fix(workday): validate tenantUrl to prevent SSRF in SOAP client

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.test.ts

@@ -1,9 +1,10 @@
 import { featureFlagsMock } from '@sim/testing'
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   validateAirtableId,
   validateAlphanumericId,
   validateAwsRegion,
+  validateCallbackUrl,
   validateEnum,
   validateExternalUrl,
   validateFileExtension,
@@ -21,7 +22,9 @@ import {
   validatePathSegment,
   validateProxyUrl,
   validateS3BucketName,
+  validateServiceNowInstanceUrl,
   validateSupabaseProjectId,
+  validateWorkdayTenantUrl,
 } from '@/lib/core/security/input-validation'
 import { validateUrlWithDNS } from '@/lib/core/security/input-validation.server'
 import { sanitizeForLogging } from '@/lib/core/security/redaction'
@@ -1837,3 +1840,271 @@ describe('validateMondayColumnId', () => {
     })
   })
 })
+
+describe('validateCallbackUrl', () => {
+  const ORIGIN = 'https://sim.app'
+  const originalWindow = (globalThis as { window?: unknown }).window
+
+  beforeEach(() => {
+    ;(globalThis as { window?: unknown }).window = {
+      location: { origin: ORIGIN },
+    }
+  })
+
+  afterEach(() => {
+    if (originalWindow === undefined) {
+      ;(globalThis as { window?: unknown }).window = undefined
+    } else {
+      ;(globalThis as { window?: unknown }).window = originalWindow
+    }
+  })
+
+  describe('accepts legitimate same-origin URLs', () => {
+    it.each([
+      ['/workspace'],
+      ['/invite/abc-123'],
+      ['/invite/abc?foo=bar&baz=qux'],
+      ['/workspace#section'],
+      ['/credential-account/456'],
+      ['?reset=true'],
+      ['/'],
+      ['https://sim.app/workspace'],
+      ['https://sim.app/'],
+      ['HTTPS://SIM.APP/foo'],
+    ])('accepts %s', (url) => {
+      expect(validateCallbackUrl(url)).toBe(true)
+    })
+  })
+
+  describe('rejects open-redirect payloads', () => {
+    it.each([
+      ['', 'empty string'],
+      ['//evil.com', 'protocol-relative'],
+      ['/\\evil.com', 'backslash protocol-relative'],
+      ['\\\\evil.com', 'double backslash'],
+      ['/\t/evil.com', 'tab-stripped protocol-relative'],
+      ['/\n/evil.com', 'newline-stripped protocol-relative'],
+      ['/\r/evil.com', 'CR-stripped protocol-relative'],
+      ['https://evil.com', 'cross-origin absolute URL'],
+      ['https://sim.app@evil.com', 'userinfo smuggling'],
+      ['https://sim.app.evil.com', 'subdomain confusion'],
+      ['https://sim.app:3001/foo', 'different port'],
+      ['http://sim.app/foo', 'different protocol'],
+      ['javascript:alert(1)', 'javascript scheme'],
+      ['data:text/html,<script>alert(1)</script>', 'data scheme'],
+      ['vbscript:msgbox', 'vbscript scheme'],
+    ])('rejects %s (%s)', (url) => {
+      expect(validateCallbackUrl(url)).toBe(false)
+    })
+  })
+
+  describe('server-side (no window)', () => {
+    beforeEach(() => {
+      ;(globalThis as { window?: unknown }).window = undefined
+    })
+
+    it('falls back to placeholder origin and still rejects cross-origin URLs', () => {
+      expect(validateCallbackUrl('/workspace')).toBe(true)
+      expect(validateCallbackUrl('//evil.com')).toBe(false)
+      expect(validateCallbackUrl('https://evil.com')).toBe(false)
+      expect(validateCallbackUrl('javascript:alert(1)')).toBe(false)
+    })
+  })
+})
+
+describe('validateServiceNowInstanceUrl', () => {
+  describe('valid ServiceNow instance URLs', () => {
+    it.concurrent('should accept *.service-now.com', () => {
+      const result = validateServiceNowInstanceUrl('https://acme.service-now.com')
+      expect(result.isValid).toBe(true)
+      expect(result.sanitized).toBe('https://acme.service-now.com')
+    })
+
+    it.concurrent('should accept *.servicenow.com', () => {
+      const result = validateServiceNowInstanceUrl('https://acme.servicenow.com')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should accept *.servicenowservices.com (GovCloud)', () => {
+      const result = validateServiceNowInstanceUrl('https://acme.servicenowservices.com')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should accept URLs with paths', () => {
+      const result = validateServiceNowInstanceUrl('https://acme.service-now.com/api/now/table')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should accept multi-level subdomains', () => {
+      const result = validateServiceNowInstanceUrl('https://dev.acme.service-now.com')
+      expect(result.isValid).toBe(true)
+    })
+  })
+
+  describe('invalid hosts — allowlist rejection', () => {
+    it.concurrent('should reject attacker-controlled domains', () => {
+      const result = validateServiceNowInstanceUrl('https://evil.com')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('ServiceNow-hosted domain')
+    })
+
+    it.concurrent('should reject lookalike suffixes', () => {
+      const result = validateServiceNowInstanceUrl('https://acme.service-now.com.evil.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject embedded substrings', () => {
+      const result = validateServiceNowInstanceUrl('https://service-now.com.evil.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject vanity CNAME hosts (Custom URL plugin)', () => {
+      const result = validateServiceNowInstanceUrl('https://support.acme.com')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('ServiceNow-hosted domain')
+    })
+
+    it.concurrent('should reject userinfo smuggling', () => {
+      const result = validateServiceNowInstanceUrl('https://acme.service-now.com@evil.com')
+      expect(result.isValid).toBe(false)
+    })
+  })
+
+  describe('invalid URLs — delegated to validateExternalUrl', () => {
+    it.concurrent('should reject null', () => {
+      const result = validateServiceNowInstanceUrl(null)
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject empty string', () => {
+      const result = validateServiceNowInstanceUrl('')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject http:// protocol', () => {
+      const result = validateServiceNowInstanceUrl('http://acme.service-now.com')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('https://')
+    })
+
+    it.concurrent('should reject private IPs', () => {
+      const result = validateServiceNowInstanceUrl('https://192.168.1.1')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('private IP')
+    })
+
+    it.concurrent('should reject link-local metadata IP', () => {
+      const result = validateServiceNowInstanceUrl('https://169.254.169.254')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject blocked ports', () => {
+      const result = validateServiceNowInstanceUrl('https://acme.service-now.com:22')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('blocked port')
+    })
+
+    it.concurrent('should reject malformed URLs', () => {
+      const result = validateServiceNowInstanceUrl('not-a-url')
+      expect(result.isValid).toBe(false)
+    })
+  })
+})
+
+describe('validateWorkdayTenantUrl', () => {
+  describe('valid Workday tenant URLs', () => {
+    it.concurrent('should accept *.workday.com implementation tenants', () => {
+      const result = validateWorkdayTenantUrl('https://wd2-impl-services1.workday.com')
+      expect(result.isValid).toBe(true)
+      expect(result.sanitized).toBe('https://wd2-impl-services1.workday.com')
+    })
+
+    it.concurrent('should accept *.workday.com production tenants', () => {
+      const result = validateWorkdayTenantUrl('https://wd5-services1.workday.com')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should accept *.myworkday.com production tenants', () => {
+      const result = validateWorkdayTenantUrl('https://wd5-services1.myworkday.com')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should accept URLs with trailing slash', () => {
+      const result = validateWorkdayTenantUrl('https://wd2-impl-services1.workday.com/')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should be case-insensitive for hostname', () => {
+      const result = validateWorkdayTenantUrl('https://WD5-Services1.Workday.com')
+      expect(result.isValid).toBe(true)
+    })
+  })
+
+  describe('invalid hosts — allowlist rejection', () => {
+    it.concurrent('should reject attacker-controlled domains', () => {
+      const result = validateWorkdayTenantUrl('https://evil.com')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('Workday-hosted domain')
+    })
+
+    it.concurrent('should reject lookalike suffixes', () => {
+      const result = validateWorkdayTenantUrl('https://wd5.workday.com.evil.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject embedded substrings', () => {
+      const result = validateWorkdayTenantUrl('https://workday.com.evil.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject near-miss domains', () => {
+      const result = validateWorkdayTenantUrl('https://evilworkday.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject userinfo smuggling', () => {
+      const result = validateWorkdayTenantUrl('https://wd5.workday.com@evil.com')
+      expect(result.isValid).toBe(false)
+    })
+  })
+
+  describe('invalid URLs — delegated to validateExternalUrl', () => {
+    it.concurrent('should reject null', () => {
+      const result = validateWorkdayTenantUrl(null)
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject empty string', () => {
+      const result = validateWorkdayTenantUrl('')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject http:// protocol', () => {
+      const result = validateWorkdayTenantUrl('http://wd2-impl-services1.workday.com')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('https://')
+    })
+
+    it.concurrent('should reject private IPs', () => {
+      const result = validateWorkdayTenantUrl('https://192.168.1.1')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('private IP')
+    })
+
+    it.concurrent('should reject link-local metadata IP (SSRF classic)', () => {
+      const result = validateWorkdayTenantUrl('https://169.254.169.254')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject blocked ports', () => {
+      const result = validateWorkdayTenantUrl('https://wd2-impl-services1.workday.com:22')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toContain('blocked port')
+    })
+
+    it.concurrent('should reject malformed URLs', () => {
+      const result = validateWorkdayTenantUrl('not-a-url')
+      expect(result.isValid).toBe(false)
+    })
+  })
+})