@oneuptime/common 12.0.8 → 12.0.9

package/Server/Utils/ClientIp.ts

@@ -0,0 +1,221 @@
+import { TrustedProxyHops } from "../EnvironmentConfig";
+import IP from "../../Types/IP/IP";
+import express from "express";
+
+/*
+ * Resolving the client IP address of an inbound request.
+ *
+ * `X-Forwarded-For` is a list, and only its RIGHT-hand end is trustworthy.
+ * Every proxy in the chain APPENDS the address of the peer it accepted the
+ * connection from -- our own Nginx uses `$proxy_add_x_forwarded_for` (see
+ * Nginx/default.conf.template) -- so the leftmost entries are whatever the
+ * original caller chose to send, verbatim.
+ *
+ * Reading the header left-to-right therefore reads attacker-supplied data. A
+ * caller who sends `X-Forwarded-For: <address-they-want-to-be>` arrives at the
+ * app as `["<address-they-want-to-be>", "<their-real-address>"]`, and anything
+ * that trusts the first entry -- or, worse, accepts a match against ANY entry
+ * -- can be told any address at all. That is a straight bypass of every
+ * IP-based control: dashboard and status page allowlists, and IP-keyed rate
+ * limits.
+ *
+ * Counting in from the right instead pins the read to an entry one of OUR
+ * proxies wrote. With the standard single-Nginx deployment the last entry is
+ * the address Nginx saw the connection come from, which is the real client.
+ * Each additional reverse proxy that we control and that appends to the header
+ * shifts the client one position further left, hence the configurable hop
+ * count.
+ *
+ * The trust boundary this relies on is the network one: the app must only be
+ * reachable through the proxies counted here. A caller who can open a
+ * connection to the app port directly is the peer, and no header discipline
+ * can help. Keep the app ports private.
+ */
+
+export type ClientIpRequestLike = Pick<express.Request, "headers"> & {
+  socket?: Partial<express.Request["socket"]> | undefined;
+  ip?: string | undefined;
+};
+
+/*
+ * Characters that may legitimately appear in a bare IPv4 or IPv6 literal.
+ * Anything else in a candidate means it is not an address we should try to
+ * interpret -- notably Nginx's `unknown` placeholder and RFC 7239's `_hidden`
+ * / `unknown` obfuscated identifiers.
+ */
+const IP_LITERAL_CHARACTERS: RegExp = /^[0-9a-fA-F:.]+$/;
+
+const IPV4_MAPPED_IPV6_PREFIX: RegExp = /^::ffff:(?=\d{1,3}(\.\d{1,3}){3}$)/i;
+
+/*
+ * No address is longer than this -- 45 is a full IPv4-mapped IPv6 literal,
+ * plus a little room for brackets and a port. Anything longer is not an
+ * address, and rejecting it up front keeps arbitrarily long header values away
+ * from IP.isIPv6's alternation-heavy pattern.
+ */
+const MAX_IP_CANDIDATE_LENGTH: number = 64;
+
+/*
+ * Normalize one X-Forwarded-For / socket address into a bare IP literal, or
+ * null when the value is not an address at all.
+ *
+ * Handles the shapes that legitimately reach us:
+ *  - surrounding whitespace and (non-standard, but seen) double quotes
+ *  - `[2001:db8::1]:443` -- bracketed IPv6 with a port
+ *  - `203.0.113.7:51234` -- IPv4 with a port, which some proxies emit
+ *  - `::ffff:203.0.113.7` -- the IPv4-mapped IPv6 form Node reports for
+ *    `socket.remoteAddress` on a dual-stack listener. Left as-is it would
+ *    never match an IPv4 allowlist entry or CIDR.
+ */
+export const normalizeIpCandidate: (
+  candidate: string | undefined | null,
+) => string | null = (candidate: string | undefined | null): string | null => {
+  if (!candidate || candidate.length > MAX_IP_CANDIDATE_LENGTH) {
+    return null;
+  }
+
+  let value: string = candidate.trim().replace(/^"|"$/g, "").trim();
+
+  if (!value) {
+    return null;
+  }
+
+  // `[2001:db8::1]` or `[2001:db8::1]:443`
+  const bracketed: RegExpMatchArray | null = value.match(
+    /^\[([^\]]+)\](:\d+)?$/,
+  );
+  if (bracketed && bracketed[1]) {
+    value = bracketed[1];
+  }
+
+  /*
+   * `203.0.113.7:51234`. Only strip when there is exactly one colon --
+   * more than one means IPv6, where a trailing `:<port>` is ambiguous
+   * without brackets and is not stripped.
+   */
+  if (value.split(":").length === 2 && value.includes(".")) {
+    value = value.split(":")[0] || "";
+  }
+
+  value = value.replace(IPV4_MAPPED_IPV6_PREFIX, "");
+
+  if (!value || !IP_LITERAL_CHARACTERS.test(value)) {
+    return null;
+  }
+
+  /*
+   * IP.isIP is the final arbiter, but its IPv6 pattern is unanchored, so the
+   * character-class guard above is what stops a substring match from letting
+   * junk through.
+   */
+  if (!IP.isIP(value)) {
+    return null;
+  }
+
+  return value;
+};
+
+/*
+ * Split X-Forwarded-For into positional entries WITHOUT dropping anything.
+ *
+ * Position is the whole point: entries are counted from the right, and
+ * silently discarding an unparseable entry would shift every entry to its left
+ * one place closer to the right-hand end. An attacker chooses the left-hand
+ * entries, so filtering here would hand them a way to slide their own value
+ * into the position we read.
+ */
+const getForwardedForEntries: (req: ClientIpRequestLike) => Array<string> = (
+  req: ClientIpRequestLike,
+): Array<string> => {
+  const header: string | Array<string> | undefined = req.headers?.[
+    "x-forwarded-for"
+  ] as string | Array<string> | undefined;
+
+  if (header === undefined || header === null) {
+    return [];
+  }
+
+  /*
+   * Node exposes a repeated header as an array. Repeated X-Forwarded-For
+   * headers are equivalent to one comma-joined header (RFC 7230 3.2.2), and
+   * they join in wire order -- so the rightmost entry of the last header is
+   * still the entry our proxy appended.
+   */
+  const raw: string = Array.isArray(header) ? header.join(",") : header;
+
+  if (!raw.trim()) {
+    return [];
+  }
+
+  return raw.split(",");
+};
+
+export interface ResolveClientIpOptions {
+  /*
+   * How many proxies that we control sit in front of this process and append
+   * to X-Forwarded-For. Defaults to the TRUSTED_PROXY_HOPS environment
+   * variable. 0 disables the header entirely and uses only the transport peer.
+   */
+  trustedProxyHops?: number | undefined;
+}
+
+/*
+ * The address to attribute a request to for SECURITY decisions -- allowlists,
+ * blocklists, IP-keyed rate limits.
+ *
+ * Returns undefined when no address can be established. Callers making a
+ * security decision must treat undefined as "deny": there is no safe default
+ * address.
+ */
+export const resolveClientIp: (
+  req: ClientIpRequestLike,
+  options?: ResolveClientIpOptions,
+) => string | undefined = (
+  req: ClientIpRequestLike,
+  options?: ResolveClientIpOptions,
+): string | undefined => {
+  const configuredHops: number =
+    options?.trustedProxyHops === undefined
+      ? TrustedProxyHops
+      : options.trustedProxyHops;
+
+  const hops: number =
+    Number.isFinite(configuredHops) && configuredHops > 0
+      ? Math.floor(configuredHops)
+      : 0;
+
+  /*
+   * The transport peer. Never forgeable, but it is the closest proxy rather
+   * than the client whenever the request actually came through one.
+   */
+  const peer: string | null =
+    normalizeIpCandidate(req.socket?.remoteAddress) ||
+    normalizeIpCandidate(req.ip);
+
+  if (hops === 0) {
+    return peer || undefined;
+  }
+
+  const entries: Array<string> = getForwardedForEntries(req);
+
+  if (entries.length >= hops) {
+    /*
+     * Count in from the right: with one trusted proxy this is the last entry,
+     * the one Nginx appended from $remote_addr.
+     *
+     * Fail closed on an unparseable entry rather than walking further left --
+     * everything to the left of this position is caller-supplied.
+     */
+    return normalizeIpCandidate(entries[entries.length - hops]) || undefined;
+  }
+
+  /*
+   * Fewer entries than there are trusted proxies: this request did not
+   * traverse the expected chain (a direct call to the app port, an internal
+   * health check, a misconfigured deployment). Nothing in the header is
+   * corroborated, so use only the peer.
+   */
+  return peer || undefined;
+};
+
+export default resolveClientIp;

package/Server/Utils/Dashboard/PublicDashboardResourceListPolicy.ts

@@ -10,6 +10,9 @@ import DashboardVariable, {
 import BadDataException from "../../../Types/Exception/BadDataException";
 import { JSONObject, JSONValue } from "../../../Types/JSON";
 import JSONFunctions from "../../../Types/JSONFunctions";
+import PublicDashboardSloWidget, {
+  PublicDashboardSloWidgetConfig,
+} from "./PublicDashboardSloWidget";
 import {
   LogFilter,
   queryStringToFilter,
@@ -473,6 +476,24 @@ export default class PublicDashboardResourceListPolicy {
           severityText: true,
           body: true,
         };
+      /*
+       * Exactly the seven display fields the SLO widget renders. Everything
+       * else the model carries — description, slug, the bound monitors and
+       * labels, the metric query config, the evaluation schedule, createdBy —
+       * stays private: an SLO's headline numbers are publishable, its
+       * definition is not.
+       */
+      case DashboardComponentType.Slo:
+        return {
+          _id: true,
+          name: true,
+          targetPercentage: true,
+          currentSliPercentage: true,
+          errorBudgetRemainingPercentage: true,
+          errorBudgetRemainingSeconds: true,
+          currentBurnRate: true,
+          sloStatus: true,
+        };
       default:
         throw new BadDataException(
           "This dashboard widget cannot list public resources.",
@@ -676,6 +697,10 @@ export default class PublicDashboardResourceListPolicy {
           argumentsObject,
           requestedQuery,
         });
+      case DashboardComponentType.Slo:
+        return PublicDashboardResourceListPolicy.buildSloPolicy(
+          argumentsObject,
+        );
       default:
         throw new BadDataException(
           `Unsupported public dashboard resource widget: ${componentType}`,
@@ -1394,6 +1419,28 @@ export default class PublicDashboardResourceListPolicy {
     };
   }
 
+  /*
+   * The SLO widget renders exactly one SLO — the one its author picked — so
+   * the stored id IS the whole query. Pinning `_id` to it and capping the
+   * read at a single row means the route can return that SLO's headline
+   * numbers and nothing else: it can neither be walked across the project's
+   * other SLOs nor turned into a filter oracle, because it accepts no filter
+   * at all.
+   */
+  private static buildSloPolicy(
+    argumentsObject: Record<string, unknown>,
+  ): PolicyDraft {
+    const config: PublicDashboardSloWidgetConfig =
+      PublicDashboardSloWidget.readConfigFromArguments(argumentsObject);
+
+    return {
+      resourceType: "slo",
+      query: { _id: config.serviceLevelObjectiveId },
+      sort: { name: SortOrder.Ascending },
+      limit: 1,
+    };
+  }
+
   private static listDraft(data: {
     resourceType: string;
     query: Record<string, unknown>;

package/Server/Utils/Dashboard/PublicDashboardSloHistoryPolicy.ts

@@ -0,0 +1,163 @@
+import AggregationInterval from "../../../Types/BaseDatabase/AggregationInterval";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import OneUptimeDate from "../../../Types/Date";
+import { SloWidgetDisplayType } from "../../../Types/Dashboard/DashboardComponents/DashboardSloComponent";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import {
+  getSloChartAggregationInterval,
+  getSloHistoryMetricName,
+} from "../../../Utils/Slo/SloWidgetFormat";
+import PublicDashboardSloWidget, {
+  PublicDashboardSloWidgetConfig,
+} from "./PublicDashboardSloWidget";
+
+/*
+ * Server-owned policy for the unauthenticated SLO history aggregation.
+ *
+ * Same contract as PublicDashboardResourceListPolicy: nothing the caller
+ * sends becomes part of the query except the time window. WHICH SLO and
+ * WHICH of its three series are read come from the stored widget alone, the
+ * aggregation columns are fixed, and the bucket size is recomputed from the
+ * window with the very same helper the widget uses — so a public viewer's
+ * only lever is "which slice of the series the dashboard already publishes
+ * do I want to see".
+ */
+export interface PublicDashboardSloHistoryPolicyResult {
+  serviceLevelObjectiveId: ObjectID;
+  /** SloHistory.metricName for the widget's chosen series. */
+  metricName: string;
+  startDate: Date;
+  endDate: Date;
+  aggregationInterval: AggregationInterval;
+  limit: number;
+}
+
+export interface BuildPublicDashboardSloHistoryPolicyData {
+  widget: unknown;
+  /** The caller's `aggregateBy`, already JSONFunctions.deserialize'd. */
+  requestedAggregateBy: unknown;
+}
+
+/*
+ * The furthest back a window is allowed to reach. 400 days is SloHistory's
+ * own TTL (see the ttlExpression on the model), so anything older can only
+ * return empty buckets anyway — bounding it here is what stops a hand-rolled
+ * request from asking ClickHouse to grid out centuries.
+ *
+ * A longer window is CLAMPED, not refused. The range picker on a public
+ * dashboard offers an unbounded custom range, and the sibling widgets — the
+ * metric charts on the very same page — just render whatever that range
+ * holds. Throwing here would make one widget show a server error string
+ * while its neighbours drew fine, purely because the viewer is anonymous.
+ */
+const MAX_WINDOW_IN_DAYS: number = 400;
+const MAX_WINDOW_IN_MINUTES: number = MAX_WINDOW_IN_DAYS * 24 * 60;
+
+export default class PublicDashboardSloHistoryPolicy {
+  public static build(
+    data: BuildPublicDashboardSloHistoryPolicyData,
+  ): PublicDashboardSloHistoryPolicyResult {
+    const config: PublicDashboardSloWidgetConfig =
+      PublicDashboardSloWidget.readConfig(data.widget);
+
+    /*
+     * Only a Chart widget publishes the SERIES. A Tile widget publishes the
+     * SLO's current numbers and nothing more, so serving 400 days of history
+     * for one would hand out history its author never put on the page.
+     */
+    if (config.displayType !== SloWidgetDisplayType.Chart) {
+      throw new BadDataException(
+        "This dashboard widget does not chart SLO history.",
+      );
+    }
+
+    const requestedAggregateBy: Record<string, unknown> =
+      PublicDashboardSloHistoryPolicy.requireObject(
+        data.requestedAggregateBy,
+        "aggregateBy",
+      );
+
+    const startDate: Date = PublicDashboardSloHistoryPolicy.validDate(
+      requestedAggregateBy["startTimestamp"],
+      "startTimestamp",
+    );
+    const endDate: Date = PublicDashboardSloHistoryPolicy.validDate(
+      requestedAggregateBy["endTimestamp"],
+      "endTimestamp",
+    );
+
+    /*
+     * An inverted or zero-length window is not a range the picker can
+     * produce — it only ever comes from a hand-rolled request, and there is
+     * no sensible slice of history to answer it with.
+     */
+    if (startDate.getTime() >= endDate.getTime()) {
+      throw new BadDataException(
+        "Public dashboard SLO history range is invalid.",
+      );
+    }
+
+    const clampedStartDate: Date =
+      OneUptimeDate.getMinutesBetweenTwoDates(startDate, endDate) >
+      MAX_WINDOW_IN_MINUTES
+        ? new Date(endDate.getTime() - MAX_WINDOW_IN_MINUTES * 60 * 1000)
+        : startDate;
+
+    const rangeInMinutes: number = OneUptimeDate.getMinutesBetweenTwoDates(
+      clampedStartDate,
+      endDate,
+    );
+
+    return {
+      serviceLevelObjectiveId: config.serviceLevelObjectiveId,
+      metricName: getSloHistoryMetricName(config.sloMetric),
+      startDate: clampedStartDate,
+      endDate,
+      /*
+       * Recomputed, never copied. The widget derives its bucket size from
+       * the same window with the same helper, so the client still gets the
+       * grid it drew its x-axis for — without being able to choose one.
+       */
+      aggregationInterval: getSloChartAggregationInterval(rangeInMinutes),
+      limit: LIMIT_PER_PROJECT,
+    };
+  }
+
+  private static validDate(value: unknown, key: string): Date {
+    if (value instanceof Date && Number.isFinite(value.getTime())) {
+      return new Date(value.getTime());
+    }
+
+    if (typeof value === "string" && value.length <= 128) {
+      const date: Date = new Date(value);
+
+      if (Number.isFinite(date.getTime())) {
+        return date;
+      }
+    }
+
+    throw new BadDataException(
+      `Public dashboard SLO history ${key} is not a valid date.`,
+    );
+  }
+
+  /*
+   * Returns an OWN-properties copy. JSON.parse turns a literal "__proto__"
+   * member into a real own key and JSONFunctions.deserialize copies it with
+   * `newVal[key] = …`, which fires Object.prototype's __proto__ setter — so a
+   * plain `object["startTimestamp"]` lookup would walk the prototype chain
+   * and read something the caller never sent as an own key. Copying first
+   * means every field this policy reads is a field that was really there.
+   */
+  private static requireObject(
+    value: unknown,
+    label: string,
+  ): Record<string, unknown> {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new BadDataException(`${label} must be an object.`);
+    }
+
+    return { ...(value as Record<string, unknown>) };
+  }
+}

package/Server/Utils/Dashboard/PublicDashboardSloWidget.ts

@@ -0,0 +1,147 @@
+import {
+  SloWidgetDisplayType,
+  SloWidgetMetric,
+} from "../../../Types/Dashboard/DashboardComponents/DashboardSloComponent";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * The stored configuration of ONE SLO widget, read back from the dashboard's
+ * JSON column.
+ *
+ * Two unauthenticated routes are driven by this config — the resource-list
+ * read that returns the SLO's current numbers, and the SloHistory aggregation
+ * that returns its series — so both must agree on exactly which SLO and which
+ * series the widget's author published. Parsing it once here is what keeps
+ * them from drifting apart.
+ *
+ * Everything here comes out of a JSONB column that an older (or hand-edited)
+ * client may have written, so nothing is trusted to be well typed.
+ */
+export interface PublicDashboardSloWidgetConfig {
+  serviceLevelObjectiveId: ObjectID;
+  sloMetric: SloWidgetMetric;
+  displayType: SloWidgetDisplayType;
+}
+
+export default class PublicDashboardSloWidget {
+  /** Read the config off a whole stored widget (`{ arguments: { … } }`). */
+  public static readConfig(widget: unknown): PublicDashboardSloWidgetConfig {
+    return PublicDashboardSloWidget.readConfigFromArguments(
+      PublicDashboardSloWidget.readArguments(widget),
+    );
+  }
+
+  /** Read the config off a widget's already-extracted `arguments` object. */
+  public static readConfigFromArguments(
+    argumentsObject: Record<string, unknown>,
+  ): PublicDashboardSloWidgetConfig {
+    return {
+      serviceLevelObjectiveId:
+        PublicDashboardSloWidget.readServiceLevelObjectiveId(argumentsObject),
+      sloMetric: PublicDashboardSloWidget.readSloMetric(argumentsObject),
+      displayType: PublicDashboardSloWidget.readDisplayType(argumentsObject),
+    };
+  }
+
+  private static readArguments(widget: unknown): Record<string, unknown> {
+    if (!widget || typeof widget !== "object" || Array.isArray(widget)) {
+      throw new BadDataException("Dashboard widget must be an object.");
+    }
+
+    const argumentsObject: unknown = (widget as Record<string, unknown>)[
+      "arguments"
+    ];
+
+    if (
+      !argumentsObject ||
+      typeof argumentsObject !== "object" ||
+      Array.isArray(argumentsObject)
+    ) {
+      throw new BadDataException(
+        "Dashboard widget arguments must be an object.",
+      );
+    }
+
+    return argumentsObject as Record<string, unknown>;
+  }
+
+  /*
+   * The SLO the widget's author picked IS the authorization decision: the id
+   * comes only from stored config, never from the request, so this endpoint
+   * can never be pointed at another SLO in the project.
+   */
+  private static readServiceLevelObjectiveId(
+    argumentsObject: Record<string, unknown>,
+  ): ObjectID {
+    const serviceLevelObjectiveId: unknown =
+      argumentsObject["serviceLevelObjectiveId"];
+
+    if (
+      typeof serviceLevelObjectiveId !== "string" ||
+      serviceLevelObjectiveId.trim().length === 0
+    ) {
+      throw new BadDataException(
+        "This dashboard widget has no Service Level Objective selected.",
+      );
+    }
+
+    const trimmed: string = serviceLevelObjectiveId.trim();
+
+    ObjectID.validateUUID(trimmed);
+
+    return new ObjectID(trimmed);
+  }
+
+  /*
+   * Sli is the widget's own default, and these arguments come out of a JSONB
+   * column that a dashboard created through the CRUD API — or hand-edited —
+   * may simply have written without them, so an absent value is not an error.
+   * An unrecognised value IS, rather than silently falling back: a stored
+   * string that is not one of the three series should never be able to
+   * quietly become "SLI" on a public page.
+   */
+  private static readSloMetric(
+    argumentsObject: Record<string, unknown>,
+  ): SloWidgetMetric {
+    const sloMetric: unknown = argumentsObject["sloMetric"];
+
+    if (sloMetric === undefined || sloMetric === null || sloMetric === "") {
+      return SloWidgetMetric.Sli;
+    }
+
+    if (
+      typeof sloMetric !== "string" ||
+      !(Object.values(SloWidgetMetric) as Array<string>).includes(sloMetric)
+    ) {
+      throw new BadDataException("Dashboard widget sloMetric is invalid.");
+    }
+
+    return sloMetric as SloWidgetMetric;
+  }
+
+  private static readDisplayType(
+    argumentsObject: Record<string, unknown>,
+  ): SloWidgetDisplayType {
+    const displayType: unknown = argumentsObject["displayType"];
+
+    if (
+      displayType === undefined ||
+      displayType === null ||
+      displayType === ""
+    ) {
+      return SloWidgetDisplayType.Tile;
+    }
+
+    if (
+      typeof displayType !== "string" ||
+      !(Object.values(SloWidgetDisplayType) as Array<string>).includes(
+        displayType,
+      )
+    ) {
+      throw new BadDataException("Dashboard widget displayType is invalid.");
+    }
+
+    return displayType as SloWidgetDisplayType;
+  }
+}

package/Server/Utils/Express.ts

@@ -1,4 +1,5 @@
 import logger from "./Logger";
+import { resolveClientIp } from "./ClientIp";
 import GracefulShutdown, { ShutdownPriority } from "./GracefulShutdown";
 import Dictionary from "../../Types/Dictionary";
 import GenericFunction from "../../Types/GenericFunction";
@@ -233,24 +234,18 @@ export const extractDeviceInfo: (req: ExpressRequest) => RequestDeviceInfo = (
   return result;
 };
 
+/*
+ * The client address for a request.
+ *
+ * This used to return the leftmost X-Forwarded-For entry, which is the one
+ * value in the header that the caller writes themselves -- so every session
+ * row and audit record built from it recorded whatever address the caller
+ * chose. It now delegates to resolveClientIp, which reads in from the trusted
+ * (right-hand) end instead. See Utils/ClientIp for the reasoning and the
+ * TRUSTED_PROXY_HOPS knob.
+ */
 export const getClientIp: (req: ExpressRequest) => string | undefined = (
   req: ExpressRequest,
 ): string | undefined => {
-  const forwarded: string | Array<string> | undefined = req.headers[
-    "x-forwarded-for"
-  ] as string | Array<string> | undefined;
-
-  if (Array.isArray(forwarded) && forwarded.length > 0) {
-    return forwarded[0]?.split(",")[0]?.trim();
-  }
-
-  if (typeof forwarded === "string" && forwarded.trim().length > 0) {
-    return forwarded.split(",")[0]?.trim();
-  }
-
-  if (req.socket?.remoteAddress) {
-    return req.socket.remoteAddress;
-  }
-
-  return req.ip;
+  return resolveClientIp(req);
 };