registry / @oneuptime/common / 11.5.0

@oneuptime/common@11.5.0

The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 22 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5,017 file(s), 37.3 MB of source, external domains: 130.211.213.119, accounts.google.com, adaptivecards.io, api.anthropic.com, api.example.com, api.github.com, api.groq.com, api.mistral.ai, api.openai.com, api.slack.com, api.telegram.org, api.yourcompany.com, catfact.ninja, core.telegram.org, developer.microsoft.com, discord.com, docs.example.com, example.com, gateway.example.com, github.com, graph.microsoft.com, hcaptcha.com, hooks.slack.com, idp.example.com, invoices.oneuptime.com, learn.microsoft.com, login.microsoftonline.com, mail.google.com, oauth2.googleapis.com, oneuptime.com, oneuptime.example, opentelemetry.io, outlook.office365.com, reseller.oneuptime.com, schema.org, short.url, slack.com, smba.trafficmanager.net, sso.example.com, statics.teams.cdn.office.net, support.discord.com, t.me, vllm.local, www.example.com, www.w3.org, xxxxx.webhook.office.com

Source & flagged code

13 flagged

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView file

Lines 139-195typescript

139 expect(result.isTruncated).toBe(true);

140 });

141

142 test("reports zero rows honestly", () => {

143 const result: SerializedResult = ToolResultSerializer.serializeRows([]);

144 expect(result.rowCount).toBe(0);

145 expect(result.text).toBe("(no rows found)");

146 });

147

148 test("redacts inside rows", () => {

149 const result: SerializedResult = ToolResultSerializer.serializeRows([

150 { body: "contact admin@corp.com now" },

151 ]);

152 expect(result.text).toContain("[redacted-email]");

153 expect(result.redactionCount).toBe(1);

154 });

155});

156

157describe("ToolResultSerializer.redact — additional credential formats", () => {

158 test("redacts PEM private key blocks", () => {

159 const key: string = `-----BEGIN RSA PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L159

160MIIBOgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu

161KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQ==

162-----END RSA PRIVATE KEY-----`;

163 const result: { text: string; count: number } = ToolResultSerializer.redact(

164 `key:\n${key}`,

165 );

166 expect(result.text).toContain("[redacted-private-key]");

167 expect(result.text).not.toContain("MIIBOgIBAAJBAKj34");

168 });

169

170 test("redacts AWS access key ids", () => {

171 const result: { text: string; count: number } = ToolResultSerializer.redact(

172 "aws_key=AKIAIOSFODNN7EXAMPLE region=us-east-1",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L172

Critical

Secret Pattern

AWS access key ID in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L172

173 );

174 expect(result.text).toContain("[redacted-aws-key]");

175 expect(result.text).not.toContain("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L175

176 });

177

178 test("redacts GitHub tokens", () => {

179 const token: string = `ghp_${"a".repeat(36)}`;

180 const result: { text: string; count: number } = ToolResultSerializer.redact(

181 `remote https://${token}@github.com/x/y`,

182 );

183 expect(result.text).toContain("[redacted-github-token]");

184 expect(result.text).not.toContain(token);

185 });

186

187 test("redacts Slack tokens", () => {

188 const result: { text: string; count: number } = ToolResultSerializer.redact(

189 "SLACK_TOKEN=xoxb-1234567890-abcdefghijklmnop",

190 );

191 expect(result.text).toContain("[redacted-slack-token]");

192 expect(result.text).not.toContain("xoxb-1234567890-abcdefghijklmnop");

193 });

194

195 test("redacts Google API keys", () => {

Server/Utils/VM/VMRunner.tsView file

Lines 1-23typescript

1import CapturedMetric from "../../../Types/Monitor/CustomCodeMonitor/CapturedMetric";

2import ReturnResult from "../../../Types/IsolatedVM/ReturnResult";

3import { JSONObject, JSONValue } from "../../../Types/JSON";

4import axios, { AxiosResponse } from "axios";

5import crypto from "crypto";

Server/Services/DockerHostService.tsView file

Lines 37-77typescript

37 );

38 })

39 .then(async () => {

40 await DockerHostOwnerRuleEngineService.applyRulesToDockerHost(

41 createdItem,

42 );

43 })

44 .catch((error: Error

Server/Services/UserWebhookService.tsView file

Lines 79-119typescript

80 for (const item of itemsToDelete) {

81 await UserNotificationRuleService.deleteBy({

82 query: {

83 userWebhookId: item.id!,

84 projectId: item.projectId!,

85 },

86 limit:

test-setup.shView file

•path = test-setup.sh kind = build_helper sizeBytes = 1520 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test-setup.shView on unpkg

UI/Fonts/materialdesignicons-webfont.woff2View file

•path = UI/Fonts/materialdesignicons-webfont.woff2 kind = high_entropy_blob sizeBytes = 325244 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

UI/Fonts/materialdesignicons-webfont.woff2View on unpkg

Models/DatabaseModels/RunbookSecret.tsView file

Lines 219-259typescript

219 @ColumnAccessControl({

220 create: [

221 Permission.ProjectOwner,

222 Permission.ProjectAdmin,

223 Permission.CreateRunbookSecret,

224 ],

225 read: [],

226 update: [

227 Permission.ProjectOwner,

228 Permission.ProjectAdmin,

229 Permission.EditRunbookSecret,

Models/DatabaseModels/MonitorSecret.tsView file

239patternName = stripe_test_secret severity = high line = 239 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in Models/DatabaseModels/MonitorSecret.ts

Models/DatabaseModels/MonitorSecret.tsView on unpkg · L239

build/dist/Models/DatabaseModels/MonitorSecret.jsView file

197patternName = stripe_test_secret severity = high line = 197 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in build/dist/Models/DatabaseModels/MonitorSecret.js

build/dist/Models/DatabaseModels/MonitorSecret.jsView on unpkg · L197

build/dist/Models/DatabaseModels/RunbookSecret.jsView file

197patternName = stripe_test_secret severity = high line = 197 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in build/dist/Models/DatabaseModels/RunbookSecret.js

build/dist/Models/DatabaseModels/RunbookSecret.jsView on unpkg · L197

Source & flagged code

13 flagged · loading source

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView file

172patternName = aws_access_key severity = critical line = 172 matchedText = "aws_key...-1",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L172

159patternName = private_key_rsa severity = critical line = 159 matchedText = const ke...----

Critical

Secret Pattern

RSA private key in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L159

172patternName = aws_access_key severity = critical line = 172 matchedText = "aws_key...-1",

Critical

Secret Pattern

AWS access key ID in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L172

175patternName = aws_access_key severity = critical line = 175 matchedText = expect(r...E");

Critical

Secret Pattern

AWS access key ID in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L175

Server/Utils/VM/VMRunner.tsView file

3import { JSONObject, JSONValue } from "../../../Types/JSON"; L4: import axios, { AxiosResponse } from "axios"; L5: import crypto from "crypto"; ... L88: * Block Playwright methods that can spawn processes or access internals. L89: * Prevents RCE via browser.browserType().launch({executablePath:"/bin/sh"}) L90: * and traversal via page.context().browser().browserType().launch(...) ... L359: @CaptureSpan() L360: public static async runCodeInNodeVM(data: { L361: code: string; ... L646: try { L647: metric.attributes = JSON.parse(attributesJson) as JSONObject; L648: } catch {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

Server/Utils/VM/VMRunner.tsView on unpkg · L3

Server/Services/DockerHostService.tsView file

57@CaptureSpan() L58: public async findOrCreateByHostIdentifier(data: { L59: projectId: ObjectID;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

Server/Services/DockerHostService.tsView on unpkg · L57

Server/Services/UserWebhookService.tsView file

99L100: private validateWebhookUrl(rawUrl: string): void { L101: let parsed: URL; ... L108: const protocolValue: string = parsed.protocol.toString().toLowerCase(); L109: if (protocolValue !== "http://" && protocolValue !== "https://") { L110: throw new BadDataException(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

Server/Services/UserWebhookService.tsView on unpkg · L99

test-setup.shView file

•path = test-setup.sh kind = build_helper sizeBytes = 1520 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test-setup.shView on unpkg

UI/Fonts/materialdesignicons-webfont.woff2View file

•path = UI/Fonts/materialdesignicons-webfont.woff2 kind = high_entropy_blob sizeBytes = 325244 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

UI/Fonts/materialdesignicons-webfont.woff2View on unpkg

Models/DatabaseModels/RunbookSecret.tsView file

239patternName = stripe_test_secret severity = high line = 239 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in Models/DatabaseModels/RunbookSecret.ts

Models/DatabaseModels/RunbookSecret.tsView on unpkg · L239

Models/DatabaseModels/MonitorSecret.tsView file

239patternName = stripe_test_secret severity = high line = 239 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in Models/DatabaseModels/MonitorSecret.ts

Models/DatabaseModels/MonitorSecret.tsView on unpkg · L239

build/dist/Models/DatabaseModels/MonitorSecret.jsView file

197patternName = stripe_test_secret severity = high line = 197 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in build/dist/Models/DatabaseModels/MonitorSecret.js

build/dist/Models/DatabaseModels/MonitorSecret.jsView on unpkg · L197

build/dist/Models/DatabaseModels/RunbookSecret.jsView file

197patternName = stripe_test_secret severity = high line = 197 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in build/dist/Models/DatabaseModels/RunbookSecret.js

build/dist/Models/DatabaseModels/RunbookSecret.jsView on unpkg · L197

Findings

4 Critical6 High5 Medium7 Low

CriticalCritical SecretTests/Server/Utils/AI/ToolResultSerializer.test.ts

CriticalSecret PatternTests/Server/Utils/AI/ToolResultSerializer.test.ts

HighCloud Metadata AccessServer/Services/UserWebhookService.ts

HighShips High Entropy BlobUI/Fonts/materialdesignicons-webfont.woff2

HighSecret PatternModels/DatabaseModels/RunbookSecret.ts

HighSecret PatternModels/DatabaseModels/MonitorSecret.ts

HighSecret Patternbuild/dist/Models/DatabaseModels/MonitorSecret.js

HighSecret Patternbuild/dist/Models/DatabaseModels/RunbookSecret.js

MediumUnsafe Vm ContextServer/Utils/VM/VMRunner.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertest-setup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak CryptoServer/Services/DockerHostService.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView file

Lines 139-195typescript

139 expect(result.isTruncated).toBe(true);

140 });

141

142 test("reports zero rows honestly", () => {

143 const result: SerializedResult = ToolResultSerializer.serializeRows([]);

144 expect(result.rowCount).toBe(0);

145 expect(result.text).toBe("(no rows found)");

146 });

147

148 test("redacts inside rows", () => {

149 const result: SerializedResult = ToolResultSerializer.serializeRows([

150 { body: "contact admin@corp.com now" },

151 ]);

152 expect(result.text).toContain("[redacted-email]");

153 expect(result.redactionCount).toBe(1);

154 });

155});

156

157describe("ToolResultSerializer.redact — additional credential formats", () => {

158 test("redacts PEM private key blocks", () => {

159 const key: string = `-----BEGIN RSA PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L159

160MIIBOgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu

161KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQ==

162-----END RSA PRIVATE KEY-----`;

163 const result: { text: string; count: number } = ToolResultSerializer.redact(

164 `key:\n${key}`,

165 );

166 expect(result.text).toContain("[redacted-private-key]");

167 expect(result.text).not.toContain("MIIBOgIBAAJBAKj34");

168 });

169

170 test("redacts AWS access key ids", () => {

171 const result: { text: string; count: number } = ToolResultSerializer.redact(

172 "aws_key=AKIAIOSFODNN7EXAMPLE region=us-east-1",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L172

Critical

Secret Pattern

AWS access key ID in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L172

173 );

174 expect(result.text).toContain("[redacted-aws-key]");

175 expect(result.text).not.toContain("AKIAIOSFODNN7EXAMPLE");

Critical

Secret Pattern

AWS access key ID in Tests/Server/Utils/AI/ToolResultSerializer.test.ts

Tests/Server/Utils/AI/ToolResultSerializer.test.tsView on unpkg · L175

176 });

177

178 test("redacts GitHub tokens", () => {

179 const token: string = `ghp_${"a".repeat(36)}`;

180 const result: { text: string; count: number } = ToolResultSerializer.redact(

181 `remote https://${token}@github.com/x/y`,

182 );

183 expect(result.text).toContain("[redacted-github-token]");

184 expect(result.text).not.toContain(token);

185 });

186

187 test("redacts Slack tokens", () => {

188 const result: { text: string; count: number } = ToolResultSerializer.redact(

189 "SLACK_TOKEN=xoxb-1234567890-abcdefghijklmnop",

190 );

191 expect(result.text).toContain("[redacted-slack-token]");

192 expect(result.text).not.toContain("xoxb-1234567890-abcdefghijklmnop");

193 });

194

195 test("redacts Google API keys", () => {

Server/Utils/VM/VMRunner.tsView file

Lines 1-23typescript

1import CapturedMetric from "../../../Types/Monitor/CustomCodeMonitor/CapturedMetric";

2import ReturnResult from "../../../Types/IsolatedVM/ReturnResult";

3import { JSONObject, JSONValue } from "../../../Types/JSON";

4import axios, { AxiosResponse } from "axios";

5import crypto from "crypto";

Server/Services/DockerHostService.tsView file

Lines 37-77typescript

37 );

38 })

39 .then(async () => {

40 await DockerHostOwnerRuleEngineService.applyRulesToDockerHost(

41 createdItem,

42 );

43 })

44 .catch((error: Error

Server/Services/UserWebhookService.tsView file

Lines 79-119typescript

80 for (const item of itemsToDelete) {

81 await UserNotificationRuleService.deleteBy({

82 query: {

83 userWebhookId: item.id!,

84 projectId: item.projectId!,

85 },

86 limit:

test-setup.shView file

•path = test-setup.sh kind = build_helper sizeBytes = 1520 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test-setup.shView on unpkg

UI/Fonts/materialdesignicons-webfont.woff2View file

•path = UI/Fonts/materialdesignicons-webfont.woff2 kind = high_entropy_blob sizeBytes = 325244 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

UI/Fonts/materialdesignicons-webfont.woff2View on unpkg

Models/DatabaseModels/RunbookSecret.tsView file

Lines 219-259typescript

219 @ColumnAccessControl({

220 create: [

221 Permission.ProjectOwner,

222 Permission.ProjectAdmin,

223 Permission.CreateRunbookSecret,

224 ],

225 read: [],

226 update: [

227 Permission.ProjectOwner,

228 Permission.ProjectAdmin,

229 Permission.EditRunbookSecret,

Models/DatabaseModels/MonitorSecret.tsView file

239patternName = stripe_test_secret severity = high line = 239 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in Models/DatabaseModels/MonitorSecret.ts

Models/DatabaseModels/MonitorSecret.tsView on unpkg · L239

build/dist/Models/DatabaseModels/MonitorSecret.jsView file

197patternName = stripe_test_secret severity = high line = 197 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in build/dist/Models/DatabaseModels/MonitorSecret.js

build/dist/Models/DatabaseModels/MonitorSecret.jsView on unpkg · L197

build/dist/Models/DatabaseModels/RunbookSecret.jsView file

197patternName = stripe_test_secret severity = high line = 197 matchedText = example:...op",

High

Secret Pattern

Stripe test secret key in build/dist/Models/DatabaseModels/RunbookSecret.js

build/dist/Models/DatabaseModels/RunbookSecret.jsView on unpkg · L197