Skip to content

feat: adding custom/default user agent support for http monitors#3446

Open
akashmannil wants to merge 1 commit intodevelopfrom
feat/monitor-user-agent
Open

feat: adding custom/default user agent support for http monitors#3446
akashmannil wants to merge 1 commit intodevelopfrom
feat/monitor-user-agent

Conversation

@akashmannil
Copy link
Copy Markdown
Collaborator

Custom and Default User agent support for monitoring.

Checkmate/X.X (uptime monitor; your-instance) - Placeholder added keeping in mind of the local checkmate instance. Please do let me know if changes needed

Implements #3260

Please ensure all items are checked off before requesting a review. "Checked off" means you need to add an "x" character between brackets so they turn into checkmarks.

  • (Do not skip this or your PR will be closed) I deployed the application locally.
  • (Do not skip this or your PR will be closed) I have performed a self-review and testing of my code.
  • I have included the issue # in the PR.
  • I have added i18n support to visible strings (instead of <div>Add</div>, use):
const { t } = useTranslation();
<div>{t('add')}</div>
  • I have not included any files that are not related to my pull request, including package-lock and package-json if dependencies have not changed
  • I didn't use any hardcoded values (otherwise it will not scale, and will make it difficult to maintain consistency across the application).
  • I made sure font sizes, color choices etc are all referenced from the theme. I don't have any hardcoded dimensions.
  • My PR is granular and targeted to one specific feature.
  • I ran npm run format in server and client directories, which automatically formats your code.
  • I took a screenshot or a video and attached to this PR if there is a UI change.
image image

Copy link
Copy Markdown
Collaborator

@ajhollid ajhollid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's two major issues here

  1. Excess DB access
  2. Header injection

that need to be addressed. There's also an architectural tweak that can keep HttpProvider less tightly coupled.

Please have a look at my comments in the code review, thanks!

Comment on lines +17 to +18
private advancedMatcher: IAdvancedMatcher,
private settingsService: ISettingsService
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't need a hard dependency on SettingsService here, lets just pass userAgent to the handle method instead.


const headers: Record<string, string> = {};
if (secret) headers["Authorization"] = `Bearer ${secret}`;
if (userAgent) headers["User-Agent"] = userAgent;
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's no validation of the header, this is a pretty serious vulnerability. userAgent must be properly sanitized.


let userAgent: string | undefined = customUserAgent;
if (!userAgent && monitor.type === "http") {
const dbSettings = await this.settingsService.getDBSettings();
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes a DB call on every execution of handle. This does not scale, if you had 500 monitors polling every 15s thats an extra 2000 db calls/min. User agent should be cached on startup, and the cache invalidated on update.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants