@oneuptime/common 12.0.8 → 12.0.9

package/Tests/Types/IP/IP.test.ts

@@ -1,4 +1,5 @@
 import IP from "../../../Types/IP/IP";
+import { ObjectType } from "../../../Types/JSON";
 
 describe("IP()", () => {
   test("expect ip to be defined", () => {
@@ -79,3 +80,265 @@ describe("IP()", () => {
     expect(IP.getDatabaseTransformer().to("")).toBe(null);
   });
 });
+
+/*
+ * The validators are anchored, so a value only counts as an address when the
+ * WHOLE string is one. These cases pin that down: the IPv6 pattern used to be
+ * unanchored and reported anything merely containing an address-shaped
+ * substring as valid.
+ */
+describe("IP.isIP() anchoring", () => {
+  const VALID_IPV4: Array<string> = [
+    "0.0.0.0",
+    "127.0.0.1",
+    "10.0.0.4",
+    "196.223.149.8",
+    "203.0.113.7",
+    "255.255.255.255",
+  ];
+
+  const VALID_IPV6: Array<string> = [
+    "::",
+    "::1",
+    "fd00::1",
+    "fe80::1",
+    "2001:db8::1",
+    "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
+    "2001:db8:0:0:0:0:0:1",
+    "a:b:c:d:e:f:1:2",
+    // Uppercase hex is valid.
+    "2001:DB8::1",
+    // Zone identifier, as reported for link-local addresses.
+    "fe80::1%eth0",
+    // IPv4-mapped, the form Node reports for a dual-stack socket.
+    "::ffff:127.0.0.1",
+    "::ffff:203.0.113.7",
+    "::11.22.33.44",
+    "2001:db8::192.168.0.1",
+  ];
+
+  test.each(VALID_IPV4)("accepts the IPv4 address %s", (value: string) => {
+    expect(IP.isIP(value)).toBe(true);
+    expect(new IP(value).isIPv4()).toBe(true);
+    expect(new IP(value).isIPv6()).toBe(false);
+  });
+
+  test.each(VALID_IPV6)("accepts the IPv6 address %s", (value: string) => {
+    expect(IP.isIP(value)).toBe(true);
+    expect(new IP(value).isIPv6()).toBe(true);
+    expect(new IP(value).isIPv4()).toBe(false);
+  });
+
+  /*
+   * Every one of these was accepted before the pattern was anchored. They are
+   * the whole point of the change, so they are listed out rather than folded
+   * into the generic invalid list below.
+   */
+  const ADDRESS_SHAPED_SUBSTRINGS: Array<string> = [
+    "evil 2001:db8::1 evil",
+    "not-an-ip-::1",
+    "x2001:db8::1",
+    "2001:db8::1x",
+    "<script>::1</script>",
+    // Leading/trailing whitespace is not part of an address.
+    "  ::1  ",
+    "::1 ",
+    " ::1",
+    // A whole forwarded-for chain is a list, not an address.
+    "::1, 1.2.3.4",
+    "2001:db8::1, 198.51.100.5",
+    // A newline is the classic way to smuggle a second value past a check.
+    "2001:db8::1\n1.2.3.4",
+    // Bracketed host:port, which is what a proxy emits for IPv6.
+    "[2001:db8::1]:443",
+    "[2001:db8::1]",
+    // Triple colon is not valid IPv6 -- only one "::" run is allowed.
+    "2001:0db8:85a3:::8a2e:0370:7334",
+    // A CIDR entry is a range, not a single address.
+    "2001:db8::/32",
+    // Out-of-range hex group.
+    "gggg::1",
+    "2001:db8::1::2",
+  ];
+
+  test.each(ADDRESS_SHAPED_SUBSTRINGS)(
+    "rejects %j, which only contains something address-shaped",
+    (value: string) => {
+      expect(IP.isIP(value)).toBe(false);
+    },
+  );
+
+  const NOT_ADDRESSES: Array<string> = [
+    "",
+    " ",
+    "hello",
+    "Invalid IP",
+    "unknown",
+    "localhost",
+    "example.com",
+    "1.2.3.4.5",
+    "1.2.3",
+    "256.1.1.1",
+    "10.0.0.0/8",
+    "203.0.113.7:51234",
+    "-1.0.0.0",
+    "01.02.03.04.05",
+  ];
+
+  test.each(NOT_ADDRESSES)("rejects %j", (value: string) => {
+    expect(IP.isIP(value)).toBe(false);
+  });
+
+  test.each([...ADDRESS_SHAPED_SUBSTRINGS, ...NOT_ADDRESSES])(
+    "constructing an IP from %j throws",
+    (value: string) => {
+      expect(() => {
+        return new IP(value);
+      }).toThrow("IP is not a valid address");
+    },
+  );
+
+  /*
+   * The validators no longer carry the `g` flag. `.test()` on a `g` regex
+   * advances lastIndex between calls, so the same input could otherwise
+   * answer differently depending on how many times it had been asked.
+   */
+  test("answers the same for repeated calls with the same input", () => {
+    for (let i: number = 0; i < 5; i++) {
+      expect(IP.isIP("2001:db8::1")).toBe(true);
+      expect(IP.isIP("127.0.0.1")).toBe(true);
+      expect(IP.isIP("evil 2001:db8::1 evil")).toBe(false);
+    }
+  });
+
+  test("answers the same when interleaving valid and invalid input", () => {
+    const inputs: Array<[string, boolean]> = [
+      ["2001:db8::1", true],
+      ["[2001:db8::1]:443", false],
+      ["2001:db8::1", true],
+      ["::1, 1.2.3.4", false],
+      ["::1", true],
+    ];
+
+    for (const [value, expected] of inputs) {
+      expect(IP.isIP(value)).toBe(expected);
+    }
+  });
+});
+
+describe("IP deserialization rejects invalid addresses", () => {
+  test("fromDatabase throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.fromDatabase("[2001:db8::1]:443");
+    }).toThrow("IP is not a valid address");
+  });
+
+  test("fromJSON throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.fromJSON({ _type: ObjectType.IP, value: "evil ::1 evil" });
+    }).toThrow("IP is not a valid address");
+  });
+
+  test("fromJSON round-trips a valid address", () => {
+    const ip: IP = new IP("2001:db8::1");
+    expect(IP.fromJSON(ip.toJSON()).toString()).toBe("2001:db8::1");
+  });
+
+  test("the database transformer throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.getDatabaseTransformer().from("evil 2001:db8::1 evil");
+    }).toThrow("IP is not a valid address");
+  });
+});
+
+describe("IP.isInWhitelist()", () => {
+  test("matches an exact IPv4 entry", () => {
+    expect(
+      IP.isInWhitelist({ ip: "203.0.113.7", whitelist: ["203.0.113.7"] }),
+    ).toBe(true);
+  });
+
+  test("matches an exact IPv6 entry", () => {
+    expect(
+      IP.isInWhitelist({ ip: "2001:db8::1", whitelist: ["2001:db8::1"] }),
+    ).toBe(true);
+  });
+
+  test("does not match a different address", () => {
+    expect(
+      IP.isInWhitelist({ ip: "198.51.100.5", whitelist: ["203.0.113.7"] }),
+    ).toBe(false);
+  });
+
+  test("matches an IPv4 CIDR range", () => {
+    expect(
+      IP.isInWhitelist({ ip: "10.1.2.3", whitelist: ["10.0.0.0/8"] }),
+    ).toBe(true);
+  });
+
+  test("does not match an address outside the CIDR range", () => {
+    expect(
+      IP.isInWhitelist({ ip: "11.1.2.3", whitelist: ["10.0.0.0/8"] }),
+    ).toBe(false);
+  });
+
+  test("returns false for an empty whitelist", () => {
+    expect(IP.isInWhitelist({ ip: "203.0.113.7", whitelist: [] })).toBe(false);
+  });
+
+  test("skips blank whitelist entries", () => {
+    expect(
+      IP.isInWhitelist({
+        ip: "203.0.113.7",
+        whitelist: ["", "   ", "203.0.113.7"],
+      }),
+    ).toBe(true);
+  });
+
+  /*
+   * The caller is expected to hand this one address it has already resolved.
+   * A value that merely contains an address is not one, and asking about it
+   * is a caller bug -- it throws rather than quietly answering false, which
+   * an access check would then read as a clean deny.
+   */
+  test("throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: "evil 2001:db8::1 evil",
+        whitelist: ["2001:db8::1"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+
+  test("throws for a bracketed host:port", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: "[2001:db8::1]:443",
+        whitelist: ["2001:db8::1"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+
+  test("throws for a whole forwarded-for chain passed as one value", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: "203.0.113.7, 198.51.100.5",
+        whitelist: ["203.0.113.7"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+
+  /*
+   * A bracketed or padded spelling of an allowlisted address never matched an
+   * entry anyway -- it just used to reach the comparison instead of being
+   * rejected. Either way it is not granted access.
+   */
+  test("does not grant access to a padded spelling of a listed address", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: " 203.0.113.7 ",
+        whitelist: ["203.0.113.7"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+});

package/Tests/Types/IP/IPWhitelist.test.ts

@@ -0,0 +1,197 @@
+import BadDataException from "../../../Types/Exception/BadDataException";
+import IP from "../../../Types/IP/IP";
+import { describe, expect, it } from "@jest/globals";
+
+describe("IP.isInWhitelist", () => {
+  describe("single-address contract", () => {
+    /*
+     * This used to take an array and return true if ANY member matched.
+     * Callers fed it a whole X-Forwarded-For chain, and because a caller
+     * writes the left-hand end of that header themselves, "any member
+     * matches" meant "the caller names the address". Taking one address is
+     * what makes the check mean anything.
+     */
+    it("checks exactly the address it is given", () => {
+      expect(
+        IP.isInWhitelist({
+          ip: "198.51.100.5",
+          whitelist: ["203.0.113.7"],
+        }),
+      ).toBe(false);
+
+      expect(
+        IP.isInWhitelist({
+          ip: "203.0.113.7",
+          whitelist: ["203.0.113.7"],
+        }),
+      ).toBe(true);
+    });
+
+    it("cannot be handed a chain", () => {
+      /*
+       * A chain is not an address, so the old bypass input is now rejected
+       * outright rather than quietly matching on its first entry.
+       */
+      expect(() => {
+        return IP.isInWhitelist({
+          ip: "203.0.113.7, 198.51.100.5",
+          whitelist: ["203.0.113.7"],
+        });
+      }).toThrow(BadDataException);
+    });
+  });
+
+  describe("exact matches", () => {
+    it("matches an IPv4 entry", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.1"] }),
+      ).toBe(true);
+    });
+
+    it("matches an IPv6 entry", () => {
+      expect(
+        IP.isInWhitelist({ ip: "2001:db8::1", whitelist: ["2001:db8::1"] }),
+      ).toBe(true);
+    });
+
+    it("does not match a different address", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.2", whitelist: ["10.0.0.1"] }),
+      ).toBe(false);
+    });
+
+    it("finds the entry wherever it sits in the list", () => {
+      expect(
+        IP.isInWhitelist({
+          ip: "10.0.0.3",
+          whitelist: ["10.0.0.1", "10.0.0.2", "10.0.0.3", "10.0.0.4"],
+        }),
+      ).toBe(true);
+    });
+
+    it("tolerates surrounding whitespace on an entry", () => {
+      /*
+       * Entries come from splitting a textarea on newlines, so a trailing
+       * \r or a stray space is routine.
+       */
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["  10.0.0.1  "] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.1\r"] }),
+      ).toBe(true);
+    });
+  });
+
+  describe("CIDR ranges", () => {
+    it("matches an address inside the range", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.4.5.6", whitelist: ["10.0.0.0/8"] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({ ip: "192.168.1.55", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(true);
+    });
+
+    it("does not match an address outside the range", () => {
+      expect(
+        IP.isInWhitelist({ ip: "11.4.5.6", whitelist: ["10.0.0.0/8"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "192.168.2.55", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(false);
+    });
+
+    it("handles the boundaries of a range", () => {
+      expect(
+        IP.isInWhitelist({ ip: "192.168.1.0", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({
+          ip: "192.168.1.255",
+          whitelist: ["192.168.1.0/24"],
+        }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({
+          ip: "192.168.0.255",
+          whitelist: ["192.168.1.0/24"],
+        }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "192.168.2.0", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(false);
+    });
+
+    it("treats /32 as an exact match", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.1/32"] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.2", whitelist: ["10.0.0.1/32"] }),
+      ).toBe(false);
+    });
+
+    it("never matches an IPv6 address against an IPv4 CIDR", () => {
+      expect(
+        IP.isInWhitelist({ ip: "2001:db8::1", whitelist: ["0.0.0.0/1"] }),
+      ).toBe(false);
+    });
+
+    it("skips malformed CIDR entries instead of matching on them", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.0/"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.0/33"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.0/abc"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["not-an-ip/8"] }),
+      ).toBe(false);
+    });
+
+    it("keeps checking later entries after a malformed one", () => {
+      expect(
+        IP.isInWhitelist({
+          ip: "10.0.0.1",
+          whitelist: ["10.0.0.0/99", "", "10.0.0.1"],
+        }),
+      ).toBe(true);
+    });
+  });
+
+  describe("empty and invalid input", () => {
+    it("denies when the allowlist is empty", () => {
+      expect(IP.isInWhitelist({ ip: "10.0.0.1", whitelist: [] })).toBe(false);
+    });
+
+    it("denies when the allowlist holds only blank entries", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["", "   ", "\n"] }),
+      ).toBe(false);
+    });
+
+    it("throws rather than guessing when the address is not an address", () => {
+      /*
+       * Callers making an access decision treat a throw as a denial; the
+       * services wrap this in a fail-closed catch.
+       */
+      for (const notAnIp of ["unknown", "", "10.0.0", "10.0.0.256", "abc"]) {
+        expect(() => {
+          return IP.isInWhitelist({ ip: notAnIp, whitelist: ["10.0.0.1"] });
+        }).toThrow(BadDataException);
+      }
+    });
+
+    it("checks the empty allowlist before validating the address", () => {
+      /*
+       * No allowlist means no restriction to evaluate, so an unparseable
+       * address is not an error worth raising.
+       */
+      expect(IP.isInWhitelist({ ip: "unknown", whitelist: [] })).toBe(false);
+    });
+  });
+});

package/Tests/Types/IP/IPv6.test.ts

@@ -2,10 +2,21 @@ import IP from "../../../Types/IP/IPv6";
 
 describe("IPv6()", () => {
   test("should be IPv6", () => {
-    const ip: IP = new IP("2001:0db8:85a3:::8a2e:0370:7334");
+    const ip: IP = new IP("2001:0db8:85a3::8a2e:0370:7334");
     expect(ip.isIPv6()).toBeTruthy();
   });
 
+  /*
+   * This address used to be accepted: a triple colon is not valid IPv6, but
+   * the validator was unanchored and matched the address-shaped substring
+   * inside it.
+   */
+  test("should reject an address with a triple colon", () => {
+    expect(() => {
+      new IP("2001:0db8:85a3:::8a2e:0370:7334");
+    }).toThrow("IP is not a valid address");
+  });
+
   test("should not be IPv4", () => {
     const ip: IP = new IP("2001:0db8:85a3:0000:0000:8a2e:0370:7334");
     expect(ip.isIPv4()).toBeFalsy();

package/Tests/Types/Monitor/SnmpOid.test.ts

@@ -0,0 +1,64 @@
+import SnmpOid, {
+  SnmpOidTemplates,
+} from "../../../Types/Monitor/SnmpMonitor/SnmpOid";
+
+/*
+ * The common-OID list is shipped as the starting point an operator picks from
+ * when building an SNMP monitor, so a typo'd OID or a duplicated entry is a
+ * silently wrong default. These invariants keep the list honest.
+ */
+describe("SnmpOidTemplates.getCommonOids", () => {
+  const oids: Array<SnmpOid> = SnmpOidTemplates.getCommonOids();
+
+  test("returns a non-empty list", () => {
+    expect(oids.length).toBeGreaterThan(0);
+  });
+
+  test("every entry is a dotted numeric OID", () => {
+    for (const entry of oids) {
+      expect(entry.oid).toMatch(/^\d+(\.\d+)+$/);
+    }
+  });
+
+  test("every entry carries a human name and description", () => {
+    for (const entry of oids) {
+      expect(entry.name && entry.name.trim().length).toBeTruthy();
+      expect(entry.description && entry.description.trim().length).toBeTruthy();
+    }
+  });
+
+  test("OIDs are unique", () => {
+    const seen: Set<string> = new Set<string>(
+      oids.map((entry: SnmpOid) => {
+        return entry.oid;
+      }),
+    );
+
+    expect(seen.size).toBe(oids.length);
+  });
+
+  test("names are unique", () => {
+    const names: Array<string> = oids.map((entry: SnmpOid) => {
+      return entry.name as string;
+    });
+
+    expect(new Set<string>(names).size).toBe(names.length);
+  });
+
+  test("includes the system-description OID every SNMP agent exposes", () => {
+    const sysDescr: SnmpOid | undefined = oids.find((entry: SnmpOid) => {
+      return entry.name === "sysDescr";
+    });
+
+    expect(sysDescr?.oid).toBe("1.3.6.1.2.1.1.1.0");
+  });
+
+  test("returns a fresh array each call (callers may mutate their copy)", () => {
+    expect(SnmpOidTemplates.getCommonOids()).not.toBe(
+      SnmpOidTemplates.getCommonOids(),
+    );
+    expect(SnmpOidTemplates.getCommonOids()).toEqual(
+      SnmpOidTemplates.getCommonOids(),
+    );
+  });
+});

package/Tests/Types/NetworkDevice/NetworkDeviceMonitoringMethod.test.ts

@@ -0,0 +1,110 @@
+import NetworkDeviceMonitoringMethod, {
+  NetworkDeviceMonitoringMethodUtil,
+} from "../../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
+
+/*
+ * The column is free text and pre-existing rows hold NULL, so the whole point
+ * of the util is that anything it does not positively recognise as
+ * monitor-backed reads as SNMP. Getting that default wrong silently stops a
+ * device being polled, which is why it is worth pinning down every branch.
+ */
+describe("NetworkDeviceMonitoringMethod enum", () => {
+  test("Snmp is the string SNMP", () => {
+    expect(NetworkDeviceMonitoringMethod.Snmp).toBe("SNMP");
+  });
+
+  test("Monitor is the string Monitor", () => {
+    expect(NetworkDeviceMonitoringMethod.Monitor).toBe("Monitor");
+  });
+
+  test("has exactly the two known methods", () => {
+    expect(Object.values(NetworkDeviceMonitoringMethod).sort()).toEqual([
+      "Monitor",
+      "SNMP",
+    ]);
+  });
+});
+
+describe("NetworkDeviceMonitoringMethodUtil.parse", () => {
+  test.each([null, undefined, "", "   "])(
+    "reads %p as Snmp (the legacy default)",
+    (value: string | null | undefined) => {
+      expect(NetworkDeviceMonitoringMethodUtil.parse(value)).toBe(
+        NetworkDeviceMonitoringMethod.Snmp,
+      );
+    },
+  );
+
+  test.each(["monitor", "Monitor", "MONITOR", "  monitor  ", "\tMoNiToR\n"])(
+    "reads %p as Monitor, case- and whitespace-insensitively",
+    (value: string) => {
+      expect(NetworkDeviceMonitoringMethodUtil.parse(value)).toBe(
+        NetworkDeviceMonitoringMethod.Monitor,
+      );
+    },
+  );
+
+  test.each(["SNMP", "snmp", "Snmp", " snmp "])(
+    "reads the SNMP spelling %p as Snmp",
+    (value: string) => {
+      expect(NetworkDeviceMonitoringMethodUtil.parse(value)).toBe(
+        NetworkDeviceMonitoringMethod.Snmp,
+      );
+    },
+  );
+
+  test.each(["ping", "unknown", "monitor-backed", "monitors", "SNMPv3", "0"])(
+    "falls back to Snmp for the unrecognised value %p",
+    (value: string) => {
+      expect(NetworkDeviceMonitoringMethodUtil.parse(value)).toBe(
+        NetworkDeviceMonitoringMethod.Snmp,
+      );
+    },
+  );
+
+  test("does not treat a string merely containing 'monitor' as monitor-backed", () => {
+    // Only an exact (trimmed, lowercased) 'monitor' qualifies.
+    expect(NetworkDeviceMonitoringMethodUtil.parse("monitor device")).toBe(
+      NetworkDeviceMonitoringMethod.Snmp,
+    );
+  });
+});
+
+describe("NetworkDeviceMonitoringMethodUtil.isMonitorBacked", () => {
+  test.each(["monitor", "Monitor", "  MONITOR  "])(
+    "is true for %p",
+    (value: string) => {
+      expect(NetworkDeviceMonitoringMethodUtil.isMonitorBacked(value)).toBe(
+        true,
+      );
+    },
+  );
+
+  test.each([null, undefined, "", "SNMP", "snmp", "ping", "monitorish"])(
+    "is false for %p",
+    (value: string | null | undefined) => {
+      expect(NetworkDeviceMonitoringMethodUtil.isMonitorBacked(value)).toBe(
+        false,
+      );
+    },
+  );
+
+  test("agrees with parse for every input", () => {
+    const inputs: Array<string | null | undefined> = [
+      null,
+      undefined,
+      "",
+      "monitor",
+      "Monitor",
+      "SNMP",
+      "ping",
+    ];
+
+    for (const input of inputs) {
+      expect(NetworkDeviceMonitoringMethodUtil.isMonitorBacked(input)).toBe(
+        NetworkDeviceMonitoringMethodUtil.parse(input) ===
+          NetworkDeviceMonitoringMethod.Monitor,
+      );
+    }
+  });
+});