@webex/webex-core 3.12.0-next.5 → 3.12.0-next.50

package/test/unit/spec/interceptors/auth.js

@@ -14,6 +14,8 @@ import {
   AuthInterceptor,
   config,
   Credentials,
+  Services,
+  ServicesV2,
   WebexHttpError,
   Token,
   serviceConstants,
@@ -380,6 +382,60 @@ describe('webex-core', () => {
         });
       });
 
+      describe('#onRequest() against a real service catalog', () => {
+        // The cases above stub `isAllowedDomainUrl`, so they answer the
+        // allowed-domain question themselves and cannot show that the catalog
+        // matcher is reached by the code that attaches the token. These use a
+        // real catalog and real allowed-domain methods.
+        [
+          {name: 'Services', Constructor: Services},
+          {name: 'ServicesV2', Constructor: ServicesV2},
+        ].forEach(({name, Constructor}) => {
+          describe(name, () => {
+            let getUserToken;
+
+            beforeEach(() => {
+              const services = new Constructor(undefined, {parent: webex});
+
+              services._getCatalog().setAllowedDomains(['webex.com']);
+              // the catalog holds no services, so a url that is not covered by
+              // an allowed domain has nothing else to authorize it
+              services.waitForService = sinon.stub().rejects(new Error('no such service'));
+
+              webex.internal.services = services;
+              getUserToken = sinon.spy(webex.credentials, 'getUserToken');
+            });
+
+            afterEach(() => {
+              getUserToken.restore();
+              delete webex.internal.services;
+            });
+
+            it('adds the authorization header for a url under an allowed domain', () =>
+              interceptor
+                .onRequest({uri: 'https://api.webex.com/resource', headers: {}})
+                .then((options) => {
+                  assert.equal(
+                    options.headers.authorization,
+                    webex.credentials.supertoken.toString()
+                  );
+                  assert.calledOnce(getUserToken);
+                }));
+
+            [
+              'https://notwebex.com/resource',
+              'https://webex.com.unrelated.example/resource',
+            ].forEach((uri) => {
+              it(`does not add the authorization header for ${uri}`, () =>
+                interceptor.onRequest({uri, headers: {}}).then((options) => {
+                  assert.notProperty(options.headers, 'authorization');
+                  assert.notCalled(getUserToken);
+                }));
+            });
+          });
+        });
+      });
+
       describe('#onResponseError()', () => {
         describe('when the server responds with 401', () => {
           nodeOnly(it)('refreshes the access token and replays the request', () => {

package/test/unit/spec/interceptors/catalog-url.js

@@ -0,0 +1,224 @@
+/*!
+ * Copyright (c) 2015-2020 Cisco Systems, Inc. See LICENSE file.
+ */
+
+import chai from 'chai';
+import chaiAsPromised from 'chai-as-promised';
+import sinon from 'sinon';
+import {CatalogUrlInterceptor} from '@webex/webex-core';
+
+const {assert} = chai;
+
+chai.use(chaiAsPromised);
+sinon.assert.expose(chai.assert, {prefix: ''});
+
+describe('webex-core', () => {
+  describe('Interceptors', () => {
+    describe('CatalogUrlInterceptor', () => {
+      let interceptor;
+      let webex;
+
+      beforeEach(() => {
+        webex = {
+          config: {
+            services: {},
+          },
+          internal: {
+            services: {
+              getServiceFromUrl: sinon.stub(),
+            },
+          },
+          logger: {
+            warn: sinon.stub(),
+          },
+        };
+
+        interceptor = Reflect.apply(CatalogUrlInterceptor.create, webex, []);
+      });
+
+      describe('#onRequest()', () => {
+        it('allows catalog URLs', async () => {
+          const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+          webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+          const result = await interceptor.onRequest(options);
+
+          assert.deepEqual(result, options);
+          assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+        });
+
+        it('blocks non-catalog URLs with error', async () => {
+          const options = {uri: 'https://evil.attacker.com/steal-data'};
+          webex.internal.services.getServiceFromUrl.returns(undefined);
+
+          await assert.isRejected(
+            interceptor.onRequest(options),
+            /Request blocked: URL not in service catalog/
+          );
+          assert.calledOnce(webex.internal.services.getServiceFromUrl);
+        });
+
+        describe('service parameter bypass', () => {
+          it('skips validation when service has not been resolved to a URL', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+            };
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('blocks a non-catalog URL when service is also present', async () => {
+            const options = {
+              service: 'conversation',
+              resource: '/messages',
+              uri: 'https://attacker.com/steal',
+              headers: {authorization: 'Bearer token'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.uri);
+          });
+        });
+
+        describe('url parameter support', () => {
+          it('validates options.url when options.uri is not present', async () => {
+            const options = {url: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.getServiceFromUrl, options.url);
+          });
+        });
+
+        describe('edge cases', () => {
+          it('allows request when no URL is present', async () => {
+            const options = {method: 'GET'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.getServiceFromUrl);
+          });
+
+          it('handles missing services plugin gracefully', async () => {
+            webex.internal = undefined;
+            const options = {uri: 'https://example.com/api'};
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+        });
+
+        describe('security scenarios', () => {
+          it('blocks Mercury-injected malicious URLs', async () => {
+            // This is the SSRF attack vector: Mercury event contains attacker URL
+            // that the flag plugin would POST to without validation
+            const options = {
+              method: 'POST',
+              uri: 'https://attacker-controlled.com/exfiltrate',
+              body: {sensitiveData: 'secrets'},
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+
+          it('allows legitimate activity service URLs', async () => {
+            const options = {
+              method: 'POST',
+              uri: 'https://conv-a.wbx2.com/conversation/api/v1/activities/12345',
+              body: {verb: 'flag'},
+            };
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+          });
+
+          it('blocks URLs with similar-looking hostnames', async () => {
+            // Attacker might try to use a URL that looks similar to a catalog URL
+            const options = {
+              uri: 'https://conv-a.wbx2.com.attacker.com/api',
+            };
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+          });
+        });
+
+        describe('allowedDomains support', () => {
+          beforeEach(() => {
+            // Add allowedDomains methods to mock
+            webex.internal.services.validateDomains = true;
+            webex.internal.services.hasAllowedDomains = sinon.stub();
+            webex.internal.services.isAllowedDomainUrl = sinon.stub();
+          });
+
+          it('allows URLs in allowedDomains when not in catalog', async () => {
+            const options = {uri: 'https://cdn.example.com/files/encrypted-attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.calledOnceWithExactly(webex.internal.services.isAllowedDomainUrl, options.uri);
+          });
+
+          it('blocks URLs not in catalog and not in allowedDomains', async () => {
+            const options = {uri: 'https://attacker.com/steal'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(false);
+
+            await assert.isRejected(
+              interceptor.onRequest(options),
+              /Request blocked: URL not in service catalog or allowed domains/
+            );
+          });
+
+          it('blocks when validateDomains is false', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.validateDomains = false;
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(true);
+            webex.internal.services.isAllowedDomainUrl.returns(true);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('blocks when no allowedDomains configured', async () => {
+            const options = {uri: 'https://cdn.example.com/files/attachment.bin'};
+            webex.internal.services.getServiceFromUrl.returns(undefined);
+            webex.internal.services.hasAllowedDomains.returns(false);
+
+            await assert.isRejected(interceptor.onRequest(options), /Request blocked/);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+
+          it('skips allowedDomains check when URL is in catalog', async () => {
+            const options = {uri: 'https://conv-a.wbx2.com/conversation/api/v1/messages'};
+            webex.internal.services.getServiceFromUrl.returns({name: 'conversation'});
+
+            const result = await interceptor.onRequest(options);
+
+            assert.deepEqual(result, options);
+            assert.notCalled(webex.internal.services.hasAllowedDomains);
+            assert.notCalled(webex.internal.services.isAllowedDomainUrl);
+          });
+        });
+      });
+    });
+  });
+});

package/test/unit/spec/interceptors/payload-transformer.js

@@ -4,7 +4,8 @@
 
 import {assert} from '@webex/test-helper-chai';
 import {capitalize} from 'lodash';
-import WebexCore from '@webex/webex-core';
+import sinon from 'sinon';
+import WebexCore, {PayloadTransformerInterceptor} from '@webex/webex-core';
 // TODO:  fix circular dependency core->metrics->core https://jira-eng-gpk2.cisco.com/jira/browse/SPARK-515520
 require('@webex/internal-plugin-metrics');
 
@@ -153,5 +154,122 @@ describe('webex-core', () => {
             ));
       });
     });
+
+    describe('PayloadTransformerInterceptor repeated inbound transforms', () => {
+      const createInterceptor = (skipRepeatedInboundTransforms) => {
+        const transform = sinon.stub().callsFake((direction, value) => Promise.resolve(value));
+        const interceptor = new PayloadTransformerInterceptor({
+          webex: {
+            config: {payloadTransformer: {skipRepeatedInboundTransforms}},
+            transform,
+          },
+        });
+
+        return {interceptor, transform};
+      };
+
+      describe('#onResponse()', () => {
+        it('transforms the same response every time when skipping repeated transforms is disabled', async () => {
+          const {interceptor, transform} = createInterceptor(false);
+          const response = {};
+
+          await interceptor.onResponse({}, response);
+          await interceptor.onResponse({}, response);
+
+          assert.calledTwice(transform);
+        });
+
+        it('transforms the same response only once when repeated transforms are skipped', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.calledOnceWithExactly(transform, 'inbound', response);
+        });
+
+        it('shares an in-flight transform for concurrent calls with the same response', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+          let resolveTransform;
+
+          transform.callsFake(
+            (direction, value) =>
+              new Promise((resolve) => {
+                resolveTransform = () => resolve(value);
+              })
+          );
+
+          const firstTransform = interceptor.onResponse({}, response);
+          const secondTransform = interceptor.onResponse({}, response);
+
+          assert.equal(firstTransform, secondTransform);
+          assert.calledOnceWithExactly(transform, 'inbound', response);
+
+          resolveTransform();
+
+          assert.equal(await firstTransform, response);
+          assert.equal(await secondTransform, response);
+        });
+
+        it('transforms distinct response objects independently', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const firstResponse = {};
+          const secondResponse = {};
+
+          await interceptor.onResponse({}, firstResponse);
+          await interceptor.onResponse({}, secondResponse);
+
+          assert.calledTwice(transform);
+          assert.isTrue(transform.firstCall.calledWithExactly('inbound', firstResponse));
+          assert.isTrue(transform.secondCall.calledWithExactly('inbound', secondResponse));
+        });
+
+        it('retries transformation after a failed transform', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+
+          transform.onFirstCall().rejects(new Error('transform failed'));
+
+          await assert.isRejected(interceptor.onResponse({}, response), 'transform failed');
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.calledTwice(transform);
+        });
+
+        it('stores transform state as non-enumerable response metadata', async () => {
+          const {interceptor} = createInterceptor(true);
+          const response = {body: {value: true}};
+
+          await interceptor.onResponse({}, response);
+
+          const [marker] = Object.getOwnPropertySymbols(response);
+
+          assert.isDefined(marker);
+          assert.isFalse(Object.getOwnPropertyDescriptor(response, marker).enumerable);
+          assert.deepEqual(JSON.parse(JSON.stringify(response)), {body: {value: true}});
+        });
+
+        it('does not mark a response when transforms are disabled for that request', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const response = {};
+
+          assert.equal(await interceptor.onResponse({disableTransform: true}, response), response);
+          assert.equal(await interceptor.onResponse({}, response), response);
+          assert.calledOnceWithExactly(transform, 'inbound', response);
+        });
+      });
+
+      describe('#onResponseError()', () => {
+        it('continues transforming repeated error objects independently', async () => {
+          const {interceptor, transform} = createInterceptor(true);
+          const reason = new Error('request failed');
+
+          await assert.isRejected(interceptor.onResponseError({}, reason), 'request failed');
+          await assert.isRejected(interceptor.onResponseError({}, reason), 'request failed');
+          assert.calledTwice(transform);
+          assert.alwaysCalledWithExactly(transform, 'inbound', reason);
+        });
+      });
+    });
   });
 });

package/test/unit/spec/lib/batcher.js

@@ -7,6 +7,7 @@ import {assert} from '@webex/test-helper-chai';
 import MockWebex from '@webex/test-helper-mock-webex';
 import sinon from 'sinon';
 import {Batcher} from '@webex/webex-core';
+import WebexHttpError from '../../../../src/lib/webex-http-error';
 
 function promiseTick(count) {
   let promise = Promise.resolve();
@@ -154,6 +155,61 @@ describe('webex-core', () => {
               return Promise.all([assert.isRejected(p1), assert.isRejected(p2)]);
             });
         });
+
+        it('does not trigger unhandledRejection when caller handles rejection', () => {
+          const unhandled = [];
+          const onUnhandledRejection = (reason) => {
+            unhandled.push(reason);
+          };
+
+          process.on('unhandledRejection', onUnhandledRejection);
+
+          const p = webex.internal.batcher.request(1);
+
+          // eslint-disable-next-line prefer-promise-reject-errors
+          webex.request.returns(Promise.reject({statusCode: 0}));
+
+          return promiseTick(50)
+            .then(() => clock.tick(2))
+            .then(() => promiseTick(50))
+            .then(() => assert.isRejected(p))
+            .then(() => promiseTick(50))
+            .then(() => {
+              assert.lengthOf(unhandled, 0);
+            })
+            .finally(() => {
+              process.removeListener('unhandledRejection', onUnhandledRejection);
+            });
+        });
+
+        it('fails queued deferreds for webex http errors without request body', () => {
+          const p1 = webex.internal.batcher.request(1);
+          const p2 = webex.internal.batcher.request(2);
+          const reason = new WebexHttpError.BadRequest({
+            statusCode: 400,
+            body: {message: 'simulated failure'},
+            options: {
+              method: 'GET',
+              uri: 'https://example.com/v1/mock/batch',
+              headers: {trackingid: 'test-tracking-id'},
+            },
+            headers: {},
+          });
+
+          webex.request.returns(Promise.reject(reason));
+
+          return promiseTick(50)
+            .then(() => clock.tick(2))
+            .then(() => promiseTick(50))
+            .then(() => {
+              assert.calledOnce(webex.request);
+
+              return Promise.all([
+                assert.isRejected(p1, /simulated failure/),
+                assert.isRejected(p2, /simulated failure/),
+              ]);
+            });
+        });
       });
 
       describe('when the number of request attempts exceeds a given threshold', () => {