fix(security): SSRF, access control, and info disclosure

apps/sim/app/api/copilot/feedback/route.test.ts

@@ -12,6 +12,7 @@ const {
  mockReturning,
  mockSelect,
  mockFrom,
+ mockWhere,
  mockAuthenticate,
  mockCreateUnauthorizedResponse,
  mockCreateBadRequestResponse,
@@ -23,6 +24,7 @@ const {
  mockReturning: vi.fn(),
  mockSelect: vi.fn(),
  mockFrom: vi.fn(),
+ mockWhere: vi.fn(),
  mockAuthenticate: vi.fn(),
  mockCreateUnauthorizedResponse: vi.fn(),
  mockCreateBadRequestResponse: vi.fn(),
@@ -81,7 +83,8 @@ describe('Copilot Feedback API Route', () => {
  mockValues.mockReturnValue({ returning: mockReturning })
  mockReturning.mockResolvedValue([])
  mockSelect.mockReturnValue({ from: mockFrom })
- mockFrom.mockResolvedValue([])
+ mockFrom.mockReturnValue({ where: mockWhere })
+ mockWhere.mockResolvedValue([])
 
  mockCreateRequestTracker.mockReturnValue({
  requestId: 'test-request-id',
@@ -386,7 +389,7 @@ edges:
  isAuthenticated: true,
  })
 
-mockFrom.mockResolvedValueOnce([])
+mockWhere.mockResolvedValueOnce([])
 
  const request = new Request('http://localhost:3000/api/copilot/feedback')
  const response = await GET(request as any)
@@ -397,7 +400,7 @@ edges:
  expect(responseData.feedback).toEqual([])
  })
 
- it('should return all feedback records', async () => {
+ it('should only return feedback records for the authenticated user', async () => {
  mockAuthenticate.mockResolvedValueOnce({
  userId: 'user-123',
  isAuthenticated: true,
@@ -415,29 +418,23 @@ edges:
  workflowYaml: null,
  createdAt: new Date('2024-01-01'),
  },
- {
- feedbackId: 'feedback-2',
- userId: 'user-456',
- chatId: 'chat-2',
- userQuery: 'Query 2',
- agentResponse: 'Response 2',
- isPositive: false,
- feedback: 'Not helpful',
- workflowYaml: 'yaml: content',
- createdAt: new Date('2024-01-02'),
- },
  ]
-mockFrom.mockResolvedValueOnce(mockFeedback)
+mockWhere.mockResolvedValueOnce(mockFeedback)
 
  const request = new Request('http://localhost:3000/api/copilot/feedback')
  const response = await GET(request as any)
 
  expect(response.status).toBe(200)
  const responseData = await response.json()
  expect(responseData.success).toBe(true)
- expect(responseData.feedback).toHaveLength(2)
+ expect(responseData.feedback).toHaveLength(1)
  expect(responseData.feedback[0].feedbackId).toBe('feedback-1')
- expect(responseData.feedback[1].feedbackId).toBe('feedback-2')
+ expect(responseData.feedback[0].userId).toBe('user-123')
+
+ // Verify the where clause was called with the authenticated user's ID
+ const { eq } = await import('drizzle-orm')
+ expect(mockWhere).toHaveBeenCalled()
+ expect(eq).toHaveBeenCalledWith('userId', 'user-123')
  })
 
  it('should handle database errors gracefully', async () => {
@@ -446,7 +443,7 @@ edges:
  isAuthenticated: true,
  })
 
-mockFrom.mockRejectedValueOnce(new Error('Database connection failed'))
+mockWhere.mockRejectedValueOnce(new Error('Database connection failed'))
 
  const request = new Request('http://localhost:3000/api/copilot/feedback')
  const response = await GET(request as any)
@@ -462,7 +459,7 @@ edges:
  isAuthenticated: true,
  })
 
-mockFrom.mockResolvedValueOnce([])
+mockWhere.mockResolvedValueOnce([])
 
  const request = new Request('http://localhost:3000/api/copilot/feedback')
  const response = await GET(request as any)

apps/sim/app/api/copilot/feedback/route.ts

@@ -1,6 +1,7 @@
 import { db } from '@sim/db'
 import { copilotFeedback } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
+import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import {
@@ -109,7 +110,7 @@ export async function POST(req: NextRequest) {
 
 /**
  * GET /api/copilot/feedback
- * Get all feedback records (for analytics)
+ * Get feedback records for the authenticated user
  */
 export async function GET(req: NextRequest) {
  const tracker = createRequestTracker()
@@ -123,7 +124,7 @@ export async function GET(req: NextRequest) {
  return createUnauthorizedResponse()
  }
 
- // Get all feedback records
+ // Get feedback records for the authenticated user only
  const feedbackRecords = await db
  .select({
  feedbackId: copilotFeedback.feedbackId,
@@ -137,6 +138,7 @@ export async function GET(req: NextRequest) {
  createdAt: copilotFeedback.createdAt,
  })
  .from(copilotFeedback)
+ .where(eq(copilotFeedback.userId, authenticatedUserId))
 
  logger.info(`[${tracker.requestId}] Retrieved ${feedbackRecords.length} feedback records`)
 

apps/sim/app/api/copilot/training/examples/route.ts

@@ -1,6 +1,10 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
+import {
+ authenticateCopilotRequestSessionOnly,
+ createUnauthorizedResponse,
+} from '@/lib/copilot/request-helpers'
 import { env } from '@/lib/core/config/env'
 
 const logger = createLogger('CopilotTrainingExamplesAPI')
@@ -16,6 +20,11 @@ const TrainingExampleSchema = z.object({
 })
 
 export async function POST(request: NextRequest) {
+ const { userId, isAuthenticated } = await authenticateCopilotRequestSessionOnly()
+ if (!isAuthenticated || !userId) {
+ return createUnauthorizedResponse()
+ }
+
  const baseUrl = env.AGENT_INDEXER_URL
  if (!baseUrl) {
  logger.error('Missing AGENT_INDEXER_URL environment variable')

apps/sim/app/api/copilot/training/route.ts

@@ -1,6 +1,10 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
+import {
+ authenticateCopilotRequestSessionOnly,
+ createUnauthorizedResponse,
+} from '@/lib/copilot/request-helpers'
 import { env } from '@/lib/core/config/env'
 
 const logger = createLogger('CopilotTrainingAPI')
@@ -22,6 +26,11 @@ const TrainingDataSchema = z.object({
 })
 
 export async function POST(request: NextRequest) {
+ const { userId, isAuthenticated } = await authenticateCopilotRequestSessionOnly()
+ if (!isAuthenticated || !userId) {
+ return createUnauthorizedResponse()
+ }
+
  try {
  const baseUrl = env.AGENT_INDEXER_URL
  if (!baseUrl) {

apps/sim/app/api/organizations/[id]/invitations/[invitationId]/route.ts

@@ -61,6 +61,21 @@ export async function GET(
  return NextResponse.json({ error: 'Invitation not found' }, { status: 404 })
  }
 
+ // Verify caller is either an org member or the invitee
+ const isInvitee = session.user.email?.toLowerCase() === orgInvitation.email.toLowerCase()
+
+ if (!isInvitee) {
+ const memberEntry = await db
+ .select()
+ .from(member)
+ .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+ .limit(1)
+
+ if (memberEntry.length === 0) {
+ return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+ }
+ }
+
  const org = await db
  .select()
  .from(organization)

apps/sim/app/api/tools/imap/mailboxes/route.ts

@@ -2,14 +2,14 @@ import { createLogger } from '@sim/logger'
 import { ImapFlow } from 'imapflow'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getSession } from '@/lib/auth'
+import { validateDatabaseHost } from '@/lib/core/security/input-validation.server'
 
 const logger = createLogger('ImapMailboxesAPI')
 
 interface ImapMailboxRequest {
  host: string
  port: number
  secure: boolean
- rejectUnauthorized: boolean
  username: string
  password: string
 }
@@ -22,7 +22,7 @@ export async function POST(request: NextRequest) {
 
  try {
  const body = (await request.json()) as ImapMailboxRequest
- const { host, port, secure, rejectUnauthorized, username, password } = body
+ const { host, port, secure, username, password } = body
 
  if (!host || !username || !password) {
  return NextResponse.json(
@@ -31,16 +31,22 @@ export async function POST(request: NextRequest) {
  )
  }
 
+ const hostValidation = await validateDatabaseHost(host, 'host')
+ if (!hostValidation.isValid) {
+ return NextResponse.json({ success: false, message: hostValidation.error }, { status: 400 })
+ }
+
  const client = new ImapFlow({
- host,
+ host: hostValidation.resolvedIP!,
+ servername: host,
  port: port || 993,
  secure: secure ?? true,
  auth: {
  user: username,
  pass: password,
  },
  tls: {
- rejectUnauthorized: rejectUnauthorized ?? true,
+ rejectUnauthorized: true,
  },
  logger: false,
  })
@@ -79,21 +85,12 @@ export async function POST(request: NextRequest) {
  const errorMessage = error instanceof Error ? error.message : 'Unknown error'
  logger.error('Error fetching IMAP mailboxes:', errorMessage)
 
- let userMessage = 'Failed to connect to IMAP server'
+ let userMessage = 'Failed to connect to IMAP server. Please check your connection settings.'
  if (
  errorMessage.includes('AUTHENTICATIONFAILED') ||
  errorMessage.includes('Invalid credentials')
  ) {
  userMessage = 'Invalid username or password. For Gmail, use an App Password.'
- } else if (errorMessage.includes('ENOTFOUND') || errorMessage.includes('getaddrinfo')) {
- userMessage = 'Could not find IMAP server. Please check the hostname.'
- } else if (errorMessage.includes('ECONNREFUSED')) {
- userMessage = 'Connection refused. Please check the port and SSL settings.'
- } else if (errorMessage.includes('certificate') || errorMessage.includes('SSL')) {
- userMessage =
- 'TLS/SSL error. Try disabling "Verify TLS Certificate" for self-signed certificates.'
- } else if (errorMessage.includes('timeout')) {
- userMessage = 'Connection timed out. Please check your network and server settings.'
  }
 
  return NextResponse.json({ success: false, message: userMessage }, { status: 500 })

apps/sim/app/api/tools/sftp/utils.ts

@@ -1,4 +1,5 @@
 import { type Attributes, Client, type ConnectConfig, type SFTPWrapper } from 'ssh2'
+import { validateDatabaseHost } from '@/lib/core/security/input-validation.server'
 
 const S_IFMT = 0o170000
 const S_IFDIR = 0o040000
@@ -91,16 +92,23 @@ function formatSftpError(err: Error, config: { host: string; port: number }): Er
  * Creates an SSH connection for SFTP using the provided configuration.
  * Uses ssh2 library defaults which align with OpenSSH standards.
  */
-export function createSftpConnection(config: SftpConnectionConfig): Promise<Client> {
+export async function createSftpConnection(config: SftpConnectionConfig): Promise<Client> {
+ const host = config.host
+
+ if (!host || host.trim() === '') {
+ throw new Error('Host is required. Please provide a valid hostname or IP address.')
+ }
+
+ const hostValidation = await validateDatabaseHost(host, 'host')
+ if (!hostValidation.isValid) {
+ throw new Error(hostValidation.error)
+ }
+
+ const resolvedHost = hostValidation.resolvedIP ?? host.trim()
+
  return new Promise((resolve, reject) => {
  const client = new Client()
  const port = config.port || 22
- const host = config.host
-
- if (!host || host.trim() === '') {
- reject(new Error('Host is required. Please provide a valid hostname or IP address.'))
- return
- }
 
  const hasPassword = config.password && config.password.trim() !== ''
  const hasPrivateKey = config.privateKey && config.privateKey.trim() !== ''
@@ -111,7 +119,7 @@ export function createSftpConnection(config: SftpConnectionConfig): Promise<Clie
  }
 
  const connectConfig: ConnectConfig = {
- host: host.trim(),
+ host: resolvedHost,
  port,
  username: config.username,
  }

apps/sim/app/api/tools/smtp/send/route.ts

@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import nodemailer from 'nodemailer'
 import { z } from 'zod'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { validateDatabaseHost } from '@/lib/core/security/input-validation.server'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { RawFileInputArraySchema } from '@/lib/uploads/utils/file-schemas'
 import { processFilesToUserFiles } from '@/lib/uploads/utils/file-utils'
@@ -56,6 +57,15 @@ export async function POST(request: NextRequest) {
  const body = await request.json()
  const validatedData = SmtpSendSchema.parse(body)
 
+ const hostValidation = await validateDatabaseHost(validatedData.smtpHost, 'smtpHost')
+ if (!hostValidation.isValid) {
+ logger.warn(`[${requestId}] SMTP host validation failed`, {
+ host: validatedData.smtpHost,
+ error: hostValidation.error,
+ })
+ return NextResponse.json({ success: false, error: hostValidation.error }, { status: 400 })
+ }
+
  logger.info(`[${requestId}] Sending email via SMTP`, {
  host: validatedData.smtpHost,
  port: validatedData.smtpPort,
@@ -64,8 +74,13 @@ export async function POST(request: NextRequest) {
  secure: validatedData.smtpSecure,
  })
 
+ // Pin the pre-resolved IP to prevent DNS rebinding (TOCTOU) attacks.
+ // Pass resolvedIP as the host so nodemailer connects to the validated address,
+ // and set servername for correct TLS SNI/certificate validation.
+ const pinnedHost = hostValidation.resolvedIP ?? validatedData.smtpHost
+
  const transporter = nodemailer.createTransport({
- host: validatedData.smtpHost,
+ host: pinnedHost,
  port: validatedData.smtpPort,
  secure: validatedData.smtpSecure === 'SSL',
  auth: {
@@ -74,12 +89,8 @@ export async function POST(request: NextRequest) {
  },
  tls:
  validatedData.smtpSecure === 'None'
- ? {
- rejectUnauthorized: false,
- }
- : {
- rejectUnauthorized: true,
- },
+ ? { rejectUnauthorized: false, servername: validatedData.smtpHost }
+ : { rejectUnauthorized: true, servername: validatedData.smtpHost },
  })
 
  const contentType = validatedData.contentType || 'text'
@@ -189,16 +200,16 @@ export async function POST(request: NextRequest) {
  if (isNodeError(error)) {
  if (error.code === 'EAUTH') {
  errorMessage = 'SMTP authentication failed - check username and password'
- } else if (error.code === 'ECONNECTION' || error.code === 'ECONNREFUSED') {
+ } else if (
+ error.code === 'ECONNECTION' ||
+ error.code === 'ECONNREFUSED' ||
+ error.code === 'ECONNRESET' ||
+ error.code === 'ETIMEDOUT'
+ ) {
  errorMessage = 'Could not connect to SMTP server - check host and port'
- } else if (error.code === 'ECONNRESET') {
- errorMessage = 'Connection was reset by SMTP server'
- } else if (error.code === 'ETIMEDOUT') {
- errorMessage = 'SMTP server connection timeout'
  }
  }
 
- // Check for SMTP response codes
  const hasResponseCode = (err: unknown): err is { responseCode: number } => {
  return typeof err === 'object' && err !== null && 'responseCode' in err
  }