fix(sanitization): added more input sanitization to tool routes #2475
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
Greptile SummaryThis PR adds input sanitization to 16 tool API routes and introduces a comprehensive validation utility library ( Key improvements:
Critical issues found:
Validation coverage:
Confidence Score: 3/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant Client
participant Route as API Route
participant Val as Validation
participant Auth
participant API as External Service
Client->>Route: Send request
Route->>Val: Validate input IDs
alt Input invalid
Val-->>Route: Return error
Route-->>Client: 400 response
else Input valid
Val-->>Route: Continue
Route->>Auth: Check permissions
Auth-->>Route: Approved
Route->>API: Make request
API-->>Route: Data
Route-->>Client: 200 response
end
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Additional Comments (1)
-
apps/sim/app/api/tools/drive/files/route.ts, line 124-130 (link)style:
mimeTypeandqueryparameters are used inescapeForDriveQuery()but are never validated before use. WhileescapeForDriveQueryescapes quotes and backslashes, it doesn't prevent other injection vectors or validate that these are legitimate values.Consider validating these parameters before using them in the query.
17 files reviewed, 4 comments
| } | ||
|
|
||
| const gmailResponse = await fetch( | ||
| `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`, |
Contributor
There was a problem hiding this comment.
logic: messageId is directly interpolated into the URL path without validation. This could allow path traversal or injection if the ID contains special characters like ../ or encoded sequences.
Suggested change
| `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`, | |
| const messageIdValidation = validateAlphanumericId(validatedData.messageId, 'messageId', 255) | |
| if (!messageIdValidation.isValid) { | |
| logger.warn(`[${requestId}] Invalid message ID: ${messageIdValidation.error}`) | |
| return NextResponse.json( | |
| { | |
| success: false, | |
| error: messageIdValidation.error, | |
| }, | |
| { status: 400 } | |
| ) | |
| } | |
| const gmailResponse = await fetch( | |
| `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`, |
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/tools/gmail/add-label/route.ts
Line: 69:69
Comment:
**logic:** `messageId` is directly interpolated into the URL path without validation. This could allow path traversal or injection if the ID contains special characters like `../` or encoded sequences.
```suggestion
const messageIdValidation = validateAlphanumericId(validatedData.messageId, 'messageId', 255)
if (!messageIdValidation.isValid) {
logger.warn(`[${requestId}] Invalid message ID: ${messageIdValidation.error}`)
return NextResponse.json(
{
success: false,
error: messageIdValidation.error,
},
{ status: 400 }
)
}
const gmailResponse = await fetch(
`${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
```
How can I resolve this? If you propose a fix, please make it concise.| } | ||
|
|
||
| const gmailResponse = await fetch( | ||
| `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`, |
Contributor
There was a problem hiding this comment.
logic: messageId is directly interpolated into the URL path without validation. This could allow path traversal or injection if the ID contains special characters like ../ or encoded sequences.
Suggested change
| `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`, | |
| const messageIdValidation = validateAlphanumericId(validatedData.messageId, 'messageId', 255) | |
| if (!messageIdValidation.isValid) { | |
| logger.warn(`[${requestId}] Invalid message ID: ${messageIdValidation.error}`) | |
| return NextResponse.json( | |
| { | |
| success: false, | |
| error: messageIdValidation.error, | |
| }, | |
| { status: 400 } | |
| ) | |
| } | |
| const gmailResponse = await fetch( | |
| `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`, |
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/tools/gmail/remove-label/route.ts
Line: 72:72
Comment:
**logic:** `messageId` is directly interpolated into the URL path without validation. This could allow path traversal or injection if the ID contains special characters like `../` or encoded sequences.
```suggestion
const messageIdValidation = validateAlphanumericId(validatedData.messageId, 'messageId', 255)
if (!messageIdValidation.isValid) {
logger.warn(`[${requestId}] Invalid message ID: ${messageIdValidation.error}`)
return NextResponse.json(
{
success: false,
error: messageIdValidation.error,
},
{ status: 400 }
)
}
const gmailResponse = await fetch(
`${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
```
How can I resolve this? If you propose a fix, please make it concise.
Comment on lines
57
to
58
| const searchQuery = query || '*' | ||
| const url = `https://graph.microsoft.com/v1.0/sites?search=${encodeURIComponent(searchQuery)}&$select=id,name,displayName,webUrl,createdDateTime,lastModifiedDateTime&$top=50` |
Contributor
There was a problem hiding this comment.
style: query parameter is used directly in URL without validation. While it's URL-encoded, consider adding input validation to prevent potential abuse or malformed queries.
Suggested change
| const searchQuery = query || '*' | |
| const url = `https://graph.microsoft.com/v1.0/sites?search=${encodeURIComponent(searchQuery)}&$select=id,name,displayName,webUrl,createdDateTime,lastModifiedDateTime&$top=50` | |
| let searchQuery = query || '*' | |
| if (query && query.length > 500) { | |
| logger.warn(`[${requestId}] Search query too long`, { length: query.length }) | |
| return NextResponse.json({ error: 'Search query exceeds maximum length' }, { status: 400 }) | |
| } | |
| const url = `https://graph.microsoft.com/v1.0/sites?search=${encodeURIComponent(searchQuery)}&$select=id,name,displayName,webUrl,createdDateTime,lastModifiedDateTime&$top=50` |
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Prompt To Fix With AI
This is a comment left during a code review.
Path: apps/sim/app/api/tools/sharepoint/sites/route.ts
Line: 57:58
Comment:
**style:** `query` parameter is used directly in URL without validation. While it's URL-encoded, consider adding input validation to prevent potential abuse or malformed queries.
```suggestion
let searchQuery = query || '*'
if (query && query.length > 500) {
logger.warn(`[${requestId}] Search query too long`, { length: query.length })
return NextResponse.json({ error: 'Search query exceeds maximum length' }, { status: 400 })
}
const url = `https://graph.microsoft.com/v1.0/sites?search=${encodeURIComponent(searchQuery)}&$select=id,name,displayName,webUrl,createdDateTime,lastModifiedDateTime&$top=50`
```
<sub>Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!</sub>
How can I resolve this? If you propose a fix, please make it concise.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Type of Change
Testing
Tested manually
Checklist