@webex/webex-core 3.12.0-next.43 → 3.12.0-next.45

package/test/unit/spec/interceptors/catalog-url.js

@@ -0,0 +1,224 @@
+/*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+
+import chai from 'chai';
+import chaiAsPromised from 'chai-as-promised';
+import sinon from 'sinon';
+import {CatalogUrlInterceptor} from '@webex/webex-core';
+
+const {assert} = chai;
+
+chai.use(chaiAsPromised);
+sinon.assert.expose(chai.assert, {prefix: ''});
+
+describe('webex-core', () => {
+  describe('Interceptors', () => {
+    describe('CatalogUrlInterceptor', () => {
+      let interceptor;
+      let webex;
+
+      beforeEach(() => {
+        webex = {
+          config: {
+            services: {},
+          },
+          internal: {
+            services: {
+              getServiceFromUrl: sinon.stub(),
+            },
+          },
+          logger: {
+            warn: sinon.stub(),
+          },
+        };
+
+        interceptor = Reflect.apply(CatalogUrlInterceptor.create, webex, []);
+      });
+
+      describe('#onRequest()', () => {
+        it('allows catalog URLs', async () => {
+          const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+          webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+          const result = await interceptor.onRequest(options);
+
+          assert.deepEqual(result, options);
+          assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+        });
+
+        it('blocks non-catalog URLs with error', async () => {
+          const options = {uri: 'https://evil.attacker.com/steal-data'};
+          webex.internal.services.getServiceFromUrl.returns(undefined);
+
+          await assert.isRejected(
+            interceptor.onRequest(options),
+            /Request blocked: URL not in service catalog/
+          );
+          assert.calledOnce(webex.internal.services.getServiceFromUrl);
+        });
+
+        describe('service parameter bypass', () => {
+          it('skips validation when service has not been resolved to a URL', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+            };
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('blocks a non-catalog URL when service is also present', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+              uri: 'https://attacker.com/steal',
+              headers: {authorization: 'Bearer token'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+          });
+        });
+
+        describe('url parameter support', () => {
+          it('validates options.url when options.uri is not present', async () => {
+            const options = {url: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.url);
+          });
+        });
+
+        describe('edge cases', () => {
+          it('allows request when no URL is present', async () => {
+            const options = {method: 'GET'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('handles missing services plugin gracefully', async () => {
+            webex.internal = undefined;
+            const options = {uri: 'https://example.com/api'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+        });
+
+        describe('security scenarios', () => {
+          it('blocks Mercury-injected malicious URLs', async () => {
+            // This is the SSRF attack vector: Mercury event contains attacker URL
+            // that the flag plugin would POST to without validation
+            const options = {
+              method: 'POST',
+              uri: 'https://attacker-controlled.com/exfiltrate',
+              body: {sensitiveData: 'secrets'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+
+          it('allows legitimate activity service URLs', async () => {
+            const options = {
+              method: 'POST',
+              uri: 'https://conv-a.wbx2.com/conversation/api/v1/activities/12345',
+              body: {verb: 'flag'},
+            };
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+
+          it('blocks URLs with similar-looking hostnames', async () => {
+            // Attacker might try to use a URL that looks similar to a catalog URL
+            const options = {
+              uri: 'https://conv-a.wbx2.com.attacker.com/api',
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+        });
+
+        describe('allowedDomains support', () => {
+          beforeEach(() => {
+            // Add allowedDomains methods to mock
+            webex.internal.services.validateDomains = true;
+            webex.internal.services.hasAllowedDomains = sinon.stub();
+            webex.internal.services.isAllowedDomainUrl = sinon.stub();
+          });
+
+          it('allows URLs in allowedDomains when not in catalog', async () => {
+            const options = {uri: 'https://cdn.example.com/files/encrypted-attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.isAllowedDomainUrl, options.uri);
+          });
+
+          it('blocks URLs not in catalog and not in allowedDomains', async () => {
+            const options = {uri: 'https://attacker.com/steal'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(false);
+
+            await assert.isRejected(
+              interceptor.onRequest(options),
+              /Request blocked: URL not in service catalog or allowed domains/
+            );
+          });
+
+          it('blocks when validateDomains is false', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.validateDomains = false;
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('blocks when no allowedDomains configured', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(false);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('skips allowedDomains check when URL is in catalog', async () => {
+            const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.hasAllowedDomains);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+        });
+      });
+    });
+  });
+});

package/test/unit/spec/services/service-catalog.js

@@ -5,6 +5,94 @@
 import {assert} from '@webex/test-helper-chai';
 import MockWebex from '@webex/test-helper-mock-webex';
 import {Services} from '@webex/webex-core';
+import {matchesCatalogUrl} from '../../../../src/lib/services/service-catalog';
+
+describe('matchesCatalogUrl()', () => {
+  describe('origin validation', () => {
+    it('returns true when origins match exactly', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when hosts differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://other.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when catalog host is prefix of candidate host (SECURITY)', () => {
+      // Attack: trusted.example.attacker.com should NOT match trusted.example
+      assert.isFalse(
+        matchesCatalogUrl(
+          'https://trusted.example.attacker.com/activities/id',
+          'https://trusted.example'
+        )
+      );
+    });
+
+    it('returns false when schemes differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('http://example.com/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when ports differ', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com:8443/api/v1/users', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('path validation', () => {
+    it('returns true for root path catalog entry', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/any/path/here', 'https://example.com/'));
+    });
+
+    it('returns true when paths match exactly', () => {
+      assert.isTrue(matchesCatalogUrl('https://example.com/api/v1', 'https://example.com/api/v1'));
+    });
+
+    it('returns true when candidate path extends catalog path at boundary', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users/123', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns true when catalog path has trailing slash', () => {
+      assert.isTrue(
+        matchesCatalogUrl('https://example.com/api/v1/users', 'https://example.com/api/v1/')
+      );
+    });
+
+    it('returns false when catalog path is prefix but not at path boundary (SECURITY)', () => {
+      // /api/v1 should NOT match /api/v1extra
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/api/v1extra/something', 'https://example.com/api/v1')
+      );
+    });
+
+    it('returns false when candidate path does not start with catalog path', () => {
+      assert.isFalse(
+        matchesCatalogUrl('https://example.com/other/path', 'https://example.com/api/v1')
+      );
+    });
+  });
+
+  describe('error handling', () => {
+    it('returns false for invalid candidate URL', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'https://example.com/api'));
+    });
+
+    it('returns false for invalid catalog URL', () => {
+      assert.isFalse(matchesCatalogUrl('https://example.com/api', 'not-a-url'));
+    });
+
+    it('returns false when both URLs are invalid', () => {
+      assert.isFalse(matchesCatalogUrl('not-a-url', 'also-not-a-url'));
+    });
+  });
+});
 
 /* eslint-disable no-underscore-dangle */
 describe('webex-core', () => {
@@ -332,6 +420,109 @@ describe('webex-core', () => {
 
         assert.equal(service, exampleService);
       });
+
+      describe('security: origin validation', () => {
+        it('rejects URLs where the catalog host is a prefix of the candidate host (SECURITY)', () => {
+          // Attack: https://trusted.example.attacker.com should NOT match https://trusted.example
+          const exampleService = {
+            defaultUrl: 'https://trusted.example',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          // Attacker registers trusted.example.attacker.com
+          const attackerUrl = 'https://trusted.example.attacker.com/activities/id';
+          const service = catalog.findServiceUrlFromUrl(attackerUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different ports even if host matches', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const differentPortUrl = 'https://example.com:8443/resource/id';
+          const service = catalog.findServiceUrlFromUrl(differentPortUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs with different schemes', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const httpUrl = 'http://example.com/resource/id';
+          const service = catalog.findServiceUrlFromUrl(httpUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('rejects URLs where catalog path is a prefix but not at path boundary', () => {
+          // /api/v1 should NOT match /api/v1extra
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const nonBoundaryUrl = 'https://example.com/api/v1extra/something';
+          const service = catalog.findServiceUrlFromUrl(nonBoundaryUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('accepts URLs at exact path boundary', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/api/v1',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const boundaryUrl = 'https://example.com/api/v1/users/123';
+          const service = catalog.findServiceUrlFromUrl(boundaryUrl);
+
+          assert.equal(service, exampleService);
+        });
+
+        it('returns undefined for invalid URLs', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/resource',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const invalidUrl = 'not-a-valid-url';
+          const service = catalog.findServiceUrlFromUrl(invalidUrl);
+
+          assert.isUndefined(service);
+        });
+
+        it('matches root path catalog entries correctly', () => {
+          const exampleService = {
+            defaultUrl: 'https://example.com/',
+            hosts: [],
+          };
+
+          catalog.serviceGroups.postauth.push(exampleService);
+
+          const subpathUrl = 'https://example.com/any/path/here';
+          const service = catalog.findServiceUrlFromUrl(subpathUrl);
+
+          assert.equal(service, exampleService);
+        });
+      });
     });
   });
 });

package/test/unit/spec/services-v2/service-catalog.ts

@@ -365,6 +365,37 @@ describe('webex-core', () => {
           assert.equal(service, exampleService);
         }
       );
+
+      it('rejects URLs with similar-looking hostnames (SECURITY)', () => {
+        // Attacker URL that looks like a catalog URL but has a different origin
+        const maliciousUrl = 'https://example.com.attacker.com/resource/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(maliciousUrl);
+
+        // Should NOT match - origins are different
+        assert.isUndefined(service);
+      });
+
+      it('rejects URLs where catalog URL is a prefix but not at path boundary', () => {
+        // e.g., /api/v1 should not match /api/v1extra
+        const url = 'https://example.com/resourceextra/id';
+
+        const exampleService = {
+          serviceUrls: [{baseUrl: 'https://example.com/resource'}],
+        };
+
+        catalog.serviceGroups.postauth.push(exampleService);
+
+        const service = catalog.findServiceDetailFromUrl(url);
+
+        assert.isUndefined(service);
+      });
     });
   });
 });

package/test/unit/spec/services-v2/services-v2.ts

@@ -896,6 +896,26 @@ describe('webex-core', () => {
       });
     });
 
+    describe('#getServiceFromUrl()', () => {
+      it('matches an exact service URL when the catalog URL has a trailing slash', () => {
+        const baseUrl = 'https://example.com/api/v1/';
+
+        catalog.updateServiceGroups('preauth', [
+          {
+            id: 'example',
+            serviceName: 'example',
+            serviceUrls: [{host: 'example.com', baseUrl, priority: 1}],
+          },
+        ]);
+
+        assert.deepEqual(services.getServiceFromUrl('https://example.com/api/v1'), {
+          name: 'example',
+          priorityUrl: baseUrl,
+          defaultUrl: baseUrl,
+        });
+      });
+    });
+
     describe('#_formatReceivedHostmap()', () => {
       let serviceHostmap;
       let formattedHM;

package/test/unit/spec/webex-core.js

@@ -179,7 +179,7 @@ describe('Webex', () => {
 
   describe('initializes with interceptors', () => {
     [
-      // 4 pre, 4 post, 10 remaining default = 18
+      // 4 pre (CatalogUrlInterceptor is opt-in), 4 post, 10 remaining default = 18
       [
         'defaults to existing interceptors if undefined',
         undefined,
@@ -205,6 +205,58 @@ describe('Webex', () => {
           'RateLimitInterceptor',
         ],
       ],
+      [
+        'does not include CatalogUrlInterceptor for a truthy non-boolean value',
+        {services: {validateCatalogUrls: 'true'}},
+        18,
+        [
+          'RequestTimingInterceptor',
+          'RequestEventInterceptor',
+          'WebexTrackingIdInterceptor',
+          'RateLimitInterceptor',
+          'ServiceInterceptor',
+          'UserAgentInterceptor',
+          'ProxyInterceptor',
+          'WebexUserAgentInterceptor',
+          'AuthInterceptor',
+          'PayloadTransformerInterceptor',
+          'RedirectInterceptor',
+          'DefaultOptionsInterceptor',
+          'HostMapInterceptor',
+          'ServerErrorInterceptor',
+          'HttpStatusInterceptor',
+          'NetworkTimingInterceptor',
+          'EmbargoInterceptor',
+          'RateLimitInterceptor',
+        ],
+      ],
+      // CatalogUrlInterceptor is opt-in via services.validateCatalogUrls
+      [
+        'includes CatalogUrlInterceptor when validateCatalogUrls is enabled',
+        {services: {validateCatalogUrls: true}},
+        19,
+        [
+          'RequestTimingInterceptor',
+          'RequestEventInterceptor',
+          'WebexTrackingIdInterceptor',
+          'RateLimitInterceptor',
+          'CatalogUrlInterceptor',
+          'ServiceInterceptor',
+          'UserAgentInterceptor',
+          'ProxyInterceptor',
+          'WebexUserAgentInterceptor',
+          'AuthInterceptor',
+          'PayloadTransformerInterceptor',
+          'RedirectInterceptor',
+          'DefaultOptionsInterceptor',
+          'HostMapInterceptor',
+          'ServerErrorInterceptor',
+          'HttpStatusInterceptor',
+          'NetworkTimingInterceptor',
+          'EmbargoInterceptor',
+          'RateLimitInterceptor',
+        ],
+      ],
       [
         'only adds PayloadTransformerInterceptor',
         {interceptors: {PayloadTransformerInterceptor: PayloadTransformerInterceptor.create}},