RocketChat / RocketChat/Rocket.Chat
ReferenceError when "module" string is present in incoming webhooks
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
The presence of the "module" string, either with quote or without trigger ReferenceError in incoming webhook scripts.
Steps to reproduce:
- Create an incoming webhook
- Add a script with a module string inside like :
class Script {
process_incoming_request({ request }) {
console.log(request.content);
return { content: { alias: "foo", text: "module"} };
}
}
- Trigger it.
curl -X POST -H 'Content-Type: application/json' --data '{"foo":"bar"}' http://localhost/hooks/***/***
Expected behavior:
I20210323-14:46:40.935(0) Integrations ➔ Incoming WebHook.info Post integration: Foo Webhook
I20210323-14:46:40.936(0) Integrations ➔ Incoming WebHook.info Will evaluate script of Trigger Foo Webhook
{ foo: 'bar' }
Actual behavior:
I20210323-14:42:14.393(0) Integrations ➔ Incoming WebHook.info Post integration: Foo Webhook
I20210323-14:42:14.394(0) Integrations ➔ Incoming WebHook.info Will evaluate script of Trigger Foo Webhook
I20210323-14:42:14.398(0) server.js:204 Integrations ➔ Incoming WebHook.error [Error evaluating Script in Trigger Foo Webhook :]
I20210323-14:42:14.399(0) server.js:204 Integrations ➔ Incoming WebHook.error !function(module1){var Script=function(){function Script(){}var _proto=Script.prototype;_proto.process_incoming_request=function process_incoming_request(_ref){var request=_ref.request;console.log(request.content);return{content:{alias:"foo",text:"module"}}};return Script}()}.call(this,module);
I20210323-14:42:14.399(0) server.js:204 Integrations ➔ Incoming WebHook.error [Stack:]
I20210323-14:42:14.402(0) server.js:204 Integrations ➔ Incoming WebHook.error script.js:1 !function(module1){var Script=function(){function Script(){}var _proto=Script.prototype;_proto.process_incoming_request=function process_incoming_request(_ref){var request=_ref.request;console.log(request.content);return{content:{alias:"foo",text:"module"}}};return Script}()}.call(this,module); ^ ReferenceError: module is not defined at script.js:1:226 at Script.runInContext (vm.js:130:18) at Script.runInNewContext (vm.js:135:17) at getIntegrationScript (app/integrations/server/api/api.js:70:12) at Object.executeIntegrationRest (app/integrations/server/api/api.js:166:13) at app/api/server/api.js:394:82 at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js🔢12) at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39) at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32) at packages/nimble_restivus/lib/route.coffee:59:33
I20210323-14:42:14.403(0) Integrations ➔ Incoming WebHook.warn { statusCode: 400, body: { success: false, error: 'error-evaluating-script', stack: undefined } }
Server Setup Information:
- Version of Rocket.Chat Server: 3.12.1 HEAD: (f2817c056)
- Operating System: Debian GNU/Linux
- Deployment Method: docker (rocketchat/rocket.chat:latest)
- Number of Running Instances: 1
- NodeJS Version: v12.18.4
- MongoDB Version: 4.0.23 / wiredTiger (oplog Enabled)
Additional context
Our real usage are prometheus alerts, which may define data to process in request.content.alerts[0].labels.module key. Either test its presence with if ("module" in alert.labels) { ... } or access it with alert.labels.module raise a ReferenceError.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in app/integrations/server/api/api.js, especially getIntegrationScript and executeIntegrationRest, and reproduce the incoming webhook with a script containing the string or property name "module". Trace why evaluation treats that reference as unavailable. Done means the webhook script runs successfully and returns its content without a ReferenceError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100