RocketChat / RocketChat/Rocket.Chat

ReferenceError when "module" string is present in incoming webhooks

Open
#21,271 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

The presence of the "module" string, either with quote or without trigger ReferenceError in incoming webhook scripts.

Steps to reproduce:
  1. Create an incoming webhook
  2. Add a script with a module string inside like :
class Script {
  process_incoming_request({ request }) {
    console.log(request.content);
    return { content: { alias: "foo", text: "module"} };
  }
}
  1. Trigger it.
curl -X POST -H 'Content-Type: application/json' --data '{"foo":"bar"}' http://localhost/hooks/***/***
Expected behavior:

I20210323-14:46:40.935(0) Integrations ➔ Incoming WebHook.info Post integration: Foo Webhook
I20210323-14:46:40.936(0) Integrations ➔ Incoming WebHook.info Will evaluate script of Trigger Foo Webhook
{ foo: 'bar' }

Actual behavior:

I20210323-14:42:14.393(0) Integrations ➔ Incoming WebHook.info Post integration: Foo Webhook
I20210323-14:42:14.394(0) Integrations ➔ Incoming WebHook.info Will evaluate script of Trigger Foo Webhook
I20210323-14:42:14.398(0) server.js:204 Integrations ➔ Incoming WebHook.error [Error evaluating Script in Trigger Foo Webhook :]
I20210323-14:42:14.399(0) server.js:204 Integrations ➔ Incoming WebHook.error !function(module1){var Script=function(){function Script(){}var _proto=Script.prototype;_proto.process_incoming_request=function process_incoming_request(_ref){var request=_ref.request;console.log(request.content);return{content:{alias:"foo",text:"module"}}};return Script}()}.call(this,module);
I20210323-14:42:14.399(0) server.js:204 Integrations ➔ Incoming WebHook.error [Stack:]
I20210323-14:42:14.402(0) server.js:204 Integrations ➔ Incoming WebHook.error script.js:1 !function(module1){var Script=function(){function Script(){}var _proto=Script.prototype;_proto.process_incoming_request=function process_incoming_request(_ref){var request=_ref.request;console.log(request.content);return{content:{alias:"foo",text:"module"}}};return Script}()}.call(this,module); ^ ReferenceError: module is not defined at script.js:1:226 at Script.runInContext (vm.js:130:18) at Script.runInNewContext (vm.js:135:17) at getIntegrationScript (app/integrations/server/api/api.js:70:12) at Object.executeIntegrationRest (app/integrations/server/api/api.js:166:13) at app/api/server/api.js:394:82 at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js🔢12) at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39) at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32) at packages/nimble_restivus/lib/route.coffee:59:33
I20210323-14:42:14.403(0) Integrations ➔ Incoming WebHook.warn { statusCode: 400, body: { success: false, error: 'error-evaluating-script', stack: undefined } }

Server Setup Information:
  • Version of Rocket.Chat Server: 3.12.1 HEAD: (f2817c056)
  • Operating System: Debian GNU/Linux
  • Deployment Method: docker (rocketchat/rocket.chat:latest)
  • Number of Running Instances: 1
  • NodeJS Version: v12.18.4
  • MongoDB Version: 4.0.23 / wiredTiger (oplog Enabled)
Additional context

Our real usage are prometheus alerts, which may define data to process in request.content.alerts[0].labels.module key. Either test its presence with if ("module" in alert.labels) { ... } or access it with alert.labels.module raise a ReferenceError.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in app/integrations/server/api/api.js, especially getIntegrationScript and executeIntegrationRest, and reproduce the incoming webhook with a script containing the string or property name "module". Trace why evaluation treats that reference as unavailable. Done means the webhook script runs successfully and returns its content without a ReferenceError.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.