@oneuptime/common 14.0.0 → 14.0.1

package/Tests/Server/Utils/Rules/RuleRun/RuleRunPermission.test.ts

@@ -363,3 +363,157 @@ describe("RuleRunPermission.assertCanRun", () => {
     }).toThrow(new BadDataException("This rule cannot be run."));
   });
 });
+
+/*
+ * SLO label and owner rules walk every SLO in the project as root, so running
+ * one needs the rule's edit permission, EditServiceLevelObjective, and - for
+ * owner rules - create on both SLO owner tables. Read off the real models'
+ * @TableAccessControl, like everything above.
+ */
+describe("RuleRunPermission.assertCanRun - SLO label and owner rules", () => {
+  it("lets a caller who can edit the rule and every SLO run an SLO label rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjectiveLabelRule,
+            Permission.EditServiceLevelObjective,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("refuses a caller who can edit SLOs but not the rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjective,
+            // Another SLO rule's permission is not this one's.
+            Permission.EditServiceLevelObjectiveMonitorRule,
+          ],
+        }),
+      );
+    }).toThrow(
+      "You do not have permission to edit this rule, which running it requires.",
+    );
+  });
+
+  it("refuses a rule author who cannot edit SLOs, naming them", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [Permission.EditServiceLevelObjectiveLabelRule],
+        }),
+      );
+    }).toThrow(
+      "You do not have permission to edit every SLO in this project, which running this rule does.",
+    );
+  });
+
+  it("does not let read access to the rule stand in for edit", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            Permission.ReadServiceLevelObjectiveOwnerRule,
+            Permission.EditServiceLevelObjective,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+            Permission.CreateServiceLevelObjectiveOwnerTeam,
+          ],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("requires create on both SLO owner tables for an SLO owner rule", () => {
+    const ruleAndSlo: Array<Permission> = [
+      Permission.EditServiceLevelObjectiveOwnerRule,
+      Permission.EditServiceLevelObjective,
+    ];
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({ permissions: ruleAndSlo }),
+      );
+    }).toThrow(
+      "You do not have permission to add owners to SLOs, which running this rule does.",
+    );
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            ...ruleAndSlo,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+          ],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            ...ruleAndSlo,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+            Permission.CreateServiceLevelObjectiveOwnerTeam,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  /*
+   * A run reaches every SLO, so an edit grant limited to the SLOs a user owns
+   * cannot authorize one.
+   */
+  it("does not count an Owned-scoped SLO edit grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjectiveLabelRule,
+            Permission.EditServiceLevelObjective,
+          ],
+          scope: PermissionScope.Owned,
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("honours a team's block list on SLOs, even over an admin grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [Permission.ProjectAdmin],
+          blockedPermissions: [Permission.EditServiceLevelObjective],
+        }),
+      );
+    }).toThrow(/permission block list/);
+  });
+
+  it("lets a project admin run both", () => {
+    for (const ruleType of [
+      RuleRunType.ServiceLevelObjectiveLabelRule,
+      RuleRunType.ServiceLevelObjectiveOwnerRule,
+    ]) {
+      expect(() => {
+        assertCanRun(
+          ruleType,
+          propsWith({ permissions: [Permission.ProjectAdmin] }),
+        );
+      }).not.toThrow();
+    }
+  });
+});

package/Tests/Server/Utils/SSRFProtection.test.ts

@@ -191,3 +191,114 @@ describe("SSRFProtection.validateWebhookTargetIsSafe", () => {
     });
   });
 });
+
+/*
+ * The guard parses the target with OneUptime's URL type as well as WHATWG, and
+ * turned any parse failure into "<label> is not a valid URL". That parser
+ * refused a first path segment containing a ":" - every Telegram Bot API URL,
+ * because the token is that segment - and any path containing "~". So the
+ * sandboxed axios bridge refused perfectly public requests as invalid URLs.
+ */
+describe("SSRFProtection with a ':' or '~' in the path", () => {
+  const BOT_TOKEN: string = "8000000001:AAFakeFakeFakeFakeFakeFakeFake_-12345";
+  const TELEGRAM_URL: string = `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`;
+  let lookupSpy: LookupSpy;
+
+  beforeEach(() => {
+    lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+    lookupSpy.mockResolvedValue([{ address: "149.154.167.220", family: 4 }]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("validateWebhookTargetIsSafe accepts a Telegram Bot API URL", async () => {
+    await expect(
+      SSRFProtection.validateWebhookTargetIsSafe(TELEGRAM_URL, {
+        targetLabel: "Request URL",
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(lookupSpy).toHaveBeenCalledWith("api.telegram.org", { all: true });
+  });
+
+  test("validateWebhookTargetIsSafe accepts the same URL as a URL object", async () => {
+    await expect(
+      SSRFProtection.validateWebhookTargetIsSafe(URL.fromString(TELEGRAM_URL)),
+    ).resolves.toBeUndefined();
+  });
+
+  test("validateAndResolveWebhookTarget keeps the token path and pins the address", async () => {
+    const target: Awaited<
+      ReturnType<typeof SSRFProtection.validateAndResolveWebhookTarget>
+    > = await SSRFProtection.validateAndResolveWebhookTarget(TELEGRAM_URL, {
+      targetLabel: "Request URL",
+    });
+
+    expect(target.url.toString()).toBe(TELEGRAM_URL);
+    expect(target.url.pathname).toBe(`/bot${BOT_TOKEN}/sendMessage`);
+    expect(target.addresses).toEqual([
+      { address: "149.154.167.220", family: 4 },
+    ]);
+  });
+
+  test.each([
+    "https://example.com/~user/hook",
+    "https://example.com/urn:uuid:6e8bc430-9c3a/x",
+    "https://example.com/abc:def",
+  ])("accepts the public URL %s", async (rawUrl: string) => {
+    await expect(
+      SSRFProtection.validateAndResolveWebhookTarget(rawUrl, {
+        targetLabel: "Request URL",
+      }),
+    ).resolves.toMatchObject({ url: new globalThis.URL(rawUrl) });
+  });
+
+  test.each([
+    [
+      "the metadata endpoint",
+      `http://169.254.169.254/bot${BOT_TOKEN}/sendMessage`,
+    ],
+    ["loopback", `http://127.0.0.1:8080/bot${BOT_TOKEN}/sendMessage`],
+    ["an RFC-1918 address", `http://10.0.0.5/bot${BOT_TOKEN}/sendMessage`],
+    ["IPv6 loopback", `http://[::1]/bot${BOT_TOKEN}/sendMessage`],
+  ])(
+    "still refuses %s behind a token path, for its host",
+    async (_label: string, rawUrl: string) => {
+      const validation: Promise<unknown> =
+        SSRFProtection.validateAndResolveWebhookTarget(rawUrl, {
+          targetLabel: "Request URL",
+        });
+
+      await expect(validation).rejects.toThrow(/private|loopback|link-local/);
+      await expect(validation).rejects.not.toThrow(/not a valid URL/);
+    },
+  );
+
+  test("still refuses a public name that resolves internally behind a token path", async () => {
+    lookupSpy.mockResolvedValue([{ address: "169.254.169.254", family: 4 }]);
+
+    await expect(
+      SSRFProtection.validateAndResolveWebhookTarget(TELEGRAM_URL, {
+        targetLabel: "Request URL",
+      }),
+    ).rejects.toThrow(/resolves to a private, loopback, or link-local/);
+  });
+
+  test("a refusal does not quote the token", async () => {
+    let message: string = "";
+
+    try {
+      await SSRFProtection.validateAndResolveWebhookTarget(
+        `http://169.254.169.254/bot${BOT_TOKEN}/sendMessage`,
+        { targetLabel: "Request URL" },
+      );
+    } catch (err) {
+      message = (err as Error).message;
+    }
+
+    expect(message).not.toBe("");
+    expect(message).not.toContain(BOT_TOKEN);
+  });
+});

package/Tests/Server/Utils/Slo/SloRulePatternValidator.test.ts

@@ -0,0 +1,67 @@
+import SloRulePatternValidator from "../../../../Server/Utils/Slo/SloRulePatternValidator";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Write-time pattern validation for SLO label and owner rules: the engines
+ * take a case-insensitive regex or a '*' wildcard, and anything else could
+ * only ever match nothing.
+ */
+describe("SloRulePatternValidator", () => {
+  it.each([
+    ["an anchored regex", "^checkout-.*$"],
+    ["an alternation", "checkout|payments"],
+    ["a leading wildcard", "*checkout"],
+    ["a wildcard on both sides", "*checkout*"],
+    ["a plain word", "checkout"],
+    // Not a regex, but the '*' makes it a wildcard.
+    ["a wildcard that is not a valid regex", "*api-(01*"],
+  ])("accepts %s", (_: string, pattern: string) => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: pattern,
+        descriptionPattern: pattern,
+      });
+    }).not.toThrow();
+  });
+
+  it.each([undefined, null, ""])(
+    "treats %p as no pattern at all",
+    (pattern: string | null | undefined) => {
+      expect(() => {
+        SloRulePatternValidator.validate({
+          namePattern: pattern,
+          descriptionPattern: pattern,
+        });
+      }).not.toThrow();
+    },
+  );
+
+  it("refuses a name pattern that is neither a regex nor a wildcard", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({ namePattern: "checkout-(01" });
+    }).toThrow(
+      new BadDataException(
+        `SLO Name Pattern "checkout-(01" is not a valid regular expression, and contains no '*' wildcard to fall back on, so it would never match an SLO. Use a regex such as checkout-.* or a wildcard such as *checkout*.`,
+      ),
+    );
+  });
+
+  it("refuses a description pattern that is neither a regex nor a wildcard", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: "checkout",
+        descriptionPattern: "[unclosed",
+      });
+    }).toThrow('SLO Description Pattern "[unclosed"');
+  });
+
+  it("checks the name before the description", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: "(",
+        descriptionPattern: "[",
+      });
+    }).toThrow("SLO Name Pattern");
+  });
+});

package/Tests/Server/Utils/VM/VMRunnerSsrf.test.ts

@@ -1365,3 +1365,216 @@ describe("VMRunner sandbox axios bridge — URL absolutization", () => {
     },
   );
 });
+
+/*
+ * The SSRF guard parses the target with OneUptime's URL type as well as
+ * WHATWG. That parser refused any URL whose first path segment contained a
+ * ":" - which every Telegram Bot API URL has, because the token
+ * ("<id>:<secret>") is that segment - and any path containing "~". The guard
+ * turned the parse failure into "Request URL is not a valid URL", so sandboxed
+ * code could not call Telegram at all. These drive the real isolate against a
+ * loopback server to prove the request now reaches the wire unchanged.
+ */
+describe("VMRunner sandbox axios bridge — paths with ':' or '~'", () => {
+  const BOT_TOKEN: string = "8000000001:AAFakeFakeFakeFakeFakeFakeFake_-12345";
+  const TELEGRAM_PATH: string = `/bot${BOT_TOKEN}/sendMessage`;
+
+  interface EchoedRequest {
+    method: string;
+    url: string;
+    host: string;
+    body: string;
+  }
+
+  async function startEchoServer(): Promise<RunningLoopbackServer> {
+    return startLoopbackServer(
+      (request: http.IncomingMessage, response: http.ServerResponse): void => {
+        let body: string = "";
+        request.on("data", (chunk: Buffer): void => {
+          body += chunk.toString("utf8");
+        });
+        request.on("end", (): void => {
+          const echoed: EchoedRequest = {
+            method: request.method || "",
+            url: request.url || "",
+            host: request.headers.host || "",
+            body: body,
+          };
+          response.setHeader("Content-Type", "application/json");
+          response.end(JSON.stringify(echoed));
+        });
+      },
+    );
+  }
+
+  async function runAgainstLoopback(code: string): Promise<EchoedRequest> {
+    const result: ReturnResult = await runInSandbox(code, {
+      allowPrivateNetworkRequests: true,
+    });
+
+    expect(result.scriptError).toBeUndefined();
+
+    return result.returnValue as EchoedRequest;
+  }
+
+  beforeEach(() => {
+    process.env[PRIVATE_NETWORK_WEBHOOK_ALLOWLIST_ENV] = "127.0.0.1";
+  });
+
+  test("axios.post reaches a Telegram /bot<id>:<secret>/sendMessage path", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.post(
+          'http://127.0.0.1:${echoServer.port}${TELEGRAM_PATH}',
+          { chat_id: '@mychannel', text: 'Deploy finished' }
+        );
+        return response.data;
+      `);
+
+      expect(echoed.method).toBe("POST");
+      expect(echoed.url).toBe(TELEGRAM_PATH);
+      expect(JSON.parse(echoed.body)).toEqual({
+        chat_id: "@mychannel",
+        text: "Deploy finished",
+      });
+      expect(echoServer.requestCount()).toBe(1);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test.each([
+    ["get", "axios.get(URL)"],
+    ["put", "axios.put(URL, { a: 1 })"],
+    ["patch", "axios.patch(URL, { a: 1 })"],
+    ["delete", "axios.delete(URL)"],
+    ["post", "axios.request({ method: 'post', url: URL, data: { a: 1 } })"],
+    ["get", "axios(URL)"],
+  ])(
+    "axios.%s via %s reaches the same path",
+    async (method: string, call: string) => {
+      const echoServer: RunningLoopbackServer = await startEchoServer();
+
+      try {
+        const echoed: EchoedRequest = await runAgainstLoopback(`
+          const URL = 'http://127.0.0.1:${echoServer.port}${TELEGRAM_PATH}';
+          const response = await ${call};
+          return response.data;
+        `);
+
+        expect(echoed.method).toBe(method.toUpperCase());
+        expect(echoed.url).toBe(TELEGRAM_PATH);
+      } finally {
+        await echoServer.close();
+      }
+    },
+  );
+
+  test("keeps the query string on a Telegram path", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.get(
+          'http://127.0.0.1:${echoServer.port}${TELEGRAM_PATH}?chat_id=%40mychannel&text=hi'
+        );
+        return response.data;
+      `);
+
+      expect(echoed.url).toBe(`${TELEGRAM_PATH}?chat_id=%40mychannel&text=hi`);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test("joins a relative token path onto baseURL", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.post(
+          'bot${BOT_TOKEN}/sendMessage',
+          { chat_id: 1, text: 'hi' },
+          { baseURL: 'http://127.0.0.1:${echoServer.port}' }
+        );
+        return response.data;
+      `);
+
+      expect(echoed.method).toBe("POST");
+      expect(echoed.url).toBe(TELEGRAM_PATH);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test("reaches api.telegram.org by name, dialling the address the guard approved", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+    const validationLookupSpy: ValidationLookupSpy = jest.spyOn(
+      dns.promises,
+      "lookup",
+    ) as unknown as ValidationLookupSpy;
+    validationLookupSpy.mockResolvedValue([
+      { address: "127.0.0.1", family: 4 },
+    ]);
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.post(
+          'http://api.telegram.org:${echoServer.port}${TELEGRAM_PATH}',
+          { chat_id: '@mychannel', text: 'hi' }
+        );
+        return response.data;
+      `);
+
+      expect(validationLookupSpy).toHaveBeenCalledWith("api.telegram.org", {
+        all: true,
+      });
+      expect(echoed.host).toBe(`api.telegram.org:${echoServer.port}`);
+      expect(echoed.url).toBe(TELEGRAM_PATH);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test.each(["/~user/hook", "/files/~backup/latest", "/urn:uuid:6e8bc430/x"])(
+    "reaches the path %s",
+    async (path: string) => {
+      const echoServer: RunningLoopbackServer = await startEchoServer();
+
+      try {
+        const echoed: EchoedRequest = await runAgainstLoopback(`
+          const response = await axios.get('http://127.0.0.1:${echoServer.port}${path}');
+          return response.data;
+        `);
+
+        expect(echoed.url).toBe(path);
+      } finally {
+        await echoServer.close();
+      }
+    },
+  );
+
+  test("a token path on an internal host is refused for its HOST, not as an invalid URL", async () => {
+    delete process.env[PRIVATE_NETWORK_WEBHOOK_ALLOWLIST_ENV];
+
+    const message: string = await errorFromSandbox(
+      `return await axios.post('http://169.254.169.254${TELEGRAM_PATH}', { a: 1 });`,
+    );
+
+    expect(message).toMatch(REFUSAL);
+    expect(message).not.toMatch(/not a valid URL/i);
+  });
+
+  test("a token path on a public host clears the guard and fails only at transport", async () => {
+    delete process.env[PRIVATE_NETWORK_WEBHOOK_ALLOWLIST_ENV];
+
+    const message: string = await errorFromSandbox(
+      `try { return await axios.post('http://8.8.8.8${TELEGRAM_PATH}', {}, { timeout: 1 }); } catch (e) { return 'threw: ' + e.message; }`,
+    );
+
+    expect(message).not.toMatch(REFUSAL);
+    expect(message).not.toMatch(/not a valid URL/i);
+  });
+});

package/Tests/Types/API/Route.test.ts

@@ -59,4 +59,60 @@ describe("Route", () => {
   ])("preserves legitimate colon use in %s", (routeValue: string) => {
     expect(new Route(routeValue).toString()).toBe(routeValue);
   });
+
+  /*
+   * A Telegram token segment is scheme-like when it stands alone, so it is
+   * refused bare - but with its leading "/" it is an ordinary absolute path.
+   * URL.fromString relies on exactly this to keep Telegram URLs parseable.
+   */
+  test("accepts a token-like first segment once it has a leading slash", () => {
+    expect(() => {
+      return new Route("bot123456:ABC-def_ghi/sendMessage");
+    }).toThrowError(BadDataException);
+
+    expect(new Route("/bot123456:ABC-def_ghi/sendMessage").toString()).toBe(
+      "/bot123456:ABC-def_ghi/sendMessage",
+    );
+  });
+
+  test("addRoute prefixes the slash before validating a token-like string", () => {
+    expect(new Route("").addRoute("bot123456:ABC/sendMessage").toString()).toBe(
+      "/bot123456:ABC/sendMessage",
+    );
+    expect(new Route("/api").addRoute("bot1:x").toString()).toBe("/api/bot1:x");
+  });
+
+  test.each([
+    ["javascript:alert(1)", true],
+    ["JaVaScRiPt:alert(1)", true],
+    ["https://example.com", true],
+    ["bot123:ABC/sendMessage", true],
+    ["a.b+c-d:e", true],
+    ["/bot123:ABC/sendMessage", false],
+    ["api/:resourceId", false],
+    [":resourceId", false],
+    ["1:2/x", false],
+    ["_matrix/!room:server", false],
+    ["#frag:ment", false],
+    ["?next=a:b", false],
+    ["", false],
+  ])("hasSchemePrefix(%s) is %s", (routeValue: string, expected: boolean) => {
+    expect(Route.hasSchemePrefix(routeValue)).toBe(expected);
+  });
+
+  test.each(["/~user", "/files/~backup", "/a~b", "~user/hook", "/p?x=~y"])(
+    "accepts the unreserved character '~' in %s",
+    (routeValue: string) => {
+      expect(new Route(routeValue).toString()).toBe(routeValue);
+    },
+  );
+
+  test.each(["/a b", "/a|b", "/a`b", '/a"b', "/a<b", "/a>b", "/a\\b", "/a^b"])(
+    "still refuses the non-path character in %s",
+    (routeValue: string) => {
+      expect(() => {
+        return new Route(routeValue);
+      }).toThrowError(BadDataException);
+    },
+  );
 });