fix: add caching for defaultUA db call and code fixes

Author: mannilakash

.claude/settings.local.json

@@ -0,0 +1,11 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(gh pr:*)",
+      "Bash(gh api:*)",
+      "WebFetch(domain:github.com)",
+      "Bash(xargs grep:*)",
+      "Bash(npx tsc:*)"
+    ]
+  }
+}

client/src/Pages/CreateMonitor/index.tsx

@@ -813,6 +813,15 @@ const CreateMonitorPage = () => {
 									fullWidth
 									error={!!fieldState.error}
 									helperText={fieldState.error?.message ?? ""}
+									onChange={(e) => {
+										field.onChange(
+											e.target.value
+												.replace(/[<>]/g, "")
+												.replace(/javascript:/gi, "")
+												.replace(/[^\t\x20-\x7E\x80-\xFF]/g, "") // RFC 7230 header-safe chars only
+												.slice(0, 500)
+										);
+									}}
 								/>
 							)}
 						/>

client/src/Pages/Settings/index.tsx

@@ -442,6 +442,15 @@ export const SettingsPage = () => {
 										placeholder={t("pages.settings.form.userAgent.option.placeholder")}
 										error={!!fieldState.error}
 										helperText={fieldState.error?.message}
+										onChange={(e) => {
+											field.onChange(
+												e.target.value
+													.replace(/[<>]/g, "")
+													.replace(/javascript:/gi, "")
+													.replace(/[^\t\x20-\x7E\x80-\xFF]/g, "") // RFC 7230 header-safe chars only
+													.slice(0, 500)
+											);
+										}}
 									/>
 								)}
 							/>

client/src/Validation/monitor.ts

@@ -38,7 +38,14 @@ const httpSchema = baseSchema.extend({
 	matchMethod: z.enum(["equal", "include", "regex", ""]).optional(),
 	expectedValue: z.string().optional(),
 	jsonPath: z.string().optional(),
-	customUserAgent: z.string().max(500).optional(),
+	customUserAgent: z
+		.string()
+		.max(500)
+		.regex(
+			/^[\t\x20-\x7E\x80-\xFF]*$/,
+			"Only printable characters, spaces, and tabs are allowed (RFC 7230 §3.2.6)"
+		)
+		.optional(),
 });
 
 // Ping monitor schema

client/src/Validation/settings.ts

@@ -15,6 +15,10 @@ export const settingsSchema = z.object({
 	defaultUserAgent: z
 		.string()
 		.max(500)
+		.regex(
+			/^[\t\x20-\x7E\x80-\xFF]*$/,
+			"Only printable characters, spaces, and tabs are allowed (RFC 7230)"
+		)
 		.transform((val) => (val.trim() === "" ? null : val.trim()))
 		.optional(),
 	checkTTL: z

client/src/locales/en.json

@@ -1064,7 +1064,7 @@
 					"description": "Set a default User-Agent header sent with all HTTP uptime monitor requests. Individual monitors can override this. Useful for identifying Checkmate in WAF logs and whitelists.",
 					"option": {
 						"label": "Default User-Agent",
-						"placeholder": "Checkmate/X.X (uptime monitor; your-instance)"
+						"placeholder": "Checkmate/X.X (uptime monitor)"
 					}
 				},
 				"stats": {

server/src/config/services.ts

@@ -248,7 +248,7 @@ export const initializeServices = async ({
 
 	// Network providers
 	const pingProvider = new PingProvider(ping);
-	const httpProvider = new HttpProvider(got, new AdvancedMatcher(jmespath), settingsService);
+	const httpProvider = new HttpProvider(got, new AdvancedMatcher(jmespath));
 	const pageSpeedProvider = new PageSpeedProvider(httpProvider, settingsService, logger);
 	const hardwareProvider = new HardwareProvider(httpProvider);
 	const dockerProvider = new DockerProvider(logger, Docker);

server/src/service/infrastructure/SuperSimpleQueue/SuperSimpleQueueHelper.ts

@@ -132,7 +132,15 @@ export class SuperSimpleQueueHelper implements ISuperSimpleQueueHelper {
 				}
 
 				// Step 2.  Request monitor status
-				const status = await this.networkService.requestStatus(monitor);
+				// Resolve default user agent for HTTP monitors (cached, invalidated on settings update)
+				let effectiveMonitor: Monitor = monitor;
+				if (monitor.type === "http" && !monitor.customUserAgent) {
+					const defaultUserAgent = await this.settingsService.getDefaultUserAgent();
+					if (defaultUserAgent) {
+						effectiveMonitor = { ...monitor, customUserAgent: defaultUserAgent };
+					}
+				}
+				const status = await this.networkService.requestStatus(effectiveMonitor);
 				if (!status) {
 					throw new Error("No network response");
 				}

server/src/service/infrastructure/network/HttpProvider.ts

@@ -7,15 +7,13 @@ import { Agent as HttpsAgent } from "https";
 import { Monitor, MonitorType } from "@/types/monitor.js";
 import { NETWORK_ERROR } from "@/service/infrastructure/network/utils.js";
 import CacheableLookup from "cacheable-lookup";
-import { ISettingsService } from "@/service/system/settingsService.js";
 
 export class HttpProvider implements IStatusProvider<HttpStatusPayload> {
 	readonly type = "http";
 
 	constructor(
 		private got: Got,
-		private advancedMatcher: IAdvancedMatcher,
-		private settingsService: ISettingsService
+		private advancedMatcher: IAdvancedMatcher
 	) {
 		const cacheable = new CacheableLookup({ maxTtl: 300, errorTtl: 30 });
 		this.got = got.extend({
@@ -58,22 +56,27 @@ export class HttpProvider implements IStatusProvider<HttpStatusPayload> {
 		};
 	}
 
+	private sanitizeHeaderValue(value: string): string {
+		if (!value) return "";
+
+		return value
+			.replace(/[<>]/g, "")
+			.replace(/javascript:/gi, "")
+			.replace(/[^\t\x20-\x7E\x80-\xFF]/g, "") // allow only RFC 7230 header-safe characters
+			.trim()
+			.slice(0, 500);
+	}
+
 	async handle<T>(monitor: Monitor): Promise<MonitorStatusResponse<T>> {
 		const { url, secret, jsonPath, ignoreTlsErrors, customUserAgent } = monitor;
 
 		if (!url) {
 			throw new Error("URL is required for HTTP monitor");
 		}
 
-		let userAgent: string | undefined = customUserAgent;
-		if (!userAgent && monitor.type === "http") {
-			const dbSettings = await this.settingsService.getDBSettings();
-			userAgent = dbSettings?.defaultUserAgent ?? undefined;
-		}
-
 		const headers: Record<string, string> = {};
 		if (secret) headers["Authorization"] = `Bearer ${secret}`;
-		if (userAgent) headers["User-Agent"] = userAgent;
+		if (customUserAgent) headers["User-Agent"] = this.sanitizeHeaderValue(customUserAgent);
 
 		const options: Record<string, unknown> = {
 			headers: Object.keys(headers).length > 0 ? headers : undefined,

server/src/service/system/settingsService.ts

@@ -20,13 +20,15 @@ export interface ISettingsService {
 	loadSettings(): EnvConfig;
 	getSettings(): EnvConfig;
 	getDBSettings(): Promise<Settings>;
+	getDefaultUserAgent(): Promise<string | undefined>;
 	updateDbSettings(newSettings: SettingsUpdate): Promise<Settings>;
 }
 
 export class SettingsService implements ISettingsService {
 	static SERVICE_NAME = SERVICE_NAME;
 	private settings: EnvConfig;
 	private settingsRepository: ISettingsRepository | null = null;
+	private cachedDefaultUserAgent: string | null | undefined = undefined;
 
 	constructor(env: ValidatedEnv) {
 		this.settings = {
@@ -70,7 +72,17 @@ export class SettingsService implements ISettingsService {
 		return this.settingsRepository;
 	}
 
+	getDefaultUserAgent = async (): Promise<string | undefined> => {
+		if (this.cachedDefaultUserAgent !== undefined) {
+			return this.cachedDefaultUserAgent ?? undefined;
+		}
+		const settings = await this.getDBSettings();
+		this.cachedDefaultUserAgent = settings.defaultUserAgent ?? null;
+		return this.cachedDefaultUserAgent ?? undefined;
+	};
+
 	updateDbSettings = async (newSettings: SettingsUpdate) => {
+		this.cachedDefaultUserAgent = newSettings.defaultUserAgent ?? null;
 		return await this.getRepository().update(newSettings);
 	};