@oneuptime/common 14.0.6 → 14.0.8

package/Server/Services/UserNotificationRuleService.ts

@@ -10,6 +10,8 @@ import Markdown, { MarkdownContentType } from "../Types/Markdown";
 import CallService from "./CallService";
 import DatabaseService from "./DatabaseService";
 import IncidentService from "./IncidentService";
+import LinkedAffectedResources from "../Utils/AffectedResources/LinkedAffectedResources";
+import SeriesLabelDisplay from "../../Types/Monitor/SeriesContext/SeriesLabelDisplay";
 import IncidentSeverityService from "./IncidentSeverityService";
 import MailService from "./MailService";
 import ProjectCallSMSConfigService from "./ProjectCallSMSConfigService";
@@ -983,15 +985,10 @@ export class Service extends DatabaseService<Model> {
           incidentNumber: true,
           incidentNumberWithPrefix: true,
           /*
-           * AcknowledgeIncident.hbs asks for a Resources Affected row and
-           * the generator had nothing to build it from, so the row was
-           * silently dropped — the same `{{#if}}` swallow that hid the
-           * alert's Root Cause.
+           * No relations here: AcknowledgeIncident.hbs's Resources Affected
+           * row is built from every resource the incident is linked to,
+           * which generateEmailTemplateForIncidentCreated reads itself.
            */
-          monitors: {
-            _id: true,
-            name: true,
-          },
         },
       });
     }
@@ -1031,11 +1028,13 @@ export class Service extends DatabaseService<Model> {
            * select it.
            */
           rootCause: true,
-          // Same story for the template's Resources Affected row.
-          monitor: {
-            _id: true,
-            name: true,
-          },
+          /*
+           * The series a grouped monitor raised this alert for (the pod or
+           * container), which the Resources Affected row names in place of
+           * the monitor - as the alert owner emails do. The linked resources
+           * themselves are read by generateEmailTemplateForAlertCreated.
+           */
+          seriesLabels: true,
         },
       });
     }
@@ -4613,7 +4612,22 @@ export class Service extends DatabaseService<Model> {
         MarkdownContentType.Email,
       ),
       alertSeverity: alert.alertSeverity!.name!,
-      resourcesAffected: alert.monitor?.name || "No resources identified",
+      /*
+       * Every resource the alert's Affected Resources card lists. An SLO
+       * burn-rate alert has no monitor, and this used to read "No resources
+       * identified" beside a card naming its SLO.
+       */
+      resourcesAffected: LinkedAffectedResources.getText({
+        resources: await LinkedAffectedResources.readForAlert({
+          service: AlertService,
+          projectId: alert.projectId!,
+          alertId: alert.id!,
+        }),
+        seriesSummary: SeriesLabelDisplay.buildInlineSummary(
+          alert.seriesLabels,
+        ),
+        fallback: "No resources identified",
+      }),
       rootCause: await Markdown.convertToHTML(
         alert.rootCause || "No root cause identified for this alert",
         MarkdownContentType.Email,
@@ -4664,15 +4678,15 @@ export class Service extends DatabaseService<Model> {
         MarkdownContentType.Email,
       ),
       incidentSeverity: incident.incidentSeverity!.name!,
-      resourcesAffected:
-        (incident.monitors || [])
-          .map((monitor: Monitor): string => {
-            return monitor.name || "";
-          })
-          .filter((name: string): boolean => {
-            return name.length > 0;
-          })
-          .join(", ") || "No resources identified",
+      // Every resource the incident's Affected Resources card lists.
+      resourcesAffected: LinkedAffectedResources.getText({
+        resources: await LinkedAffectedResources.readForIncident({
+          service: IncidentService,
+          projectId: incident.projectId!,
+          incidentId: incident.id!,
+        }),
+        fallback: "No resources identified",
+      }),
       rootCause: await Markdown.convertToHTML(
         incident.rootCause || "No root cause identified for this incident",
         MarkdownContentType.Email,
@@ -4762,18 +4776,15 @@ export class Service extends DatabaseService<Model> {
           })
         : [];
 
-    // Get unique monitors (resources affected)
-    const monitorNames: Set<string> = new Set();
-    for (const alert of alerts) {
-      if (alert.monitor?.name) {
-        monitorNames.add(alert.monitor.name);
-      }
-    }
-
-    const resourcesAffected: string =
-      monitorNames.size > 0
-        ? Array.from(monitorNames).join(", ")
-        : "No resources identified";
+    // Every resource any alert in the episode is linked to, each named once.
+    const resourcesAffected: string = LinkedAffectedResources.getText({
+      resources: await LinkedAffectedResources.readForAlerts({
+        service: AlertService,
+        projectId: alertEpisode.projectId!,
+        alertIds: alertIds,
+      }),
+      fallback: "No resources identified",
+    });
 
     // Build alerts list HTML with proper email styling
     let alertsListHtml: string = "";
@@ -4933,24 +4944,15 @@ export class Service extends DatabaseService<Model> {
           })
         : [];
 
-    /*
-     * Unique monitors across every incident in the episode. An incident carries
-     * a list of monitors (unlike an alert, which has exactly one), so this
-     * flattens rather than reading a single relation.
-     */
-    const monitorNames: Set<string> = new Set();
-    for (const incident of incidents) {
-      for (const monitor of incident.monitors || []) {
-        if (monitor.name) {
-          monitorNames.add(monitor.name);
-        }
-      }
-    }
-
-    const resourcesAffected: string =
-      monitorNames.size > 0
-        ? Array.from(monitorNames).join(", ")
-        : "No resources identified";
+    // Every resource any incident in the episode is linked to, each named once.
+    const resourcesAffected: string = LinkedAffectedResources.getText({
+      resources: await LinkedAffectedResources.readForIncidents({
+        service: IncidentService,
+        projectId: incidentEpisode.projectId!,
+        incidentIds: incidentIds,
+      }),
+      fallback: "No resources identified",
+    });
 
     // Build incidents list HTML with proper email styling
     let incidentsListHtml: string = "";

package/Server/Services/WorkspaceNotificationSummaryService.ts

@@ -18,6 +18,8 @@ import IncidentStateTimeline from "../../Models/DatabaseModels/IncidentStateTime
 import AlertStateTimeline from "../../Models/DatabaseModels/AlertStateTimeline";
 import Label from "../../Models/DatabaseModels/Label";
 import Monitor from "../../Models/DatabaseModels/Monitor";
+import LinkedAffectedResources from "../Utils/AffectedResources/LinkedAffectedResources";
+import { escapeMarkdownInline } from "../../Utils/Markdown/MarkdownEscape";
 import WorkspaceNotificationLogService from "./WorkspaceNotificationLogService";
 import WorkspaceNotificationStatus from "../../Types/Workspace/WorkspaceNotificationStatus";
 import WorkspaceNotificationActionType from "../../Types/Workspace/WorkspaceNotificationActionType";
@@ -212,6 +214,18 @@ export class Service extends DatabaseService<WorkspaceNotificationSummary> {
     return `[${text}](${url})`;
   }
 
+  /*
+   * Resource names are escaped: a host or cluster name can come from an
+   * agent rather than from someone typing it, and this text is markdown.
+   */
+  private static joinNames(names: Array<string>): string {
+    return names
+      .map((name: string): string => {
+        return escapeMarkdownInline(name);
+      })
+      .join(", ");
+  }
+
   private static formatDuration(totalMinutes: number): string {
     if (totalMinutes < 1) {
       return "< 1m";
@@ -761,20 +775,20 @@ export class Service extends DatabaseService<WorkspaceNotificationSummary> {
     if (
       Service.has(items, WorkspaceNotificationSummaryItem.ResourcesAffected)
     ) {
-      const names: Set<string> = new Set();
-      for (const inc of incidents) {
-        if (inc.monitors) {
-          for (const m of inc.monitors) {
-            if (m.name) {
-              names.add(m.name);
-            }
-          }
-        }
-      }
-      if (names.size > 0) {
+      // Every resource the period's incidents are linked to, not only monitors.
+      const names: Array<string> = LinkedAffectedResources.getNames({
+        resources: await LinkedAffectedResources.readForIncidents({
+          service: IncidentService,
+          projectId,
+          incidentIds: incidents.map((inc: Incident): ObjectID => {
+            return inc.id!;
+          }),
+        }),
+      });
+      if (names.length > 0) {
         blocks.push(
           Service.md(
-            `${Service.bold(`Resources Affected (${names.size}):`)}  ${Array.from(names).join(", ")}`,
+            `${Service.bold(`Resources Affected (${names.length}):`)}  ${Service.joinNames(names)}`,
           ),
         );
       }
@@ -1203,16 +1217,20 @@ export class Service extends DatabaseService<WorkspaceNotificationSummary> {
     if (
       Service.has(items, WorkspaceNotificationSummaryItem.ResourcesAffected)
     ) {
-      const names: Set<string> = new Set();
-      for (const a of alerts) {
-        if (a.monitor?.name) {
-          names.add(a.monitor.name);
-        }
-      }
-      if (names.size > 0) {
+      // Every resource the period's alerts are linked to, not only monitors.
+      const names: Array<string> = LinkedAffectedResources.getNames({
+        resources: await LinkedAffectedResources.readForAlerts({
+          service: AlertService,
+          projectId,
+          alertIds: alerts.map((a: Alert): ObjectID => {
+            return a.id!;
+          }),
+        }),
+      });
+      if (names.length > 0) {
         blocks.push(
           Service.md(
-            `${Service.bold(`Resources Affected (${names.size}):`)}  ${Array.from(names).join(", ")}`,
+            `${Service.bold(`Resources Affected (${names.length}):`)}  ${Service.joinNames(names)}`,
           ),
         );
       }

package/Server/Types/Markdown.ts

@@ -1,6 +1,7 @@
 import { Renderer, marked } from "marked";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import markdownSlugify from "./MarkdownSlugify";
+import SafeHtml from "../../Types/SafeHtml";
 
 export type MarkdownRenderer = Renderer;
 
@@ -50,6 +51,26 @@ const HTML_ENTITIES: Record<string, string> = {
   nbsp: " ",
 };
 
+// The named references getEmailUrl decodes in a link destination.
+const URL_NAMED_CHARACTER_REFERENCES: Record<string, string> = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+};
+
+/*
+ * The schemes an email may link to, and load an image from. A destination
+ * with no scheme is also allowed (see Markdown.getEmailUrl).
+ */
+export const EMAIL_LINK_SCHEMES: ReadonlyArray<string> = [
+  "http",
+  "https",
+  "mailto",
+];
+export const EMAIL_IMAGE_SCHEMES: ReadonlyArray<string> = ["http", "https"];
+
 type HoldFunction = (value: string) => string;
 
 interface BacktickRuns {
@@ -603,12 +624,93 @@ export default class Markdown {
    * a second implementation is a second thing to get wrong.
    */
   public static escapeHtml(text: string): string {
-    return text
-      .replace(/&/g, "&amp;")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;")
-      .replace(/"/g, "&quot;")
-      .replace(/'/g, "&#39;");
+    return SafeHtml.escape(text);
+  }
+
+  /**
+   * The URL a link or image in an EMAIL may point at, ready to go between
+   * the double quotes of an href or src attribute - or null when it may not
+   * be emitted at all.
+   *
+   * An email's Markdown comes from people outside the recipient's control: a
+   * public note, an incident description, a root cause built from telemetry.
+   * marked emits any destination it is given, so `[Details](javascript:...)`
+   * or `(data:text/html;base64,...)` became a live link in a status update
+   * the subscriber trusts. Only the schemes listed are kept; a destination
+   * with no scheme (a relative link or "#anchor") is kept too, as it was
+   * before, and cannot run anything.
+   *
+   * The scheme is judged on exactly the URL the recipient's mail client will
+   * see:
+   * - The character references marked leaves in a destination
+   *   ("&#x6A;avascript:") are decoded first, and the result is percent-
+   *   encoded the way marked does it (encodeURI), which also encodes every
+   *   space and control character a browser would strip out of a scheme.
+   * - The URL is then HTML-escaped into the attribute, so the client's own
+   *   decoding of the attribute gives back exactly the string that was
+   *   checked. A character reference this does not decode ("&colon;")
+   *   therefore reaches the client as literal text, never as a ":".
+   */
+  public static getEmailUrl(
+    href: string | null | undefined,
+    allowedSchemes: ReadonlyArray<string>,
+  ): string | null {
+    if (!href) {
+      return null;
+    }
+
+    let url: string;
+
+    try {
+      url = encodeURI(Markdown.decodeUrlCharacterReferences(href)).replace(
+        /%25/g,
+        "%",
+      );
+    } catch {
+      // A lone surrogate, which encodeURI refuses: no usable URL.
+      return null;
+    }
+
+    const scheme: RegExpMatchArray | null = url.match(
+      /^([a-zA-Z][a-zA-Z0-9+.-]*):/,
+    );
+
+    if (scheme && !allowedSchemes.includes(scheme[1]!.toLowerCase())) {
+      return null;
+    }
+
+    return Markdown.escapeHtml(url);
+  }
+
+  /*
+   * Numeric character references, and the named ones for the characters
+   * escapeHtml writes. Anything else is left as written, and getEmailUrl's
+   * escaping makes it inert.
+   */
+  private static decodeUrlCharacterReferences(text: string): string {
+    return text.replace(
+      /&(#[xX][0-9a-fA-F]+|#[0-9]+|amp|lt|gt|quot|apos);/g,
+      (match: string, reference: string): string => {
+        if (reference.startsWith("#")) {
+          const codePoint: number =
+            reference[1] === "x" || reference[1] === "X"
+              ? parseInt(reference.slice(2), 16)
+              : parseInt(reference.slice(1), 10);
+
+          if (
+            !Number.isFinite(codePoint) ||
+            codePoint <= 0 ||
+            codePoint > 0x10ffff
+          ) {
+            return match;
+          }
+
+          return String.fromCodePoint(codePoint);
+        }
+
+        return URL_NAMED_CHARACTER_REFERENCES[reference] ?? match;
+      },
+    );
   }
 
   /*
@@ -743,6 +845,51 @@ export default class Markdown {
       );
     };
 
+    /*
+     * Links and images keep only http, https and mailto destinations (http
+     * and https for an image), plus relative ones: see getEmailUrl. Any
+     * other link renders as its text alone, and any other image as its alt
+     * text, so the words the author wrote still read in place.
+     *
+     * The markup is marked's own. `text` is the link's rendered inline
+     * content, and `title` and an image's alt text arrive already escaped by
+     * marked's tokenizer, so escaping them again would show "&amp;".
+     */
+    renderer.link = function (
+      href: string,
+      title: string | null | undefined,
+      text: string,
+    ): string {
+      const url: string | null = Markdown.getEmailUrl(href, EMAIL_LINK_SCHEMES);
+
+      if (url === null) {
+        return text;
+      }
+
+      const titleAttribute: string = title ? ` title="${title}"` : "";
+
+      return `<a href="${url}"${titleAttribute}>${text}</a>`;
+    };
+
+    renderer.image = function (
+      href: string,
+      title: string | null,
+      text: string,
+    ): string {
+      const url: string | null = Markdown.getEmailUrl(
+        href,
+        EMAIL_IMAGE_SCHEMES,
+      );
+
+      if (url === null) {
+        return text;
+      }
+
+      const titleAttribute: string = title ? ` title="${title}"` : "";
+
+      return `<img src="${url}" alt="${text}"${titleAttribute}>`;
+    };
+
     this.emailRenderer = renderer;
 
     return renderer;

package/Server/Types/Workflow/Components/Email.ts

@@ -6,9 +6,18 @@ import ComponentID from "../../../../Types/Workflow/ComponentID";
 import Components from "../../../../Types/Workflow/Components/Email";
 import nodemailer, { Transporter } from "nodemailer";
 import SMTPTransport from "nodemailer/lib/smtp-transport";
+import DataSourceEgressGuard, {
+  ResolvedAddress,
+} from "../../../Utils/DataSource/EgressGuard";
+import PinnedSmtpSocket, {
+  SmtpSocketCallback,
+} from "../../../Utils/Mail/PinnedSmtpSocket";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
 export default class Email extends ComponentCode {
+  // nodemailer's own default connection timeout.
+  private static readonly CONNECTION_TIMEOUT_IN_MS: number = 2 * 60 * 1000;
+
   public constructor() {
     super();
 
@@ -123,10 +132,60 @@ export default class Email extends ComponentCode {
       };
     }
 
+    const smtpHost: string = args["smtp-host"].toString().trim();
+    // "[fd00::25]" is how an IPv6 literal is usually written next to a port.
+    const bareSmtpHost: string = smtpHost.replace(/^\[|\]$/g, "");
+    const smtpPort: number = args["smtp-port"] as number;
+
     try {
+      /*
+       * The SMTP host is free text typed into the workflow node by any
+       * project member who can edit workflows, and nodemailer's failures
+       * ("Invalid greeting. response=<banner>", refused vs timed out) come
+       * back through the Error port into the workflow log. Unchecked, this
+       * step is a port scanner with banner disclosure for whatever network
+       * the workflow worker runs in.
+       *
+       * Same guard and label as a project's own SMTP server in MailService,
+       * so the same policy: loopback, link-local and cloud metadata are
+       * refused everywhere; private ranges are refused on SaaS and allowed on
+       * self-hosted installs unless DATA_SOURCE_BLOCK_PRIVATE_ADDRESSES=true.
+       * A refusal is thrown inside this try, so it takes the Error port like
+       * any other failure to send, before a socket is opened.
+       */
+      const validatedAddresses: Array<ResolvedAddress> =
+        await DataSourceEgressGuard.assertHostnameAllowed(bareSmtpHost, {
+          targetLabel: "SMTP server",
+        });
+
       const smtpTransport: SMTPTransport.Options = {
-        host: args["smtp-host"]?.toString(),
-        port: args["smtp-port"] as number,
+        /*
+         * nodemailer still needs the name the user typed: it is what TLS
+         * sends as SNI and checks the certificate against, on implicit TLS
+         * and on the STARTTLS upgrade alike. It is never dialed; see
+         * getSocket.
+         */
+        host: bareSmtpHost,
+        port: smtpPort,
+        /*
+         * Connect here, to the addresses just validated, and hand nodemailer
+         * the open socket. Given the name instead, nodemailer resolves it
+         * again on its own (dns.resolve4/6, then a process-wide five-minute
+         * cache), so a DNS answer that changed after the check would choose
+         * the address actually connected to.
+         */
+        getSocket: (
+          _options: SMTPTransport.Options,
+          callback: SmtpSocketCallback,
+        ): void => {
+          PinnedSmtpSocket.connect({
+            host: bareSmtpHost,
+            port: smtpPort,
+            addresses: validatedAddresses,
+            timeoutInMs: Email.CONNECTION_TIMEOUT_IN_MS,
+            onDone: callback,
+          });
+        },
       };
 
       if (