fix(credentials): address the final audit

An Azure DevOps project or organization pasted already encoded is decoded
once before the traversal-safe segment, so it isn't encoded twice; a base
URL with a single-slash scheme is refused; Upstash accepts a proxy path like
the legacy block; a Thrive tenant id must be printable ASCII.

Author: waleedlatif1

apps/sim/lib/credentials/token-service-accounts/validators/http.test.ts

@@ -7,7 +7,10 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
 
-import { tokenCheckValidator } from '@/lib/credentials/token-service-accounts/validators/http'
+import {
+  normalizeHttpBaseUrl,
+  tokenCheckValidator,
+} from '@/lib/credentials/token-service-accounts/validators/http'
 
 const validate = tokenCheckValidator({
   serviceLabel: 'Example',
@@ -156,6 +159,13 @@ describe('tokenCheckValidator with a typed host', () => {
     )
   })
 
+  it('refuses a base URL with a mistyped scheme instead of reading the scheme as a host', () => {
+    expect(() => normalizeHttpBaseUrl('https:/grafana.example.com')).toThrow(/scheme/)
+    expect(normalizeHttpBaseUrl('grafana.example.com:3000/')).toBe(
+      'https://grafana.example.com:3000'
+    )
+  })
+
   it('refuses a host its normalizer rejects without sending the token anywhere', async () => {
     await expect(
       validateHost({ apiToken: 'good', domain: 'evil.example.com@tools.example.com' })

apps/sim/lib/credentials/token-service-accounts/validators/http.ts

@@ -98,23 +98,19 @@ export function readJsonBody(response: ProviderResponse, serviceLabel: string):
  * A typed http(s) base URL in the form tools build request paths on: a bare host
  * is taken as https, trailing slashes are dropped, and any other scheme,
  * credentials, a query, or a fragment is refused, since each would retarget the
- * request. `allowPath: false` also refuses a path, for tools that append to the
- * origin.
+ * request.
  */
-export function normalizeHttpBaseUrl(
-  raw: string | undefined,
-  { allowPath = true }: { allowPath?: boolean } = {}
-): string {
+export function normalizeHttpBaseUrl(raw: string | undefined): string {
   const typed = (raw ?? '').trim()
   if (!typed) throw new Error('missing URL')
+  // `https:/host` would otherwise get a second scheme and parse as a host named `https`.
+  if (/^https?:(?!\/\/)/i.test(typed)) throw new Error('malformed scheme')
   const url = new URL(/^[a-z][a-z\d+.-]*:\/\//i.test(typed) ? typed : `https://${typed}`)
   if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new Error('http(s) only')
   if (url.username || url.password || url.search || url.hash) {
     throw new Error('credentials, query, or fragment in URL')
   }
-  const path = url.pathname.replace(/\/+$/, '')
-  if (path && !allowPath) throw new Error('path not allowed')
-  return `${url.origin}${path}`
+  return `${url.origin}${url.pathname.replace(/\/+$/, '')}`
 }
 
 /**

apps/sim/lib/credentials/token-service-accounts/validators/token-checks.ts

@@ -1313,8 +1313,8 @@ export const validateThriveServiceAccount = tokenCheckValidator({
   domain: allowedDomain(THRIVE_HOSTS),
   workspaceId: ({ providerWorkspaceId }) => {
     const tenantId = (providerWorkspaceId ?? '').trim()
-    // The tenant id is the Basic-auth username, so a colon would split it.
-    if (!tenantId || /[:\s]/.test(tenantId)) throw new Error('invalid tenant id')
+    // The tenant id is the Basic-auth username: printable ASCII, and no colon, which would split it.
+    if (!/^[\x21-\x39\x3b-\x7e]+$/.test(tenantId)) throw new Error('invalid tenant id')
     return tenantId
   },
   request: ({ apiToken, domain, providerWorkspaceId = '' }) => ({
@@ -1397,7 +1397,7 @@ export const validateTypeformServiceAccount = tokenCheckValidator({
  */
 export const validateUpstashServiceAccount = tokenCheckValidator({
   serviceLabel: 'Upstash',
-  domain: ({ domain }) => normalizeHttpBaseUrl(domain, { allowPath: false }),
+  domain: ({ domain }) => normalizeHttpBaseUrl(domain),
   egress: 'configuredEndpoint',
   request: ({ apiToken, domain }) => ({
     url: `${domain}/ping`,

apps/sim/tools/azure_devops/azure-devops.test.ts

@@ -564,7 +564,13 @@ describe('Azure DevOps project-scoped URLs', () => {
     expect(url.pathname).toBe('/contoso/My%20Project/_apis/wit/workitems/7')
   })
 
-  it.each(['../../other-org/proj', '..', 'proj/../../other-org'])(
+  it('sends a project name pasted already encoded from the address bar unchanged', () => {
+    const url = new URL(buildUrl(getWorkItemTool, { ...base, project: 'My%20Project' } as never))
+
+    expect(url.pathname).toBe('/contoso/My%20Project/_apis/wit/workitems/7')
+  })
+
+  it.each(['../../other-org/proj', '..', 'proj/../../other-org', '%2e%2e'])(
     'refuses a project that would climb into another organization (%s)',
     (project) => {
       expect(() => buildUrl(getWorkItemTool, { ...base, project } as never)).toThrow(/project/)

apps/sim/tools/azure_devops/utils.ts

@@ -7,7 +7,17 @@ import { safeUrlPathSegment } from '@/tools/url-path'
  * climb into another organization's endpoints with the caller's token.
  */
 export function azureDevOpsProjectUrl(params: { organization: string; project: string }): string {
-  return `https://dev.azure.com/${safeUrlPathSegment(params.organization.trim(), 'organization')}/${safeUrlPathSegment(params.project.trim(), 'project')}`
+  return `https://dev.azure.com/${pathSegment(params.organization, 'organization')}/${pathSegment(params.project, 'project')}`
+}
+
+/** A name copied from the browser's address bar arrives encoded; decode it once so it isn't encoded twice. */
+function pathSegment(value: string, paramName: string): string {
+  const typed = value.trim()
+  let decoded = typed
+  try {
+    decoded = decodeURIComponent(typed)
+  } catch {}
+  return safeUrlPathSegment(decoded, paramName)
 }
 
 /** States for Azure DevOps Basic process work items (Issue, Task, Epic). */