slo,
+            argumentsObject: brokenArguments,
+          });
+        }).toThrow(BadDataException);
+      }
+    });
+
+    it("fails closed when the stored SLO id is not a UUID", () => {
+      for (const brokenId of [
+        "not-a-uuid",
+        "1",
+        "' OR 1=1 --",
+        SLO_ID.toString().replace(/-/g, ""),
+      ]) {
+        expect(() => {
+          return build({
+            componentType: DashboardComponentType.Slo,
+            argumentsObject: { serviceLevelObjectiveId: brokenId },
+          });
+        }).toThrow(BadDataException);
+      }
+
+      expect(() => {
+        return build({
+          componentType: DashboardComponentType.Slo,
+          argumentsObject: {
+            serviceLevelObjectiveId: [SLO_ID.toString()],
+          } as unknown as JSONObject,
+        });
+      }).toThrow(BadDataException);
+    });
+
+    it("accepts every stored metric and display type the widget can persist", () => {
+      for (const sloMetric of Object.values(SloWidgetMetric)) {
+        for (const displayType of Object.values(SloWidgetDisplayType)) {
+          const result: PublicDashboardResourceListPolicyResult = build({
+            componentType: DashboardComponentType.Slo,
+            argumentsObject: {
+              ...sloArguments,
+              sloMetric,
+              displayType,
+            },
+          });
+
+          /*
+           * Neither argument changes the row that is read — they only pick
+           * which of its numbers the widget draws.
+           */
+          expect(result.query).toEqual({ _id: SLO_ID });
+        }
+      }
+    });
+
+    it("rejects a stored metric or display type it does not recognise", () => {
+      expect(() => {
+        return build({
+          componentType: DashboardComponentType.Slo,
+          argumentsObject: { ...sloArguments, sloMetric: "Everything" },
+        });
+      }).toThrow(BadDataException);
+
+      expect(() => {
+        return build({
+          componentType: DashboardComponentType.Slo,
+          argumentsObject: { ...sloArguments, displayType: "Raw" },
+        });
+      }).toThrow(BadDataException);
+    });
+  });
+
   describe("telemetry range ownership", () => {
     it("copies only time from the log request and keeps stored filters", () => {
       const result: PublicDashboardResourceListPolicyResult = build({