@oneuptime/common 13.0.8 → 14.0.1

package/Tests/Types/API/HostnameFromAuthority.test.ts

@@ -12,8 +12,10 @@ import { describe, expect, test } from "@jest/globals";
  * consumer, which is why a monitor on a non-443 port could never connect —
  * see https://github.com/OneUptime/oneuptime/issues/3225.
  *
- * fromString() is NOT a substitute: it splits on the FIRST colon, which
- * mangles every IPv6 literal.
+ * fromString() used not to be a substitute: it split on the FIRST colon,
+ * which mangled every IPv6 literal. It now delegates IPv6 authorities here
+ * instead, so the two agree on addresses; they still differ on a DNS host,
+ * where fromString keeps its own splitting and its own userinfo handling.
  */
 describe("Hostname.fromAuthority", () => {
   describe("host and port", () => {
@@ -141,18 +143,26 @@ describe("Hostname.fromAuthority", () => {
   });
 
   describe("contrast with fromString", () => {
-    test("fromString rejects an IPv6 literal that fromAuthority handles", () => {
+    test("fromString now agrees with fromAuthority on an IPv6 literal", () => {
       /*
-       * Pinned deliberately: it documents WHY fromAuthority exists, and
-       * guards against someone 'simplifying' one into the other.
+       * This case used to be pinned the other way round: fromString split on
+       * the FIRST colon, so "[::1]:8443" became a host of "[" and the setter
+       * threw. Worse, the unbracketed spelling did NOT throw -- it returned
+       * host "2001" / port 518 for "2001:518:2800:9::2" and a monitor was
+       * saved pointing at a host nobody typed.
        *
-       * fromString splits on the FIRST colon, so "[::1]:8443" becomes a
-       * host of "[" - which the Hostname setter rejects outright.
+       * fromString delegates IPv6 authorities to fromAuthority now, so the
+       * two agree. Kept as a contrast test so a future 'simplification' that
+       * reintroduces the split fails here.
        */
       expect(Hostname.fromAuthority("[::1]:8443").hostname).toBe("[::1]");
-      expect(() => {
-        return Hostname.fromString("[::1]:8443");
-      }).toThrow();
+      expect(Hostname.fromString("[::1]:8443").hostname).toBe("[::1]");
+      expect(Hostname.fromString("[::1]:8443").port?.toNumber()).toBe(8443);
+
+      expect(Hostname.fromString("2001:518:2800:9::2").hostname).toBe(
+        "2001:518:2800:9::2",
+      );
+      expect(Hostname.fromString("2001:518:2800:9::2").port).toBeUndefined();
     });
 
     test("both agree on the simple host:port case", () => {

package/Tests/Types/API/HostnameIPv6.test.ts

@@ -0,0 +1,149 @@
+import Hostname from "../../../Types/API/Hostname";
+import URL from "../../../Types/API/URL";
+import { describe, expect, test } from "@jest/globals";
+import net from "net";
+
+/*
+ * Hostname's handling of IPv6 literals.
+ *
+ * fromString used to split on the FIRST colon, which is meaningless for an
+ * address made of colons. The damage was silent rather than loud: for the
+ * customer address reported below it
+ * returned host "2001" with port 518 — both legal — so nothing threw and the
+ * value the operator typed was simply gone.
+ */
+
+const CUSTOMER_ADDRESS: string = "2001:518:2800:9::2";
+
+describe("Hostname.fromString with an IPv6 literal", () => {
+  test("keeps the whole address instead of its first two groups", () => {
+    const hostname: Hostname = Hostname.fromString(CUSTOMER_ADDRESS);
+
+    expect(hostname.hostname).toBe(CUSTOMER_ADDRESS);
+    expect(hostname.port).toBeUndefined();
+    expect(hostname.toString()).toBe(CUSTOMER_ADDRESS);
+  });
+
+  test("specifically, it is not 2001 port 518", () => {
+    const hostname: Hostname = Hostname.fromString(CUSTOMER_ADDRESS);
+
+    expect(hostname.hostname).not.toBe("2001");
+    expect(hostname.port?.toNumber()).not.toBe(518);
+  });
+
+  test("trims, so a pasted address keeps working", () => {
+    expect(Hostname.fromString(`  ${CUSTOMER_ADDRESS}\n`).hostname).toBe(
+      CUSTOMER_ADDRESS,
+    );
+  });
+
+  test.each([
+    "::1",
+    "::",
+    "2001:db8::",
+    "::ffff:192.0.2.1",
+    "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
+  ])("survives the compressed form %s", (address: string) => {
+    expect(Hostname.fromString(address).hostname).toBe(address);
+  });
+
+  test("a bracketed literal keeps its brackets and gives up its port", () => {
+    const hostname: Hostname = Hostname.fromString(`[${CUSTOMER_ADDRESS}]:179`);
+
+    expect(hostname.hostname).toBe(`[${CUSTOMER_ADDRESS}]`);
+    expect(hostname.port?.toNumber()).toBe(179);
+  });
+
+  test("a value with two colons that is NOT an address is rejected rather than silently split", () => {
+    expect(() => {
+      return Hostname.fromString("example.com:80:90");
+    }).toThrow();
+  });
+});
+
+describe("Hostname.fromString — IPv4 and DNS are unchanged", () => {
+  test.each([
+    ["example.com", "example.com", undefined],
+    ["example.com:8443", "example.com", 8443],
+    ["192.0.2.1", "192.0.2.1", undefined],
+    ["192.0.2.1:179", "192.0.2.1", 179],
+    ["localhost:3000", "localhost", 3000],
+  ])(
+    "%s parses to host %s",
+    (value: string, expectedHost: string, expectedPort?: number) => {
+      const hostname: Hostname = Hostname.fromString(value);
+
+      expect(hostname.hostname).toBe(expectedHost);
+      expect(hostname.port?.toNumber()).toBe(expectedPort);
+    },
+  );
+});
+
+describe("Hostname.toString with a port", () => {
+  test("brackets an IPv6 host, because the unbracketed form is a different address", () => {
+    const hostname: Hostname = new Hostname(CUSTOMER_ADDRESS, 179);
+
+    expect(hostname.toString()).toBe(`[${CUSTOMER_ADDRESS}]:179`);
+
+    // What it used to produce, and why that was not merely ugly:
+    expect(net.isIP(`${CUSTOMER_ADDRESS}:179`)).toBe(6);
+    expect(hostname.toString()).not.toBe(`${CUSTOMER_ADDRESS}:179`);
+  });
+
+  test("the bracketed form re-parses to the same host and port", () => {
+    const roundTripped: Hostname = Hostname.fromString(
+      new Hostname(CUSTOMER_ADDRESS, 179).toString(),
+    );
+
+    expect(roundTripped.hostname).toBe(`[${CUSTOMER_ADDRESS}]`);
+    expect(roundTripped.port?.toNumber()).toBe(179);
+  });
+
+  test("an IPv4 or DNS host keeps the conventional spelling", () => {
+    expect(new Hostname("192.0.2.1", 179).toString()).toBe("192.0.2.1:179");
+    expect(new Hostname("example.com", 8443).toString()).toBe(
+      "example.com:8443",
+    );
+  });
+
+  test("without a port the host is returned exactly as held", () => {
+    expect(new Hostname(CUSTOMER_ADDRESS).toString()).toBe(CUSTOMER_ADDRESS);
+    expect(Hostname.fromAuthority("[::1]").toString()).toBe("[::1]");
+  });
+});
+
+describe("Hostname.isValid validates the address, not just its characters", () => {
+  test.each([CUSTOMER_ADDRESS, "::1", "[::1]", "[::1]:8080", "2001:db8::"])(
+    "accepts %s",
+    (value: string) => {
+      expect(Hostname.isValid(value)).toBe(true);
+    },
+  );
+
+  test.each([
+    "::::",
+    "2001:db8:::1",
+    "[not-an-address]",
+    "gggg::1",
+    "2001:db8::1::2",
+  ])(
+    "rejects %s, which the old character allowlist let through",
+    (value: string) => {
+      expect(Hostname.isValid(value)).toBe(false);
+    },
+  );
+});
+
+describe("URL.toString still emits a valid authority for an IPv6 host", () => {
+  test("brackets survive a round trip", () => {
+    expect(
+      URL.fromString(`https://[${CUSTOMER_ADDRESS}]/health`).toString(),
+    ).toBe(`https://[${CUSTOMER_ADDRESS}]/health`);
+  });
+
+  test("a bracketed host with a port survives a round trip", () => {
+    expect(
+      URL.fromString(`https://[${CUSTOMER_ADDRESS}]:8443/x`).toString(),
+    ).toBe(`https://[${CUSTOMER_ADDRESS}]:8443/x`);
+  });
+});

package/Tests/Types/API/Route.test.ts

@@ -59,4 +59,60 @@ describe("Route", () => {
   ])("preserves legitimate colon use in %s", (routeValue: string) => {
     expect(new Route(routeValue).toString()).toBe(routeValue);
   });
+
+  /*
+   * A Telegram token segment is scheme-like when it stands alone, so it is
+   * refused bare - but with its leading "/" it is an ordinary absolute path.
+   * URL.fromString relies on exactly this to keep Telegram URLs parseable.
+   */
+  test("accepts a token-like first segment once it has a leading slash", () => {
+    expect(() => {
+      return new Route("bot123456:ABC-def_ghi/sendMessage");
+    }).toThrowError(BadDataException);
+
+    expect(new Route("/bot123456:ABC-def_ghi/sendMessage").toString()).toBe(
+      "/bot123456:ABC-def_ghi/sendMessage",
+    );
+  });
+
+  test("addRoute prefixes the slash before validating a token-like string", () => {
+    expect(new Route("").addRoute("bot123456:ABC/sendMessage").toString()).toBe(
+      "/bot123456:ABC/sendMessage",
+    );
+    expect(new Route("/api").addRoute("bot1:x").toString()).toBe("/api/bot1:x");
+  });
+
+  test.each([
+    ["javascript:alert(1)", true],
+    ["JaVaScRiPt:alert(1)", true],
+    ["https://example.com", true],
+    ["bot123:ABC/sendMessage", true],
+    ["a.b+c-d:e", true],
+    ["/bot123:ABC/sendMessage", false],
+    ["api/:resourceId", false],
+    [":resourceId", false],
+    ["1:2/x", false],
+    ["_matrix/!room:server", false],
+    ["#frag:ment", false],
+    ["?next=a:b", false],
+    ["", false],
+  ])("hasSchemePrefix(%s) is %s", (routeValue: string, expected: boolean) => {
+    expect(Route.hasSchemePrefix(routeValue)).toBe(expected);
+  });
+
+  test.each(["/~user", "/files/~backup", "/a~b", "~user/hook", "/p?x=~y"])(
+    "accepts the unreserved character '~' in %s",
+    (routeValue: string) => {
+      expect(new Route(routeValue).toString()).toBe(routeValue);
+    },
+  );
+
+  test.each(["/a b", "/a|b", "/a`b", '/a"b', "/a<b", "/a>b", "/a\\b", "/a^b"])(
+    "still refuses the non-path character in %s",
+    (routeValue: string) => {
+      expect(() => {
+        return new Route(routeValue);
+      }).toThrowError(BadDataException);
+    },
+  );
 });

package/Tests/Types/API/URLSchemeLikePath.test.ts

@@ -0,0 +1,304 @@
+import Hostname from "../../../Types/API/Hostname";
+import Protocol from "../../../Types/API/Protocol";
+import Route from "../../../Types/API/Route";
+import URL from "../../../Types/API/URL";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Route refuses any value that starts with a scheme ("javascript:...", but
+ * equally "bot123:ABC/sendMessage"), so a scheme can never reach a navigation
+ * sink. URL.fromString stores a parsed path WITHOUT the "/" that separates it
+ * from the authority, and handed that bare path to Route. So any URL whose
+ * first path segment contains a ":" stopped parsing:
+ *
+ *   URL.fromString("https://api.telegram.org/bot123:ABC/sendMessage")
+ *     => BadDataException "Invalid route: bot123:ABC/sendMessage"
+ *
+ * Telegram puts the bot token - always "<id>:<secret>" - in exactly that
+ * segment. That broke the Telegram workflow component (and put the token in
+ * the run log), every API component call to Telegram, and every sandboxed
+ * axios call to Telegram, where the SSRF guard's parse failure surfaced as
+ * "Request URL is not a valid URL".
+ */
+
+// Same shape as a real token: 10-digit bot id, 35-character secret.
+const BOT_TOKEN: string = "8000000001:AAFakeFakeFakeFakeFakeFakeFake_-12345";
+const TELEGRAM_URL: string = `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`;
+
+describe("URL.fromString - Telegram Bot API URLs", () => {
+  test("parses the sendMessage URL instead of throwing Invalid route", () => {
+    expect(() => {
+      return URL.fromString(TELEGRAM_URL);
+    }).not.toThrow();
+  });
+
+  test("round-trips to exactly the string that was parsed", () => {
+    expect(URL.fromString(TELEGRAM_URL).toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("puts the whole bot token in the path, not in the host or port", () => {
+    const url: URL = URL.fromString(TELEGRAM_URL);
+
+    expect(url.protocol).toBe(Protocol.HTTPS);
+    expect(url.hostname.hostname).toBe("api.telegram.org");
+    expect(url.hostname.port).toBeUndefined();
+    expect(url.route.toString()).toBe(`/bot${BOT_TOKEN}/sendMessage`);
+  });
+
+  test("agrees with the WHATWG parser the HTTP client uses", () => {
+    const whatwg: globalThis.URL = new globalThis.URL(TELEGRAM_URL);
+    const url: URL = URL.fromString(TELEGRAM_URL);
+
+    expect(url.hostname.hostname).toBe(whatwg.hostname);
+    expect(url.route.toString()).toBe(whatwg.pathname);
+    expect(url.toString()).toBe(whatwg.href);
+  });
+
+  test.each([
+    "getMe",
+    "sendMessage",
+    "sendPhoto",
+    "getUpdates",
+    "setWebhook",
+    "getWebhookInfo",
+  ])("parses the %s method URL", (method: string) => {
+    const raw: string = `https://api.telegram.org/bot${BOT_TOKEN}/${method}`;
+
+    expect(URL.fromString(raw).toString()).toBe(raw);
+  });
+
+  test("keeps query parameters on a Telegram URL", () => {
+    const raw: string = `${TELEGRAM_URL}?chat_id=@mychannel&text=hello`;
+    const url: URL = URL.fromString(raw);
+
+    expect(url.route.toString()).toBe(`/bot${BOT_TOKEN}/sendMessage`);
+    expect(url.getQueryParam("chat_id")).toBe("@mychannel");
+    expect(url.getQueryParam("text")).toBe("hello");
+    expect(url.toString()).toBe(raw);
+  });
+
+  test("keeps the file download path, whose token is not the first segment", () => {
+    const raw: string = `https://api.telegram.org/file/bot${BOT_TOKEN}/photos/file_1.jpg`;
+
+    expect(URL.fromString(raw).toString()).toBe(raw);
+  });
+
+  test("fromStringLenient returns a real URL, not a malformed placeholder", () => {
+    const url: URL = URL.fromStringLenient(TELEGRAM_URL);
+
+    expect(url.isMalformed()).toBe(false);
+    expect(url.hostname.hostname).toBe("api.telegram.org");
+    expect(url.toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("survives fromURL, toJSON and fromJSON", () => {
+    const url: URL = URL.fromString(TELEGRAM_URL);
+
+    expect(URL.fromURL(url).toString()).toBe(TELEGRAM_URL);
+
+    const revived: URL = URL.fromJSON(url.toJSON());
+    expect(revived.isMalformed()).toBe(false);
+    expect(revived.toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("removeQueryString keeps the token path", () => {
+    const url: URL = URL.fromString(`${TELEGRAM_URL}?chat_id=1`);
+
+    expect(url.removeQueryString().toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("addQueryParam appends to a Telegram URL", () => {
+    const url: URL = URL.fromString(TELEGRAM_URL).addQueryParam(
+      "chat_id",
+      "@my channel",
+      true,
+    );
+
+    expect(url.toString()).toBe(`${TELEGRAM_URL}?chat_id=%40my%20channel`);
+  });
+
+  test("getLastRoute reads the method and the token segment", () => {
+    const url: URL = URL.fromString(TELEGRAM_URL);
+
+    expect(url.getLastRoute()?.toString()).toBe("/sendMessage");
+    expect(url.getLastRoute(1)?.toString()).toBe(`/bot${BOT_TOKEN}`);
+  });
+});
+
+describe("URL.fromString - any first path segment containing a ':'", () => {
+  test.each([
+    ["an id:secret pair", "https://example.com/abc:def"],
+    ["a URN", "https://example.com/urn:uuid:6e8bc430-9c3a-11d9-9669"],
+    ["a trailing slash", "https://example.com/bot1:abc/"],
+    ["a single segment", "https://example.com/bot1:abc"],
+    ["a port", "https://example.com:8443/bot1:abc/sendMessage"],
+    ["userinfo", "https://user:pw@example.com/bot1:abc/sendMessage"],
+    ["plain http", "http://example.com/bot1:abc/sendMessage"],
+    ["a fragment", "https://example.com/bot1:abc/sendMessage#top"],
+    ["a query", "https://example.com/bot1:abc/sendMessage?a=1&b=2"],
+    ["a dotted scheme-like name", "https://example.com/a.b+c-d:e/f"],
+  ])("parses and round-trips a path with %s", (_label: string, raw: string) => {
+    const url: URL = URL.fromString(raw);
+
+    expect(url.toString()).toBe(raw);
+  });
+
+  test("an uppercase scheme on the URL is normalised, the path is kept", () => {
+    const url: URL = URL.fromString(
+      "HTTPS://api.telegram.org/bot1:abc/sendMessage",
+    );
+
+    expect(url.toString()).toBe(
+      "https://api.telegram.org/bot1:abc/sendMessage",
+    );
+  });
+
+  test("a path that merely looks like a dangerous scheme stays a path", () => {
+    /*
+     * Before Route refused scheme-like values this parsed to a route of
+     * "javascript:alert(1)" - a value that is a live href on its own. It now
+     * keeps its "/", so the Route is a same-origin path and can never be
+     * mistaken for a scheme by anything that renders it.
+     */
+    const url: URL = URL.fromString("https://example.com/javascript:alert(1)");
+    const route: string = url.route.toString();
+
+    expect(url.hostname.hostname).toBe("example.com");
+    expect(route).toBe("/javascript:alert(1)");
+    expect(route.startsWith("/")).toBe(true);
+    expect(Route.hasSchemePrefix(route)).toBe(false);
+    expect(url.toString()).toBe("https://example.com/javascript:alert(1)");
+  });
+
+  test.each([
+    "https://example.com/bot1:abc/sendMessage",
+    "https://example.com/mailto:someone@example.com",
+    "https://example.com/data:text/plain,hi",
+    "https://example.com/urn:isbn:0451450523",
+  ])("the route of %s is never itself scheme-like", (raw: string) => {
+    expect(Route.hasSchemePrefix(URL.fromString(raw).route.toString())).toBe(
+      false,
+    );
+  });
+
+  test("the host is still read off the authority, never off the path", () => {
+    // The ":" in the path must not be mistaken for a host:port separator.
+    const url: URL = URL.fromString("https://10.0.0.5/bot1:80/sendMessage");
+
+    expect(url.hostname.hostname).toBe("10.0.0.5");
+    expect(url.hostname.port).toBeUndefined();
+  });
+});
+
+describe("URL.fromString - paths that already parsed are unchanged", () => {
+  /*
+   * The leading "/" is only kept when dropping it would make the path read as
+   * a scheme. Every other path keeps the bare representation it always had,
+   * so nothing that read url.route before this change sees a different value.
+   */
+  test.each([
+    ["https://example.com/api/v1/items", "api/v1/items"],
+    ["https://example.com/docs#section", "docs#section"],
+    ["https://example.com#section", "#section"],
+    ["https://example.com/p/", "p/"],
+    ["https://vision.googleapis.com/v1/images:annotate", "v1/images:annotate"],
+    ["https://example.com/api/:resourceId", "api/:resourceId"],
+    ["https://example.com/1:2/x", "1:2/x"],
+    [
+      "https://example.com/_matrix/client/v3/rooms/!r:m.org",
+      "_matrix/client/v3/rooms/!r:m.org",
+    ],
+    ["https://example.com/:leading-colon", ":leading-colon"],
+    ["https://example.com/events?at=12:30", "events"],
+    ["https://example.com", ""],
+    ["https://example.com/", ""],
+  ])("%s keeps route %s", (raw: string, expectedRoute: string) => {
+    expect(URL.fromString(raw).route.toString()).toBe(expectedRoute);
+  });
+});
+
+describe("URL.fromString - '~' in a path", () => {
+  /*
+   * "~" is an RFC 3986 unreserved character, but Route's character allowlist
+   * left it out, so "https://example.com/~user" could not be parsed - and the
+   * sandboxed axios bridge refused it as "Request URL is not a valid URL".
+   */
+  test.each([
+    "https://example.com/~user/hook",
+    "https://example.com/files/~backup",
+    "https://example.com/a~b/c",
+    "https://example.com/path?x=~y",
+  ])("parses and round-trips %s", (raw: string) => {
+    expect(URL.fromString(raw).toString()).toBe(raw);
+  });
+});
+
+describe("URL.addRoute with a scheme-like segment", () => {
+  test("appends a string segment that starts with a token", () => {
+    const url: URL = URL.fromString("https://api.telegram.org").addRoute(
+      `bot${BOT_TOKEN}/sendMessage`,
+    );
+
+    expect(url.toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("appends the same segment given with its leading slash", () => {
+    const url: URL = URL.fromString("https://api.telegram.org").addRoute(
+      `/bot${BOT_TOKEN}/sendMessage`,
+    );
+
+    expect(url.toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("appends a method to a URL that already ends in the token", () => {
+    const url: URL = URL.fromString(
+      `https://api.telegram.org/bot${BOT_TOKEN}`,
+    ).addRoute("sendMessage");
+
+    expect(url.toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("appends to a URL built from the constructor", () => {
+    const url: URL = new URL(
+      Protocol.HTTPS,
+      new Hostname("api.telegram.org"),
+    ).addRoute(`bot${BOT_TOKEN}/sendMessage`);
+
+    expect(url.toString()).toBe(TELEGRAM_URL);
+  });
+
+  test("still behaves as before for an ordinary segment", () => {
+    expect(
+      URL.fromString("https://example.com/api").addRoute("v1/items").toString(),
+    ).toBe("https://example.com/api/v1/items");
+    expect(
+      URL.fromString("https://example.com/api").addRoute("/v1").toString(),
+    ).toBe("https://example.com/api/v1");
+  });
+
+  test("still refuses characters no route may contain", () => {
+    expect(() => {
+      URL.fromString("https://example.com").addRoute("a b");
+    }).toThrowError(BadDataException);
+  });
+});
+
+describe("URL.fromString - the scheme checks are not loosened", () => {
+  test.each([
+    "javascript:alert(1)",
+    "data:text/html,<script>alert(1)</script>",
+    "file:///etc/passwd",
+    "ftp://example.com/bot1:abc/sendMessage",
+  ])("still refuses %s", (raw: string) => {
+    expect(() => {
+      return URL.fromString(raw);
+    }).toThrowError(BadDataException);
+  });
+
+  test("a bare scheme-like Route is still refused on its own", () => {
+    expect(() => {
+      return new Route(`bot${BOT_TOKEN}/sendMessage`);
+    }).toThrowError(BadDataException);
+  });
+});