Skip to content

add URL host validation for action URLs #1564

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Artuomka merged 2 commits into from
Feb 5, 2026
Merged

add URL host validation for action URLs #1564

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7fffe11
feat: add URL host validation for action URLs
Artuomka Feb 5, 2026
f1d2250
Merge branch 'main' into backend_security_report
Artuomka Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
216 changes: 114 additions & 102 deletions ...entities/table-actions/table-action-rules-module/use-cases/create-action-rule.use.case.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,118 +14,130 @@ import { buildTableActionWithRule } from '../../table-actions-module/utils/build
import { buildActionEventWithRule } from '../../table-action-events-module/utils/build-action-event-with-rule.util.js';
import { buildFoundActionRulesWithActionsAndEventsDTO } from '../utils/build-found-action-rules-with-actions-and-events-dto.util.js';
import { validateStringWithEnum } from '../../../../helpers/validators/validate-string-with-enum.js';
import { isActionUrlHostAllowed } from '../../../../helpers/validators/is-action-url-host-allowed.js';

@Injectable({ scope: Scope.REQUEST })
export class CreateActionRuleUseCase
extends AbstractUseCase<CreateActionRuleDS, FoundActionRulesWithActionsAndEventsDTO>
implements ICreateActionRule
extends AbstractUseCase<CreateActionRuleDS, FoundActionRulesWithActionsAndEventsDTO>
implements ICreateActionRule
{
constructor(
@Inject(BaseType.GLOBAL_DB_CONTEXT)
protected _dbContext: IGlobalDatabaseContext,
) {
super();
}
constructor(
@Inject(BaseType.GLOBAL_DB_CONTEXT)
protected _dbContext: IGlobalDatabaseContext,
) {
super();
}

protected async implementation(inputData: CreateActionRuleDS): Promise<FoundActionRulesWithActionsAndEventsDTO> {
const { connection_data, action_events_data, rule_data, table_actions_data } = inputData;
const { connectionId, masterPwd, userId } = connection_data;
const { table_name } = rule_data;
protected async implementation(inputData: CreateActionRuleDS): Promise<FoundActionRulesWithActionsAndEventsDTO> {
const { connection_data, action_events_data, rule_data, table_actions_data } = inputData;
const { connectionId, masterPwd, userId } = connection_data;
const { table_name } = rule_data;

await this.validateActionEmailsOrThrowException(table_actions_data, userId);
await this.validateTableNameOrThrowException(table_name, connectionId, masterPwd);
await this.validateTableActionDataOrThrowException(table_actions_data);
await this.validateActionEmailsOrThrowException(table_actions_data, userId);
await this.validateTableNameOrThrowException(table_name, connectionId, masterPwd);
await this.validateTableActionDataOrThrowException(table_actions_data);

const foundConnection = await this._dbContext.connectionRepository.findOne({ where: { id: connectionId } });
const newActionRule = buildEmptyActionRule(rule_data, foundConnection);
const savedActionRule = await this._dbContext.actionRulesRepository.saveNewOrUpdatedActionRule(newActionRule);
const foundConnection = await this._dbContext.connectionRepository.findOne({ where: { id: connectionId } });
const newActionRule = buildEmptyActionRule(rule_data, foundConnection);
const savedActionRule = await this._dbContext.actionRulesRepository.saveNewOrUpdatedActionRule(newActionRule);

const savedTableActions = await Promise.all(
table_actions_data.map((tableAction) => {
const newTableAction = buildTableActionWithRule(tableAction, savedActionRule);
return this._dbContext.tableActionRepository.saveNewOrUpdatedTableAction(newTableAction);
}),
);
const savedTableActions = await Promise.all(
table_actions_data.map((tableAction) => {
const newTableAction = buildTableActionWithRule(tableAction, savedActionRule);
return this._dbContext.tableActionRepository.saveNewOrUpdatedTableAction(newTableAction);
}),
);

const savedActionEvents = await Promise.all(
action_events_data.map((actionEvent) => {
const newActionEvent = buildActionEventWithRule(actionEvent, savedActionRule);
return this._dbContext.actionEventsRepository.saveNewOrUpdatedActionEvent(newActionEvent);
}),
);
savedActionRule.action_events = savedActionEvents;
savedActionRule.table_actions = savedTableActions;
return buildFoundActionRulesWithActionsAndEventsDTO(savedActionRule);
}
const savedActionEvents = await Promise.all(
action_events_data.map((actionEvent) => {
const newActionEvent = buildActionEventWithRule(actionEvent, savedActionRule);
return this._dbContext.actionEventsRepository.saveNewOrUpdatedActionEvent(newActionEvent);
}),
);
savedActionRule.action_events = savedActionEvents;
savedActionRule.table_actions = savedTableActions;
return buildFoundActionRulesWithActionsAndEventsDTO(savedActionRule);
}

private async validateActionEmailsOrThrowException(
table_actions_data: Array<CreateTableActionData>,
userId: string,
): Promise<void> {
const companyWithUsers = await this._dbContext.companyInfoRepository.findUserCompanyWithUsers(userId);
const usersInCompanyEmails = companyWithUsers.users.map((user) => user.email);
const emailsFromEmailActions: Array<string> = table_actions_data.reduce((acc, table_action) => {
if (table_action.action_method === TableActionMethodEnum.EMAIL) {
return acc.concat(table_action.action_emails);
}
return acc;
}, []);
const emailsNotInCompany = emailsFromEmailActions.filter((email) => !usersInCompanyEmails.includes(email));
if (emailsNotInCompany.length > 0) {
throw new BadRequestException(Messages.EMAILS_NOT_IN_COMPANY(emailsNotInCompany));
}
const emailsNotVerified = emailsFromEmailActions.filter((email) => {
const foundUser = companyWithUsers.users.find((user) => user.email === email);
if (foundUser.id === userId) {
return false;
}
return !foundUser.isActive;
});
if (emailsNotVerified.length > 0) {
throw new BadRequestException(Messages.USERS_NOT_VERIFIED(emailsNotVerified));
}
}
private async validateActionEmailsOrThrowException(
table_actions_data: Array<CreateTableActionData>,
userId: string,
): Promise<void> {
const companyWithUsers = await this._dbContext.companyInfoRepository.findUserCompanyWithUsers(userId);
const usersInCompanyEmails = companyWithUsers.users.map((user) => user.email);
const emailsFromEmailActions: Array<string> = table_actions_data.reduce((acc, table_action) => {
if (table_action.action_method === TableActionMethodEnum.EMAIL) {
return acc.concat(table_action.action_emails);
}
return acc;
}, []);
const emailsNotInCompany = emailsFromEmailActions.filter((email) => !usersInCompanyEmails.includes(email));
if (emailsNotInCompany.length > 0) {
throw new BadRequestException(Messages.EMAILS_NOT_IN_COMPANY(emailsNotInCompany));
}
const emailsNotVerified = emailsFromEmailActions.filter((email) => {
const foundUser = companyWithUsers.users.find((user) => user.email === email);
if (foundUser.id === userId) {
return false;
}
return !foundUser.isActive;
});
if (emailsNotVerified.length > 0) {
throw new BadRequestException(Messages.USERS_NOT_VERIFIED(emailsNotVerified));
}
}

private async validateTableNameOrThrowException(
tableName: string,
connectionId: string,
masterPwd: string,
): Promise<void> {
const foundConnection = await this._dbContext.connectionRepository.findAndDecryptConnection(
connectionId,
masterPwd,
);
const dao = getDataAccessObject(foundConnection);
const tablesInConnection = await dao.getTablesFromDB();
const tableNamesInConnection = tablesInConnection.map((table) => table.tableName);
if (!tableNamesInConnection.includes(tableName)) {
throw new BadRequestException(Messages.TABLE_WITH_NAME_NOT_EXISTS(tableName));
}
}
private async validateTableNameOrThrowException(
tableName: string,
connectionId: string,
masterPwd: string,
): Promise<void> {
const foundConnection = await this._dbContext.connectionRepository.findAndDecryptConnection(
connectionId,
masterPwd,
);
const dao = getDataAccessObject(foundConnection);
const tablesInConnection = await dao.getTablesFromDB();
const tableNamesInConnection = tablesInConnection.map((table) => table.tableName);
if (!tableNamesInConnection.includes(tableName)) {
throw new BadRequestException(Messages.TABLE_WITH_NAME_NOT_EXISTS(tableName));
}
}

private async validateTableActionDataOrThrowException(tableActions: Array<CreateTableActionData>): Promise<void> {
for (const action of tableActions) {
if (action.action_method === TableActionMethodEnum.EMAIL) {
if (!action.action_emails || action.action_emails.length === 0) {
throw new BadRequestException(Messages.EMAILS_REQUIRED_FOR_EMAIL_ACTION);
}
}
if (action.action_method === TableActionMethodEnum.SLACK) {
if (!action.action_slack_url) {
throw new BadRequestException(Messages.SLACK_URL_MISSING);
}
}
if (!validateStringWithEnum(action.action_method, TableActionMethodEnum)) {
throw new BadRequestException(Messages.INVALID_ACTION_METHOD(action.action_method));
}
if (action.action_method === TableActionMethodEnum.URL) {
if (process.env.NODE_ENV === 'test') {
return;
}
if (!action.action_url || !ValidationHelper.isValidUrl(action.action_url)) {
throw new BadRequestException(Messages.URL_INVALID);
}
}
}
}
private async validateTableActionDataOrThrowException(tableActions: Array<CreateTableActionData>): Promise<void> {
for (const action of tableActions) {
if (action.action_method === TableActionMethodEnum.EMAIL) {
if (!action.action_emails || action.action_emails.length === 0) {
throw new BadRequestException(Messages.EMAILS_REQUIRED_FOR_EMAIL_ACTION);
}
}
if (action.action_method === TableActionMethodEnum.SLACK) {
if (!action.action_slack_url) {
throw new BadRequestException(Messages.SLACK_URL_MISSING);
}
if (process.env.NODE_ENV !== 'test' && !ValidationHelper.isValidUrl(action.action_slack_url)) {
throw new BadRequestException(Messages.URL_INVALID);
}
const isSlackUrlAllowed = await isActionUrlHostAllowed(action.action_slack_url);
if (!isSlackUrlAllowed) {
throw new BadRequestException(Messages.ACTION_URL_HOST_NOT_ALLOWED);
}
}

Copilot AI Feb 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ZAPIER method appears to use a URL (based on test code showing it uses slack_url field) but is not validated. If ZAPIER actions also use URLs that could be exploited for SSRF attacks, they should be validated similarly to URL and SLACK methods. Please verify if ZAPIER actions need host validation and add the appropriate check if needed.

Suggested change
}
}
if (action.action_method === TableActionMethodEnum.ZAPIER) {
if (!action.action_slack_url) {
throw new BadRequestException(Messages.SLACK_URL_MISSING);
}
if (process.env.NODE_ENV !== 'test' && !ValidationHelper.isValidUrl(action.action_slack_url)) {
throw new BadRequestException(Messages.URL_INVALID);
}
const isZapierUrlAllowed = await isActionUrlHostAllowed(action.action_slack_url);
if (!isZapierUrlAllowed) {
throw new BadRequestException(Messages.ACTION_URL_HOST_NOT_ALLOWED);
}
}

Copilot uses AI. Check for mistakes.
if (!validateStringWithEnum(action.action_method, TableActionMethodEnum)) {
throw new BadRequestException(Messages.INVALID_ACTION_METHOD(action.action_method));
}
if (action.action_method === TableActionMethodEnum.URL) {
if (
process.env.NODE_ENV !== 'test' &&
(!action.action_url || !ValidationHelper.isValidUrl(action.action_url))
) {
throw new BadRequestException(Messages.URL_INVALID);
}
const isUrlAllowed = await isActionUrlHostAllowed(action.action_url);
if (!isUrlAllowed) {
throw new BadRequestException(Messages.ACTION_URL_HOST_NOT_ALLOWED);
}
}
}
}
}
Loading
Loading