@oneuptime/common 14.0.10 → 14.0.11

package/Server/Utils/Telemetry/ResourceEntityFilter.ts

@@ -272,7 +272,10 @@ async function resolveDatabaseServerEntityKeys(data: {
  * get the id + attribute branches only — the same `resource.faas.name` /
  * `resource.iot.fleet.name` scope their detail pages use. The function
  * identifier is `faas.name` (or `service.name` on a FaaS platform without
- * one, which the attribute branch then simply does not match).
+ * one, which ingest writes onto the resource as `faas.name` —
+ * OtelIngestBaseService.stampServerlessFunctionNameAttribute — so the
+ * attribute branch matches every row ingested since; rows ingested before
+ * carry no `resource.faas.name`, as there is no backfill).
  *
  * Databases resolve straight to their entity-key set (see
  * resolveDatabaseServerEntityKeys above): no attribute branch, because no

package/Server/Utils/VendorAssets.ts

@@ -17,9 +17,9 @@ import path from "path";
  * An air-gapped deployment has no route to cdn.tailwindcss.com or
  * cdnjs.cloudflare.com, and a `<script src>` pointed at one does not fail
  * fast - the browser waits out the connect timeout with the parser blocked,
- * so the page renders unstyled or not at all. Same class of bug as the Monaco
- * loader (see CodeEditor/MonacoLoader.ts): the fix is to stop reaching off-box
- * for anything the page cannot render without.
+ * so the page renders unstyled or not at all. The code editor's old Monaco
+ * runtime had the same bug, loading from cdn.jsdelivr.net: the fix is to stop
+ * reaching off-box for anything the page cannot render without.
  *
  * Mounted by every service, because there is no single service that serves
  * every one of these pages: Docs, the API reference and the SSO/on-call

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Incident.ts

@@ -31,6 +31,7 @@ import IncidentStateTimeline from "../../../../../Models/DatabaseModels/Incident
 import IncidentPublicNote from "../../../../../Models/DatabaseModels/IncidentPublicNote";
 import IncidentInternalNote from "../../../../../Models/DatabaseModels/IncidentInternalNote";
 import OnCallDutyPolicyExecutionLog from "../../../../../Models/DatabaseModels/OnCallDutyPolicyExecutionLog";
+import { escapeMarkdownValue } from "../../../../../Utils/Markdown/MarkdownEscape";
 import ColumnLength from "../../../../../Types/Database/ColumnLength";
 import { truncateToLength } from "../../../Database/TruncateColumnValue";
 import MicrosoftTeamsCardChoices, {
@@ -422,7 +423,8 @@ export default class MicrosoftTeamsIncidentActions {
 
       const declaredAt: Date | undefined =
         incident.declaredAt || incident.createdAt || undefined;
-      const message: string = `**Incident Details**\n\n**Title:** ${incident.title}\n**Description:** ${incident.description || "No description"}\n**State:** ${incident.currentIncidentState?.name || "Unknown"}\n**Severity:** ${incident.incidentSeverity?.name || "Unknown"}\n**Declared At:** ${declaredAt ? new Date(declaredAt).toLocaleString() : "Unknown"}`;
+      // The title is plain text, escaped as MarkdownEscape says a title must be.
+      const message: string = `**Incident Details**\n\n**Title:** ${escapeMarkdownValue(incident.title)}\n**Description:** ${incident.description || "No description"}\n**State:** ${incident.currentIncidentState?.name || "Unknown"}\n**Severity:** ${incident.incidentSeverity?.name || "Unknown"}\n**Declared At:** ${declaredAt ? new Date(declaredAt).toLocaleString() : "Unknown"}`;
 
       await turnContext.sendActivity(message);
       return;

package/Server/Utils/Workspace/MicrosoftTeams/Actions/IncidentEpisode.ts

@@ -23,6 +23,7 @@ import IncidentStateService from "../../../../Services/IncidentStateService";
 import UserNotificationEventType from "../../../../../Types/UserNotification/UserNotificationEventType";
 import OnCallDutyPolicy from "../../../../../Models/DatabaseModels/OnCallDutyPolicy";
 import IncidentState from "../../../../../Models/DatabaseModels/IncidentState";
+import { escapeMarkdownValue } from "../../../../../Utils/Markdown/MarkdownEscape";
 import MicrosoftTeamsReplies from "../MicrosoftTeamsReplies";
 
 export default class MicrosoftTeamsIncidentEpisodeActions {
@@ -338,7 +339,8 @@ export default class MicrosoftTeamsIncidentEpisodeActions {
         return;
       }
 
-      const message: string = `**Incident Episode Details**\n\n**Title:** ${episode.title}\n**Description:** ${episode.description || "No description"}\n**State:** ${episode.currentIncidentState?.name || "Unknown"}\n**Severity:** ${episode.incidentSeverity?.name || "Unknown"}\n**Incident Count:** ${episode.incidentCount || 0}\n**Created At:** ${episode.createdAt ? new Date(episode.createdAt).toLocaleString() : "Unknown"}`;
+      // The title is plain text, escaped as MarkdownEscape says a title must be.
+      const message: string = `**Incident Episode Details**\n\n**Title:** ${escapeMarkdownValue(episode.title)}\n**Description:** ${episode.description || "No description"}\n**State:** ${episode.currentIncidentState?.name || "Unknown"}\n**Severity:** ${episode.incidentSeverity?.name || "Unknown"}\n**Incident Count:** ${episode.incidentCount || 0}\n**Created At:** ${episode.createdAt ? new Date(episode.createdAt).toLocaleString() : "Unknown"}`;
 
       await turnContext.sendActivity(message);
       return;

package/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.ts

@@ -119,6 +119,7 @@ import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedExc
 import AIService, { AI_DISABLED_MESSAGE } from "../../../Services/AIService";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { AIChatCitation } from "../../../../Types/AI/AIChatTypes";
+import { escapeMarkdownInline } from "../../../../Utils/Markdown/MarkdownEscape";
 
 // Microsoft Teams apps should always be single-tenant
 const MICROSOFT_TEAMS_APP_TYPE: string = "SingleTenant";
@@ -3931,7 +3932,15 @@ If you need to report an incident or check historical incidents, please visit th
             incident.id!,
           );
 
-        message += `${severityIcon} **[Incident ${incident.incidentNumberWithPrefix || "#" + incident.incidentNumber}: ${incident.title}](${incidentUrl.toString()})**
+        /*
+         * The title - plain text, which anyone holding an incident form's
+         * link may have typed - sits inside the link's text, so every
+         * Markdown character in it is escaped: a "]" cannot end that text
+         * early and point the rest somewhere else, and "![...](...)" is no
+         * image. Escaping brackets alone is not enough there: marked, for
+         * one, undoes "\[" and "\]" in a link's text before reading it.
+         */
+        message += `${severityIcon} **[Incident ${incident.incidentNumberWithPrefix || "#" + incident.incidentNumber}: ${escapeMarkdownInline(incident.title)}](${incidentUrl.toString()})**
 • **Severity:** ${severity}
 • **Status:** ${state}
 • **Declared:** ${declaredAtText}