Release 8.1.1

.changeset/bump-patch-1771425547745.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.

.changeset/nice-glasses-love.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

apps/meteor/app/api/server/helpers/parseJsonQuery.ts

@@ -142,7 +142,8 @@ export async function parseJsonQuery(api: GenericRouteExecutionContext): Promise
 			}
 		}
 
-		if (queryFields && !isValidQuery(query, queryFields || ['*'], queryOperations ?? pathAllowConf.def)) {
+		const containsQueryFields = queryFields.length > 0;
+		if (containsQueryFields && !isValidQuery(query, queryFields, queryOperations ?? pathAllowConf.def)) {
 			throw new Meteor.Error('error-invalid-query', isValidQuery.errors.join('\n'));
 		}
 

apps/meteor/app/api/server/lib/isValidQuery.ts

@@ -1,3 +1,5 @@
+import { isRecord } from '@rocket.chat/tools';
+
 import { removeDangerousProps } from './cleanQuery';
 
 type Query = { [k: string]: any };
@@ -8,7 +10,8 @@ export const isValidQuery: {
 } = Object.assign(
 	(query: Query, allowedAttributes: string[], allowedOperations: string[]): boolean => {
 		isValidQuery.errors = [];
-		if (!(query instanceof Object)) {
+		// query is an object with null prototype, so it wont be instance of Object
+		if (!isRecord(query)) {
 			throw new Error('query must be an object');
 		}
 
@@ -21,7 +24,7 @@ export const isValidQuery: {
 );
 
 const verifyQuery = (query: Query, allowedAttributes: string[], allowedOperations: string[], parent = ''): boolean => {
-	return Object.entries(removeDangerousProps(query)).every(([key, value]) => {
+	return Object.entries(removeDangerousProps({ ...query })).every(([key, value]) => {
 		const path = parent ? `${parent}.${key}` : key;
 		if (key.startsWith('$')) {
 			if (!allowedOperations.includes(key)) {
@@ -33,7 +36,7 @@ const verifyQuery = (query: Query, allowedAttributes: string[], allowedOperation
 				return value.every((v) => verifyQuery(v, allowedAttributes, allowedOperations));
 			}
 
-			if (value instanceof Object) {
+			if (isRecord(value)) {
 				return verifyQuery(value, allowedAttributes, allowedOperations, path);
 			}
 
@@ -56,7 +59,7 @@ const verifyQuery = (query: Query, allowedAttributes: string[], allowedOperation
 			return false;
 		}
 
-		if (value instanceof Object) {
+		if (isRecord(value)) {
 			return verifyQuery(value, allowedAttributes, allowedOperations, path);
 		}
 		return true;

apps/meteor/app/api/server/v1/users.ts

@@ -511,8 +511,6 @@ API.v1.addRoute(
 
 			const inclusiveFieldsKeys = Object.keys(inclusiveFields);
 
-			const hasUserQuery = query && Object.keys(query).length > 0;
-
 			const nonEmptyQuery = getNonEmptyQuery(query, await hasPermissionAsync(this.userId, 'view-full-other-user-info'));
 
 			// if user provided a query, validate it with their allowed operators
@@ -528,7 +526,9 @@ API.v1.addRoute(
 						inclusiveFieldsKeys.includes('type') && 'type.*',
 						inclusiveFieldsKeys.includes('customFields') && 'customFields.*',
 					].filter(Boolean) as string[],
-					hasUserQuery ? this.queryOperations : [...this.queryOperations, '$regex', '$options'],
+					// At this point, we have already validated the user query not containing malicious fields
+					// On here we are using our own query so we can allow some extra fields
+					[...this.queryOperations, '$regex', '$options'],
 				)
 			) {
 				throw new Meteor.Error('error-invalid-query', isValidQuery.errors.join('\n'));

apps/meteor/app/file/server/file.server.ts

@@ -10,6 +10,8 @@ import { NpmModuleMongodb } from 'meteor/npm-mongo';
 import mime from 'mime-type/with-db';
 import mkdirp from 'mkdirp';
 
+import { sanitizeFileName } from './functions/sanitizeFileName';
+
 const { db } = MongoInternals.defaultRemoteCollectionDriver().mongo;
 
 type IFile = {
@@ -141,23 +143,23 @@ class FileSystem implements IRocketChatFileStore {
 	}
 
 	createWriteStream(fileName: string) {
-		const ws = fs.createWriteStream(path.join(this.absolutePath, fileName));
+		const ws = fs.createWriteStream(path.join(this.absolutePath, sanitizeFileName(fileName)));
 		ws.on('close', () => {
 			return ws.emit('end');
 		});
 		return ws;
 	}
 
 	createReadStream(fileName: string) {
-		return fs.createReadStream(path.join(this.absolutePath, fileName));
+		return fs.createReadStream(path.join(this.absolutePath, sanitizeFileName(fileName)));
 	}
 
 	stat(fileName: string) {
-		return fsp.stat(path.join(this.absolutePath, fileName));
+		return fsp.stat(path.join(this.absolutePath, sanitizeFileName(fileName)));
 	}
 
 	async remove(fileName: string) {
-		return fsp.unlink(path.join(this.absolutePath, fileName));
+		return fsp.unlink(path.join(this.absolutePath, sanitizeFileName(fileName)));
 	}
 
 	async getFileWithReadStream(fileName: string) {

apps/meteor/app/file/server/functions/sanitizeFileName.spec.ts

@@ -0,0 +1,55 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+
+import { sanitizeFileName } from './sanitizeFileName';
+
+describe('sanitizeFileName', () => {
+	describe('valid filenames', () => {
+		it('should allow simple filenames', () => {
+			const result = sanitizeFileName('sound.mp3');
+			expect(result).to.equal('sound.mp3');
+		});
+
+		it('should allow filenames with dashes, underscores and dots', () => {
+			const result = sanitizeFileName('alert_test-01.wav');
+			expect(result).to.equal('alert_test-01.wav');
+		});
+
+		it('should allow filenames without extension', () => {
+			const result = sanitizeFileName('beep');
+			expect(result).to.equal('beep');
+		});
+	});
+
+	describe('invalid paths', () => {
+		it('should reject path traversal using ../', () => {
+			expect(() => sanitizeFileName('../etc/passwd')).to.throw();
+		});
+
+		it('should reject path traversal using ./', () => {
+			expect(() => sanitizeFileName('./folder/sounds')).to.throw();
+		});
+
+		it('should reject nested paths', () => {
+			expect(() => sanitizeFileName('sounds/alert.mp3')).to.throw();
+		});
+
+		it('should reject absolute paths', () => {
+			expect(() => sanitizeFileName('/etc/passwd')).to.throw();
+		});
+	});
+
+	describe('invalid characters', () => {
+		it('should reject filenames with spaces', () => {
+			expect(() => sanitizeFileName('my sound.mp3')).to.throw();
+		});
+
+		it('should reject filenames with special characters', () => {
+			expect(() => sanitizeFileName('sound$.mp3')).to.throw();
+		});
+
+		it('should reject filenames with backslashes', () => {
+			expect(() => sanitizeFileName('..\\passwd')).to.throw();
+		});
+	});
+});

apps/meteor/app/file/server/functions/sanitizeFileName.ts

@@ -0,0 +1,19 @@
+import path from 'path';
+
+export function sanitizeFileName(fileName: string) {
+	const base = path.basename(fileName);
+
+	if (base !== fileName) {
+		throw new Error('error-invalid-file-name');
+	}
+
+	if (base === '.' || base.startsWith('..')) {
+		throw new Error('error-invalid-file-name');
+	}
+
+	if (!/^[a-zA-Z0-9._-]+$/.test(base)) {
+		throw new Error('error-invalid-characters-in-file-name');
+	}
+
+	return base;
+}

docker-compose-ci.yml

@@ -201,7 +201,7 @@ services:
     image: kong/httpbin
 
   traefik:
-    image: traefik:v3.1
+    image: traefik:v3.6.6
     command:
       - --providers.docker=true
       - '--serverstransport.maxidleconnsperhost=-1'

docker-compose-local.yml

@@ -1,11 +1,6 @@
-version: '3.8'
-
 services:
   rocketchat:
     platform: linux/amd64
-    build:
-      dockerfile: apps/meteor/.docker/Dockerfile.alpine
-      context: /tmp/build
     image: ghcr.io/${LOWERCASE_REPOSITORY}/rocket.chat:${DOCKER_TAG}
     environment:
       - TEST_MODE=true
@@ -29,10 +24,6 @@ services:
 
   authorization-service:
     platform: linux/amd64
-    build:
-      dockerfile: ee/apps/authorization-service/Dockerfile
-      args:
-        SERVICE: authorization-service
     image: ghcr.io/${LOWERCASE_REPOSITORY}/authorization-service:${DOCKER_TAG}
     environment:
       - 'MONGO_URL=${MONGO_URL}'
@@ -45,10 +36,6 @@ services:
 
   account-service:
     platform: linux/amd64
-    build:
-      dockerfile: ee/apps/account-service/Dockerfile
-      args:
-        SERVICE: account-service
     image: ghcr.io/${LOWERCASE_REPOSITORY}/account-service:${DOCKER_TAG}
     environment:
       - MONGO_URL=${MONGO_URL}
@@ -61,10 +48,6 @@ services:
 
   presence-service:
     platform: linux/amd64
-    build:
-      dockerfile: ee/apps/presence-service/Dockerfile
-      args:
-        SERVICE: presence-service
     image: ghcr.io/${LOWERCASE_REPOSITORY}/presence-service:${DOCKER_TAG}
     environment:
       - MONGO_URL=${MONGO_URL}
@@ -77,10 +60,6 @@ services:
 
   ddp-streamer-service:
     platform: linux/amd64
-    build:
-      dockerfile: ee/apps/ddp-streamer/Dockerfile
-      args:
-        SERVICE: ddp-streamer
     image: ghcr.io/${LOWERCASE_REPOSITORY}/ddp-streamer-service:${DOCKER_TAG}
     environment:
       - MONGO_URL=${MONGO_URL}
@@ -99,10 +78,6 @@ services:
 
   queue-worker-service:
     platform: linux/amd64
-    build:
-      dockerfile: ee/apps/queue-worker/Dockerfile
-      args:
-        SERVICE: queue-worker
     image: ghcr.io/${LOWERCASE_REPOSITORY}/queue-worker-service:${DOCKER_TAG}
     environment:
       - MONGO_URL=${MONGO_URL}
@@ -115,10 +90,6 @@ services:
 
   omnichannel-transcript-service:
     platform: linux/amd64
-    build:
-      dockerfile: ee/apps/omnichannel-transcript/Dockerfile
-      args:
-        SERVICE: omnichannel-transcript
     image: ghcr.io/${LOWERCASE_REPOSITORY}/omnichannel-transcript-service:${DOCKER_TAG}
     environment:
       - MONGO_URL=${MONGO_URL}
@@ -142,7 +113,7 @@ services:
       bash -c
         "mongod --replSet $$MONGODB_REPLICA_SET_NAME --bind_ip_all &
           sleep 2;
-          until mongosh --eval \"db.adminCommand('ping')\"; do 
+          until mongosh --eval \"db.adminCommand('ping')\"; do
             echo '=====> Waiting for Mongo...';
             sleep 1;
           done;
@@ -155,9 +126,10 @@ services:
     image: nats:2.6-alpine
 
   traefik:
-    image: traefik:v2.8
+    image: traefik:v3.6.6
     command:
       - --providers.docker=true
+      - '--serverstransport.maxidleconnsperhost=-1'
     ports:
       - 3000:80
     volumes: