@tellescope/sdk 1.256.0 → 1.256.2

package/src/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.ts

@@ -0,0 +1,292 @@
+require('source-map-support').install();
+
+import http from "http"
+import os from "os"
+import { Session } from "../../../sdk"
+import {
+  assert,
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
+
+const TEST_SECRET = "f0015 outbound ssrf test secret"
+
+/**
+ * The sentinel — the destination that must NEVER be reached — is bound to this machine's own RFC1918
+ * address rather than to loopback, and that choice is load-bearing.
+ *
+ * Loopback is deliberately permitted outside prod/staging (see api/modules/outbound_url.ts), because
+ * several test suites bind their receivers with `listen(0, '127.0.0.1')` and an ephemeral port cannot be
+ * allowlisted ahead of time. A loopback sentinel would therefore be ALLOWED in exactly the environment
+ * where this test runs, and "the sentinel was not contacted" would pass by allowance while proving
+ * nothing.
+ *
+ * RFC1918 is refused in every environment, so binding there keeps the assertion meaningful AND keeps a
+ * real listener present — which is what lets us prove non-delivery by observation rather than by
+ * reading a log message.
+ */
+const first_private_ipv4 = () => {
+  for (const addresses of Object.values(os.networkInterfaces())) {
+    for (const address of addresses ?? []) {
+      if (address.family !== 'IPv4' || address.internal) continue
+      if (/^10\./.test(address.address)) return address.address
+      if (/^192\.168\./.test(address.address)) return address.address
+      if (/^172\.(1[6-9]|2\d|3[01])\./.test(address.address)) return address.address
+    }
+  }
+  return undefined
+}
+
+/**
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel would never be contacted, every assertion here would
+ * pass for the wrong reason, and we would be creating a real webhook in a live tenant. Fail loudly.
+ */
+const assert_local_api = () => {
+  const hostname = new URL(host).hostname
+  if (!LOCAL_HOSTNAMES.includes(hostname)) {
+    throw new Error(
+      `F-0015 SSRF tests must run against a local API (got ${host}). `
+      + `127.0.0.1 would resolve to the API server rather than this machine, and this test configures a webhook.`
+    )
+  }
+}
+
+const listen = (server: http.Server, address: string) => new Promise<void>((resolve, reject) => {
+  server.once('error', reject)
+  server.listen(0, address, () => resolve()) // ephemeral port — nothing here needs a fixed one
+})
+
+const port_of = (server: http.Server) => (server.address() as any).port
+
+/** Webhook delivery is fire-and-forget, so absence has to be established by waiting. */
+const settle = (ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms))
+const wait_until = async (predicate: () => boolean, ms: number) => {
+  const deadline = Date.now() + ms
+  while (Date.now() < deadline) {
+    if (predicate()) return true
+    await settle(100)
+  }
+  return predicate()
+}
+
+/**
+ * Regression tests for F-0015
+ * (security-audit/findings/F-0015-webhook-outbound-ssrf.md).
+ *
+ * Outbound webhooks request customer-configured URLs that are validated only for SYNTAX
+ * (urlValidator -> validator.isURL, which happily accepts http://10.0.0.1/). Four call sites are
+ * affected: api/modules/webhooks.ts:145, :214, :270, and the five-method block at api/v1/api.ts:9723.
+ *
+ * Two properties make this worse than a blind SSRF:
+ *  - A non-2xx response body is stored in log.response, and webhook_logs is surfaced to customers for
+ *    debugging — so an internal endpoint's error body is readable by the tenant that configured it.
+ *  - The automation send-webhook action builds its URL at runtime through five nested template
+ *    replacers over action.info.url, so patient-controlled field values can reach the destination.
+ *
+ * And critically: axios@0.30.2 follows redirects by default (maxRedirects: 5). A pre-flight check on
+ * the configured URL is therefore NOT sufficient — a receiver can simply 302 to an internal address
+ * after validation has already passed. T4 exists to prove exactly that, which is why the fix has to
+ * validate at connect time (a guarded agent) rather than as a string check.
+ *
+ * Each test below asserts ABSENCE ("the sentinel was never contacted"), which passes trivially if the
+ * request never happened at all — a missing allowlist entry, a webhook that never fired, a broken
+ * subscription. So each is paired with a positive control that proves the attempt really was made.
+ */
+export const webhook_outbound_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0015: outbound webhook SSRF")
+  assert_local_api()
+
+  const SENTINEL = `f0015-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
+
+  const privateIP = first_private_ipv4()
+  if (!privateIP) {
+    // Degrade loudly rather than silently passing. Everything below needs a bindable address that the
+    // guard refuses in every environment, and loopback does not qualify (see the note above).
+    assert(
+      false,
+      'F-0015 SKIPPED: no non-loopback RFC1918 interface on this host, so the SSRF sentinel cannot be '
+      + 'bound anywhere the guard refuses. Run on a host with a private network interface.',
+      'F-0015 outbound SSRF',
+    )
+    return
+  }
+
+  let sentinelHits = 0   // must NEVER be reached once fixed
+  let okHits = 0         // permitted target: must stay reachable
+  let redirectHits = 0   // permitted hop 1 of the redirect chain
+
+  let sentinelURL = ''
+
+  // Stands in for an internal-only service, on an RFC1918 address that is refused in dev, staging and
+  // prod alike.
+  const sentinel = http.createServer((_, res) => {
+    sentinelHits++
+    res.writeHead(200, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }))
+  })
+
+  // The legitimate receiver, on loopback — permitted in local dev exactly like every other webhook test.
+  const allowed = http.createServer((req, res) => {
+    if ((req.url || '').startsWith('/redirect-to-internal')) {
+      redirectHits++
+      // Hop 1 is permitted and genuinely succeeds; hop 2 points somewhere that is not.
+      res.writeHead(302, { location: sentinelURL })
+      res.end()
+      return
+    }
+    okHits++
+    res.writeHead(200, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ ok: true }))
+  })
+
+  let enduserId: string | undefined
+  let templateEnduserId: string | undefined
+  let configuredWebhook = false
+
+  try {
+    await listen(sentinel, privateIP)
+    const sentinelPort = port_of(sentinel)
+    sentinelURL = `http://${privateIP}:${sentinelPort}/ssrf-sentinel`
+
+    await listen(allowed, '127.0.0.1')
+    const okURL = `http://127.0.0.1:${port_of(allowed)}/webhook-ok`
+    const redirectURL = `http://127.0.0.1:${port_of(allowed)}/redirect-to-internal`
+
+    const enduser = await sdk.api.endusers.createOne({
+      email: `f0015-${Date.now()}@example.com`, fname: 'F0015', lname: 'Ssrf',
+    })
+    enduserId = enduser.id
+
+    const send_automation_webhook_to = async (url: string, forEnduserId = enduser.id) => {
+      sentinelHits = 0; okHits = 0; redirectHits = 0
+      const outcome = await sdk.api.webhooks.send_automation_webhook({
+        enduserId: forEnduserId,
+        action: { info: { url } },
+      } as any).then(() => 'resolved').catch(() => 'rejected')
+      // The action awaits its own axios call, but give redirect chains a moment to land.
+      await settle(750)
+      return { outcome, sentinelHits, okHits, redirectHits }
+    }
+
+    // ---------------------------------------------------------------------------------------------
+    // T6 first: the positive control for the whole file. If an allowlisted target does not receive the
+    // webhook, every "sentinel not contacted" assertion below is meaningless.
+    // ---------------------------------------------------------------------------------------------
+    await async_test(
+      'F-0015: automation webhook to a permitted target still delivers (regression baseline)',
+      () => send_automation_webhook_to(okURL),
+      { onResult: (r: any) => r.okHits === 1 && r.sentinelHits === 0 },
+    )
+
+    // T3 — direct non-allowlisted private destination.
+    await async_test(
+      'F-0015: automation webhook does not reach a private destination',
+      () => send_automation_webhook_to(sentinelURL),
+      { onResult: (r: any) => r.sentinelHits === 0 },
+    )
+
+    // T4 — the redirect bypass. THE test that justifies a connect-time guard over a pre-flight check.
+    await async_test(
+      'F-0015: automation webhook does not follow a redirect from a permitted host into a private one',
+      () => send_automation_webhook_to(redirectURL),
+      {
+        // redirectHits === 1 is the positive control: hop 1 was allowlisted and really was reached, so
+        // sentinelHits === 0 can only mean hop 2 was refused — not that the request never happened.
+        onResult: (r: any) => r.redirectHits === 1 && r.sentinelHits === 0,
+      },
+    )
+
+    // T5 — the destination arrives via template interpolation, so validation must run AFTER the
+    // replacers rather than against the stored config. {{enduser.<key>}} resolves from enduser.fields.
+    const templateEnduser = await sdk.api.endusers.createOne({
+      email: `f0015-tpl-${Date.now()}@example.com`,
+      fname: 'F0015', lname: 'Template',
+      fields: { ssrfTarget: `${privateIP}:${sentinelPort}` },
+    })
+    templateEnduserId = templateEnduser.id
+
+    await async_test(
+      'F-0015: automation webhook validates the URL after template interpolation, not before',
+      () => send_automation_webhook_to('http://{{enduser.ssrfTarget}}/ssrf-sentinel', templateEnduser.id),
+      { onResult: (r: any) => r.sentinelHits === 0 },
+    )
+
+    // ---------------------------------------------------------------------------------------------
+    // The configured-webhook delivery path (api/modules/webhooks.ts:145), which is a different code
+    // path from the automation action above. Paired: allowlisted target proves the subscription and
+    // trigger plumbing works, then the same plumbing pointed at the sentinel must not reach it.
+    // ---------------------------------------------------------------------------------------------
+    // CUDSubscription is an object of booleans, not a list of verbs (see webhooks_tests.ts fullSubscription).
+    await sdk.api.webhooks.configure({
+      url: okURL, secret: TEST_SECRET, subscriptions: { endusers: { create: true } },
+    })
+    configuredWebhook = true
+
+    await async_test(
+      'F-0015: configured webhook to a permitted target still delivers (positive control)',
+      async () => {
+        sentinelHits = 0; okHits = 0
+        const e = await sdk.api.endusers.createOne({ email: `f0015-ok-${Date.now()}@example.com` })
+        const delivered = await wait_until(() => okHits > 0, 8_000)
+        await sdk.api.endusers.deleteOne(e.id).catch(() => {})
+        return { delivered, okHits, sentinelHits }
+      },
+      { onResult: (r: any) => r.delivered === true && r.sentinelHits === 0 },
+    )
+
+    // Repoint the same configuration at the sentinel, keeping the subscription intact.
+    await sdk.api.webhooks.update({ url: sentinelURL })
+
+    await async_test(
+      'F-0015: configured webhook does not deliver to a private destination',
+      async () => {
+        sentinelHits = 0; okHits = 0
+        const e = await sdk.api.endusers.createOne({ email: `f0015-blocked-${Date.now()}@example.com` })
+        // Wait out the window a real delivery would have landed in, then assert it did not.
+        await settle(6_000)
+        await sdk.api.endusers.deleteOne(e.id).catch(() => {})
+        return { sentinelHits }
+      },
+      { onResult: (r: any) => r.sentinelHits === 0 },
+    )
+  } finally {
+    // Leaving a webhook configured would fire on every subsequent create in the shared suite run.
+    if (configuredWebhook) {
+      try {
+        const { webhooks } = await sdk.api.webhooks.getSome({}) as any
+        for (const w of (webhooks ?? [])) { await sdk.api.webhooks.deleteOne(w.id).catch(() => {}) }
+      } catch {}
+    }
+    if (enduserId) { try { await sdk.api.endusers.deleteOne(enduserId) } catch {} }
+    if (templateEnduserId) { try { await sdk.api.endusers.deleteOne(templateEnduserId) } catch {} }
+    sentinel.close()
+    allowed.close()
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await webhook_outbound_ssrf_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0015 outbound webhook SSRF test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0015 outbound webhook SSRF test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.ts

@@ -0,0 +1,179 @@
+require('source-map-support').install();
+
+import http from "http"
+import axios from "axios"
+import { Session } from "../../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
+
+/**
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted, every assertion
+ * here would pass for the wrong reason, and we would be probing a live environment. Fail loudly.
+ */
+const assert_local_api = () => {
+  const hostname = new URL(host).hostname
+  if (!LOCAL_HOSTNAMES.includes(hostname)) {
+    throw new Error(
+      `F-0025 SSRF tests must run against a local API (got ${host}). `
+      + `127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.`
+    )
+  }
+}
+
+/**
+ * Regression tests for F-0025
+ * (security-audit/findings/F-0025-proxy-image-unauth-ssrf.md).
+ *
+ * GET /v1/proxy-image accepted an arbitrary ?url= and streamed the upstream response body straight
+ * back with Access-Control-Allow-Origin: *, with no authentication, no destination validation and no
+ * content-type restriction. That reaches http://169.254.169.254/ (EC2 instance credentials under
+ * IMDSv1), 127.0.0.1, and anything else inside the VPC.
+ *
+ * The endpoint's only legitimate job is to re-serve an image that ALREADY renders in the staff
+ * browser, with permissive CORS headers, so html2canvas can rasterize a form-response PDF without
+ * tainting the canvas (canvas.toDataURL() throws on a tainted canvas, and the form-response view sets
+ * crossOrigin="anonymous"). Anything reachable only from inside our network was therefore never a
+ * legitimate input — which is why refusing non-public destinations cannot regress the feature.
+ *
+ * Repro: stand up a local HTTP server that serves a JSON secret, point proxy-image at it with no
+ * credentials, and assert the secret does not come back.
+ *   - red  (unfixed): the sentinel body is streamed back to an unauthenticated caller
+ *   - green (fixed):  the request is refused and the sentinel server is never contacted
+ *
+ * Assertions are deliberately written as "4xx and nothing leaked" rather than pinning an exact status,
+ * because the fix both authenticates the endpoint and moves it to POST (the url moves into the body so
+ * presigned S3 URLs for patient attachments stop landing in access logs). Either 401 or 404/405 on the
+ * old GET shape is an acceptable outcome; streaming the body is not.
+ *
+ * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
+ * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
+ * the vulnerability proof.
+ */
+export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("F-0025: proxy-image unauthenticated SSRF")
+  assert_local_api()
+
+  const SENTINEL = `f0025-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
+  let sentinelHits = 0
+
+  // Stands in for an internal-only service (IMDS, an internal admin API, a VPC-local port). Serves
+  // JSON rather than an image, so it also exercises the missing content-type restriction.
+  const sentinel = http.createServer((_, res) => {
+    sentinelHits++
+    res.writeHead(200, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }))
+  })
+
+  try {
+    await new Promise<void>(resolve => sentinel.listen(0, '127.0.0.1', () => resolve()))
+    const sentinelPort = (sentinel.address() as any).port
+    const sentinelURL = `http://127.0.0.1:${sentinelPort}/latest/meta-data/iam/security-credentials/`
+
+    // Raw axios rather than the SDK: the SDK always attaches an Authorization header, and the point
+    // here is that no credential is presented at all.
+    const call_unauthenticated = async () => {
+      sentinelHits = 0
+      const res = await axios.get(`${host}/v1/proxy-image`, {
+        params: { url: sentinelURL },
+        validateStatus: () => true, // capture 4xx/5xx instead of throwing
+        responseType: 'text',
+        transformResponse: [(d: any) => d], // keep the raw body as a string
+        timeout: 10_000,
+      } as any)
+
+      const body = typeof res.data === 'string' ? res.data : JSON.stringify(res.data ?? '')
+      return { status: res.status, leaked: body.includes(SENTINEL), sentinelHits }
+    }
+
+    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+    await async_test(
+      'F-0025: proxy-image does not stream an internal non-image resource to an unauthenticated caller',
+      call_unauthenticated,
+      {
+        // Positive control: a numeric status proves we actually reached our API rather than failing to
+        // connect (a connection error would make "nothing leaked" true for the wrong reason).
+        onResult: (r: any) => (
+          typeof r.status === 'number'
+          && r.leaked === false
+          && r.sentinelHits === 0
+        ),
+      },
+    )
+
+    // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+    // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+    await async_test(
+      'F-0025: proxy-image refuses an unauthenticated request without contacting the destination',
+      call_unauthenticated,
+      { onResult: (r: any) => r.status >= 400 && r.status < 500 && r.sentinelHits === 0 },
+    )
+
+    // Authenticating is not enough on its own — a staff session must not be able to reach an internal
+    // address either. These use the real session, and are deterministic (no external network).
+    const call_authenticated = async (url: string) => {
+      sentinelHits = 0
+      const res = await axios.post(`${host}/v1/proxy-image`, { url }, {
+        headers: { Authorization: `Bearer ${sdk.authToken}` },
+        validateStatus: () => true,
+        timeout: 10_000,
+      } as any)
+      return { status: res.status, sentinelHits }
+    }
+
+    await async_test(
+      'F-0025: proxy-image refuses a private destination even for an authenticated staff session',
+      () => call_authenticated(sentinelURL),
+      { onResult: (r: any) => r.status === 400 && r.sentinelHits === 0 },
+    )
+
+    await async_test(
+      'F-0025: proxy-image refuses cloud metadata for an authenticated staff session',
+      () => call_authenticated('https://169.254.169.254/latest/meta-data/'),
+      { onResult: (r: any) => r.status === 400 },
+    )
+
+    // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+    await async_test(
+      'F-0025: proxy-image refuses a plain http destination',
+      () => call_authenticated('http://example.com/logo.png'),
+      { onResult: (r: any) => r.status === 400 },
+    )
+
+    await async_test(
+      'F-0025: proxy-image refuses a non-443 port',
+      () => call_authenticated('https://example.com:8443/logo.png'),
+      { onResult: (r: any) => r.status === 400 },
+    )
+  } finally {
+    sentinel.close()
+  }
+}
+
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ F-0025 proxy-image SSRF test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ F-0025 proxy-image SSRF test suite failed:", error)
+      process.exit(1)
+    })
+}