Release 8.7.1

.changeset/bump-patch-1787062423707.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.

.changeset/fuzzy-ends-refuse.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

.changeset/lovely-bats-buy.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

.changeset/ninety-buses-create.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where a `MultiSelect` option checkbox remained checked after the option was deselected

.changeset/pink-dolls-flash.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Replace http with serverFetch in downloadPublicImportFile to add SSRF protection

.changeset/shy-actors-jump.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes special characters not being escaped in the visitor name shown in the Omnichannel queue side panel's message preview

.github/workflows/ci-test-e2e.yml

@@ -191,9 +191,14 @@ jobs:
           # the deprecation logger log without throwing. Other suites use the
           # docker-compose default of TEST_MODE='true'.
           TEST_MODE: ${{ startsWith(inputs.type, 'api') && 'api' || 'true' }}
+          TEST_TYPE: ${{ inputs.type }}
         run: |
-          # when we are testing CE, we only need to start the rocketchat container
-          DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose -f docker-compose-ci.yml up -d rocketchat --wait
+          # when we are testing CE, we only need to start the rocketchat container (plus mock-server for the api suite)
+          services=(rocketchat)
+          if [ "$TEST_TYPE" == "api" ]; then
+            services+=(mock-server)
+          fi
+          DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose -f docker-compose-ci.yml up -d "${services[@]}" --wait
 
       - name: Start containers for EE
         if: inputs.release == 'ee'

apps/meteor/client/views/navigation/sidepanel/omnichannel/InquireSidePanelItem.tsx

@@ -1,5 +1,6 @@
 import { isOmnichannelRoom } from '@rocket.chat/core-typings';
 import { SidebarV2ItemIcon as SidebarItemIcon } from '@rocket.chat/fuselage';
+import { escapeHTML } from '@rocket.chat/string-helpers';
 import { RoomAvatar } from '@rocket.chat/ui-avatar';
 import { useUserId } from '@rocket.chat/ui-contexts';
 import { memo } from 'react';
@@ -29,7 +30,8 @@ const InquireSidePanelItem = ({ room, openedRoom, ...props }: InquireSidePanelIt
 
 	const time = 'lastMessage' in room ? room.lastMessage?.ts : undefined;
 	const message =
-		room.lastMessage && `${room.lastMessage.u.name || room.lastMessage.u.username}: ${normalizeMessagePreview(room.lastMessage, t)}`;
+		room.lastMessage &&
+		`${escapeHTML(room.lastMessage.u.name || room.lastMessage.u.username)}: ${normalizeMessagePreview(room.lastMessage, t)}`;
 	const title = roomCoordinator.getRoomName(room.t, room) || '';
 	const href = roomCoordinator.getRouteLink(room.t, room) || '';
 

apps/meteor/package.json

@@ -109,7 +109,7 @@
 		"@rocket.chat/favicon": "workspace:^",
 		"@rocket.chat/federation-matrix": "workspace:^",
 		"@rocket.chat/federation-sdk": "0.7.0",
-		"@rocket.chat/fuselage": "^0.83.0",
+		"@rocket.chat/fuselage": "0.83.1",
 		"@rocket.chat/fuselage-forms": "~1.5.0",
 		"@rocket.chat/fuselage-hooks": "~0.43.0",
 		"@rocket.chat/fuselage-toastbar": "~0.36.1",

apps/meteor/server/meteor-methods/auth/sendForgotPasswordEmail.ts

@@ -2,6 +2,7 @@ import type { ServerMethods } from '@rocket.chat/ddp-client';
 import { Users } from '@rocket.chat/models';
 import { Accounts } from 'meteor/accounts-base';
 import { check } from 'meteor/check';
+import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
 import { Meteor } from 'meteor/meteor';
 
 import { SystemLogger } from '../../lib/logger/system';
@@ -44,3 +45,15 @@ Meteor.methods<ServerMethods>({
 		return sendForgotPasswordEmail(to);
 	},
 });
+
+DDPRateLimiter.addRule(
+	{
+		type: 'method',
+		name: 'sendForgotPasswordEmail',
+		clientAddress() {
+			return true;
+		},
+	},
+	10,
+	60000,
+);

apps/meteor/server/meteor-methods/import/downloadPublicImportFile.ts

@@ -1,23 +1,34 @@
 import fs from 'node:fs';
-import http from 'node:http';
-import https from 'node:https';
+import type { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
 
 import { Import } from '@rocket.chat/core-services';
 import type { IUser } from '@rocket.chat/core-typings';
 import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { serverFetch as fetch } from '@rocket.chat/server-fetch';
 import { Meteor } from 'meteor/meteor';
 
 import { ProgressStep } from '../../../app/importer/lib/ImporterProgressStep';
 import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
 import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
 import { Importers } from '../../lib/import';
 import { RocketChatImportFileInstance } from '../../lib/import/startup/store';
+import { SystemLogger } from '../../lib/logger/system';
+import { settings } from '../../settings';
 
-function downloadHttpFile(fileUrl: string, writeStream: fs.WriteStream): void {
-	const protocol = fileUrl.startsWith('https') ? https : http;
-	protocol.get(fileUrl, (response) => {
-		response.pipe(writeStream);
+async function getHttpFileStream(fileUrl: string): Promise<Readable> {
+	const response = await fetch(fileUrl, {
+		ignoreSsrfValidation: false,
+		allowList: settings.get<string>('SSRF_Allowlist'),
 	});
+
+	const body = response.body as Readable;
+	if (!response.ok) {
+		body.resume();
+		throw new Error(`Unexpected response status ${response.status}`);
+	}
+
+	return body;
 }
 
 function copyLocalFile(filePath: fs.PathLike, writeStream: fs.WriteStream): void {
@@ -53,27 +64,46 @@ export const executeDownloadPublicImportFile = async (userId: IUser['_id'], file
 	await instance.updateProgress(ProgressStep.DOWNLOADING_FILE);
 
 	const writeStream = RocketChatImportFileInstance.createWriteStream(newFileName);
+	let errorProgressUpdate: Promise<unknown> | undefined;
+	const markImportAsFailed = (): Promise<unknown> => {
+		errorProgressUpdate ??= instance.updateProgress(ProgressStep.ERROR).catch((error) => {
+			SystemLogger.error({ msg: 'Failed to update import progress to ERROR', err: error });
+		});
+		return errorProgressUpdate;
+	};
 
 	writeStream.on('error', () => {
-		void instance.updateProgress(ProgressStep.ERROR);
+		void markImportAsFailed();
 	});
 
-	writeStream.on('end', () => {
+	let readStream: Readable | undefined;
+	if (isUrl) {
+		try {
+			readStream = await getHttpFileStream(fileUrl);
+		} catch (error) {
+			writeStream.destroy();
+			await markImportAsFailed();
+			throw error;
+		}
+	}
+
+	writeStream.on('finish', () => {
 		void instance.updateProgress(ProgressStep.FILE_LOADED);
 	});
 
-	if (isUrl) {
-		downloadHttpFile(fileUrl, writeStream);
-	} else {
-		// If the url is actually a folder path on the current machine, skip moving it to the file store
-		if (fs.statSync(fileUrl).isDirectory()) {
-			await instance.updateRecord({ file: fileUrl });
-			await instance.updateProgress(ProgressStep.FILE_LOADED);
-			return;
-		}
+	if (readStream) {
+		void pipeline(readStream, writeStream).catch(() => markImportAsFailed());
+		return;
+	}
 
-		copyLocalFile(fileUrl, writeStream);
+	// If the url is actually a folder path on the current machine, skip moving it to the file store
+	if (fs.statSync(fileUrl).isDirectory()) {
+		await instance.updateRecord({ file: fileUrl });
+		await instance.updateProgress(ProgressStep.FILE_LOADED);
+		return;
 	}
+
+	copyLocalFile(fileUrl, writeStream);
 };
 
 declare module '@rocket.chat/ddp-client' {

apps/meteor/server/meteor-methods/messages/getThreadMessages.ts

@@ -31,6 +31,10 @@ Meteor.methods<ServerMethods>({
 			});
 		}
 
+		if (typeof tmid !== 'string') {
+			throw new Meteor.Error('error-invalid-message', 'Invalid message', { method: 'getThreadMessages' });
+		}
+
 		const thread = await Messages.findOneById(tmid);
 		if (!thread) {
 			return [];
@@ -48,9 +52,9 @@ Meteor.methods<ServerMethods>({
 		}
 
 		await callbacks.run('beforeReadMessages', thread.rid, user._id);
-		await readThread({ user: user as IUser, room, tmid });
+		await readThread({ user: user as IUser, room, tmid: thread._id });
 
-		const result = await Messages.findVisibleThreadByThreadId(tmid, {
+		const result = await Messages.findVisibleThreadByThreadId(thread._id, {
 			...(skip && { skip }),
 			...(limit && { limit }),
 			sort: { ts: -1 },

apps/meteor/server/meteor-methods/messages/getThreadsList.ts

@@ -29,13 +29,17 @@ Meteor.methods<ServerMethods>({
 			throw new Meteor.Error('error-not-allowed', 'Threads Disabled', { method: 'getThreadsList' });
 		}
 
+		if (typeof rid !== 'string') {
+			throw new Meteor.Error('error-invalid-room', 'Invalid room', { method: 'getThreadsList' });
+		}
+
 		const user = await Meteor.userAsync();
 		const room = await Rooms.findOneById(rid);
 
 		if (!user || !room || !(await canAccessRoomAsync(room, user))) {
 			throw new Meteor.Error('error-not-allowed', 'Not Allowed', { method: 'getThreadsList' });
 		}
 
-		return Messages.findThreadsByRoomId(rid, skip, limit).toArray();
+		return Messages.findThreadsByRoomId(room._id, skip, limit).toArray();
 	},
 });

apps/meteor/server/modules/notifications/notifications.module.ts

@@ -250,7 +250,11 @@ export class NotificationsModule {
 			...args: [{ action: string; params: { callId: string; uid: string; rid: string } }] | [IUserDataEvent]
 		) {
 			const [roomId, e] = eventName.split('/') as [string, 'video-conference' | 'userData'];
-			if (this.userId && (await Subscriptions.countByRoomIdAndUserId(roomId, this.userId)) > 0) {
+			if (
+				this.userId &&
+				['video-conference', 'userData'].includes(e) &&
+				(await Subscriptions.countByRoomIdAndUserId(roomId, this.userId)) > 0
+			) {
 				const subscriptions: ISubscription[] = await Subscriptions.findByRoomIdAndNotUserId(roomId, this.userId, {
 					projection: { 'u._id': 1, '_id': 0 },
 				}).toArray();

apps/meteor/tests/end-to-end/api/import.spec.ts

@@ -2,9 +2,15 @@ import { expect } from 'chai';
 import { after, before, describe, it } from 'mocha';
 import type { Response } from 'supertest';
 
+import { sleep } from '../../../lib/utils/sleep';
 import { getCredentials, api, request, credentials } from '../../data/api-data';
+import { mockServerHealthy, mockServerReset, mockServerSet } from '../../data/mock-server.helper';
+import { getSettingValueById, updateSetting } from '../../data/permissions.helper';
 import { password } from '../../data/user';
 import { createUser, login, deleteUser } from '../../data/users.helper';
+import { withTimeout } from '../../data/utils';
+
+const IMPORT_MOCK_SERVER_URL = process.env.IMPORT_MOCK_SERVER_URL ?? 'http://mock-server.dev:8080';
 
 describe('Imports', () => {
 	before((done) => getCredentials(done));
@@ -112,6 +118,70 @@ describe('Imports', () => {
 		});
 	});
 
+	describe('[/downloadPublicImportFile]', () => {
+		let previousSsrfAllowlist: Awaited<ReturnType<typeof getSettingValueById>>;
+
+		const waitForImportStep = (expectedStep: string): Promise<string> =>
+			withTimeout(async (signal) => {
+				let step = '';
+				while (!signal.aborted) {
+					const res = await request.get(api('getImportProgress')).set(credentials).expect(200);
+					step = res.body.step;
+					if (step === expectedStep || step === 'importer_import_failed') {
+						return step;
+					}
+					await sleep(100);
+				}
+				return step;
+			}, 10_000);
+
+		before(async () => {
+			expect(await mockServerHealthy(), 'mock-server is not reachable — ensure it is running').to.be.true;
+			previousSsrfAllowlist = await getSettingValueById('SSRF_Allowlist');
+			await Promise.all([mockServerReset(), updateSetting('SSRF_Allowlist', '')]);
+		});
+
+		after(async () => {
+			await Promise.all([
+				mockServerReset(),
+				previousSsrfAllowlist !== undefined ? updateSetting('SSRF_Allowlist', previousSsrfAllowlist) : Promise.resolve(),
+			]);
+		});
+
+		it('should reject a private target that is not on the SSRF allowlist and mark the operation as failed', async () => {
+			await request
+				.post(api('downloadPublicImportFile'))
+				.set(credentials)
+				.send({ fileUrl: 'http://127.0.0.1:3000/api/v1/info', importerKey: 'slack-users' })
+				.expect(400)
+				.expect((res: Response) => {
+					expect(res.body.success).to.be.false;
+					expect(res.body.error).to.equal('error-ssrf-validation-failed');
+				});
+
+			const progress = await request.get(api('getImportProgress')).set(credentials).expect(200);
+			expect(progress.body.step).to.equal('importer_import_failed');
+		});
+
+		it('should download a file from an allowlisted private target', async () => {
+			await Promise.all([
+				mockServerSet('GET', '/import-test.zip', { marker: 'downloaded-by-server-fetch' }),
+				updateSetting('SSRF_Allowlist', new URL(IMPORT_MOCK_SERVER_URL).host),
+			]);
+
+			await request
+				.post(api('downloadPublicImportFile'))
+				.set(credentials)
+				.send({ fileUrl: `${IMPORT_MOCK_SERVER_URL}/import-test.zip`, importerKey: 'csv' })
+				.expect(200)
+				.expect((res: Response) => {
+					expect(res.body.success).to.be.true;
+				});
+
+			expect(await waitForImportStep('importer_file_loaded')).to.equal('importer_file_loaded');
+		});
+	});
+
 	describe('[/uploadImportFile]', () => {
 		let testUser: any = {};
 		before(async () => {