fix(sim-links): require a closed authority before {*} so values cannot move the host

Author: waleedlatif1

apps/sim/app/o/[organizationId]/links/sim-link-modal.tsx

@@ -19,7 +19,7 @@ import {
   SIM_LINK_VARIABLE,
   simLinkFieldsSchema,
 } from '@/lib/sim-links/validation'
-import { useSaveSimLink } from '@/hooks/queries/sim-links'
+import { useCreateSimLink, useUpdateSimLink } from '@/hooks/queries/sim-links'
 
 type Field = 'name' | 'url' | 'defaultUrl' | 'description'
 
@@ -45,7 +45,9 @@ function draftOf(link: SimLink | undefined, initialName = ''): SimLinkBody {
 
 /** Mount per link (keyed) so each open starts from that link's saved fields. */
 export function SimLinkModal({ organizationId, onClose, link, initialName }: SimLinkModalProps) {
-  const mutation = useSaveSimLink(organizationId)
+  const create = useCreateSimLink(organizationId)
+  const update = useUpdateSimLink(organizationId)
+  const mutation = link ? update : create
   const nameTaken = isApiClientError(mutation.error) && mutation.error.status === 409
   const [draft, setDraft] = useState(() => draftOf(link, initialName))
   const [errors, setErrors] = useState<Partial<Record<Field, string>>>({})
@@ -73,7 +75,8 @@ export function SimLinkModal({ organizationId, onClose, link, initialName }: Sim
       )
       return
     }
-    mutation.mutate({ linkId: link?.id, body: parsed.data }, { onSuccess: onClose })
+    if (link) update.mutate({ linkId: link.id, body: parsed.data }, { onSuccess: onClose })
+    else create.mutate(parsed.data, { onSuccess: onClose })
   }
 
   const title = link ? `Edit sim/${link.name}` : 'New Sim link'

apps/sim/app/o/[organizationId]/links/sim-links.tsx

@@ -75,7 +75,7 @@ export function SimLinks({ organizationId }: SimLinksProps) {
       }
     >
       <div className={RESOURCE_LIST_STACK}>
-        {links.error ? (
+        {links.isLoadingError ? (
           <SettingsQueryErrorState
             error={links.error}
             fallback='Could not load Sim links'

apps/sim/app/sim/[[...path]]/page.tsx

@@ -14,7 +14,6 @@ import { serializeSimLinkView } from '@/app/o/[organizationId]/links/search-para
 
 export const metadata: Metadata = {
   title: 'Sim link',
-  referrer: 'no-referrer',
   robots: { index: false, follow: false },
 }
 

apps/sim/hooks/queries/sim-links.ts

@@ -43,14 +43,20 @@ function useInvalidateSimLinks(organizationId: string) {
   return () => queryClient.invalidateQueries({ queryKey: simLinkKeys.lists(organizationId) })
 }
 
-/** Creates a link, or replaces the fields of `linkId` when given. */
-export function useSaveSimLink(organizationId: string) {
+export function useCreateSimLink(organizationId: string) {
   const invalidate = useInvalidateSimLinks(organizationId)
   return useMutation({
-    mutationFn: ({ linkId, body }: { linkId?: string; body: SimLinkBody }) =>
-      linkId
-        ? requestJson(updateSimLinkContract, { params: { id: organizationId, linkId }, body })
-        : requestJson(createSimLinkContract, { params: { id: organizationId }, body }),
+    mutationFn: (body: SimLinkBody) =>
+      requestJson(createSimLinkContract, { params: { id: organizationId }, body }),
+    onSuccess: invalidate,
+  })
+}
+
+export function useUpdateSimLink(organizationId: string) {
+  const invalidate = useInvalidateSimLinks(organizationId)
+  return useMutation({
+    mutationFn: ({ linkId, body }: { linkId: string; body: SimLinkBody }) =>
+      requestJson(updateSimLinkContract, { params: { id: organizationId, linkId }, body }),
     onSuccess: invalidate,
   })
 }

apps/sim/lib/sim-links/destination.test.ts

@@ -27,6 +27,9 @@ describe('Sim link destinations', () => {
     'https://example.com{*}',
     'https://example.com@{*}',
     'https://example.com:{*}',
+    'https://{*}@corp.example.com/',
+    'https://user:{*}@corp.example.com/',
+    'https://corp.example.com:{*}/path',
     '{*}',
     'https:{*}',
     'javascript:alert(1)',
@@ -64,6 +67,21 @@ describe('Sim link destinations', () => {
     }
   )
 
+  it.each(['https://{*}@corp.example.com/', 'https://user:{*}@corp.example.com/'])(
+    'refuses to resolve %s, whose values could move the host',
+    (url) => {
+      for (const values of [
+        ['evil.com', 'x'],
+        ['443', 'x'],
+        ['a b', 'x:y'],
+      ]) {
+        expect(() => resolveSimLinkTarget({ url, defaultUrl: null }, values)).toThrow(
+          'no fixed http(s) origin'
+        )
+      }
+    }
+  )
+
   it('fills each variable in order, the last taking every remaining value', () => {
     expect(redirectUrl('https://github.com/{*}/issues/{*}', ['sim', 'BUG 12', 'x'])).toBe(
       'https://github.com/sim/issues/BUG%2012/x'
@@ -97,8 +115,10 @@ describe('Sim link destinations', () => {
   })
 
   it('refuses to redirect to a stored destination that is not http(s)', () => {
-    expect(() =>
-      resolveSimLinkTarget({ url: 'javascript:alert(1)', defaultUrl: null }, [])
-    ).toThrow('not an http(s) URL')
+    for (const url of ['javascript:alert(1)', 'data:text/html,hi']) {
+      expect(() => resolveSimLinkTarget({ url, defaultUrl: null }, [])).toThrow(
+        'no fixed http(s) origin'
+      )
+    }
   })
 })

apps/sim/lib/sim-links/destination.ts

@@ -1,4 +1,9 @@
-import { isVariableSimLinkUrl, parseHttpUrl, SIM_LINK_VARIABLE } from '@/lib/sim-links/validation'
+import {
+  isVariableSimLinkUrl,
+  parseHttpUrl,
+  SIM_LINK_VARIABLE,
+  simLinkOrigin,
+} from '@/lib/sim-links/validation'
 
 interface SimLinkDestination {
   url: string
@@ -13,34 +18,45 @@ function encodeSegments(values: readonly string[]): string {
   return values.map(encodeURIComponent).join('/')
 }
 
-function redirectTo(url: string): SimLinkTarget {
+/** Values fill only what follows a closed authority, so leaving `origin` is a broken invariant. */
+function redirectWithin(origin: string, url: string): SimLinkTarget {
   const parsed = parseHttpUrl(url)
-  if (!parsed) throw new Error('Sim link destination is not an http(s) URL')
+  if (parsed?.origin !== origin) throw new Error('Sim link resolved outside its fixed origin')
   return { kind: 'redirect', url: parsed.toString() }
 }
 
 /**
  * Where `sim/<name>/<values…>` leads. A plain link appends the values to its path.
  * A variable link fills each `{*}` in order, the last taking every remaining value,
- * and opens its default destination when given none.
+ * and opens its default destination when given none. Every redirect stays on the
+ * stored destination's origin.
  */
 export function resolveSimLinkTarget(
   link: SimLinkDestination,
   values: readonly string[]
 ): SimLinkTarget {
+  const origin = simLinkOrigin(link.url)
+  if (!origin) throw new Error('Sim link destination has no fixed http(s) origin')
   if (!isVariableSimLinkUrl(link.url)) {
-    if (!values.length) return redirectTo(link.url)
+    if (!values.length) return redirectWithin(origin, link.url)
     const url = new URL(link.url)
     url.pathname = `${url.pathname.replace(/\/+$/, '')}/${encodeSegments(values)}`
-    return redirectTo(url.toString())
+    return redirectWithin(origin, url.toString())
+  }
+  if (!values.length && link.defaultUrl) {
+    const defaultUrl = parseHttpUrl(link.defaultUrl)
+    if (!defaultUrl) throw new Error('Sim link default destination is not an http(s) URL')
+    return { kind: 'redirect', url: defaultUrl.toString() }
   }
   const parts = link.url.split(SIM_LINK_VARIABLE)
   const slots = parts.length - 1
-  if (!values.length && link.defaultUrl) return redirectTo(link.defaultUrl)
   if (values.length < slots) return { kind: 'missing_values', required: slots }
   const fills = [
     ...values.slice(0, slots - 1).map(encodeURIComponent),
     encodeSegments(values.slice(slots - 1)),
   ]
-  return redirectTo(parts.reduce((url, part, index) => url + fills[index - 1] + part))
+  return redirectWithin(
+    origin,
+    parts.reduce((url, part, index) => url + fills[index - 1] + part)
+  )
 }

apps/sim/lib/sim-links/validation.ts

@@ -24,11 +24,17 @@ export function parseHttpUrl(value: string): URL | null {
   return url.protocol === 'https:' || url.protocol === 'http:' ? url : null
 }
 
-/** Values may fill a destination's path, query, or fragment, never its origin. */
-function hasFixedHttpOrigin(url: string): boolean {
-  const first = parseHttpUrl(url.replaceAll(SIM_LINK_VARIABLE, 'a'))
-  const second = parseHttpUrl(url.replaceAll(SIM_LINK_VARIABLE, 'b'))
-  return Boolean(first && second && first.origin === second.origin)
+/** A scheme and authority closed by `/`, `?`, or `#`: nothing typed later can extend the host. */
+const CLOSED_AUTHORITY = /^https?:\/\/[^/?#]+[/?#]/i
+
+/**
+ * The origin every visit to `url` must land on, or null when values could change it. Values fill
+ * only what follows the authority, so the text before the first `{*}` must already close it.
+ */
+export function simLinkOrigin(url: string): string | null {
+  const [prefix] = url.split(SIM_LINK_VARIABLE)
+  if (isVariableSimLinkUrl(url) && !CLOSED_AUTHORITY.test(prefix)) return null
+  return parseHttpUrl(url.replaceAll(SIM_LINK_VARIABLE, 'value'))?.origin ?? null
 }
 
 export const simLinkNameSchema = z
@@ -46,7 +52,7 @@ const destinationSchema = z
   .max(URL_MAX_LENGTH, `Use at most ${URL_MAX_LENGTH} characters`)
 
 const simLinkUrlSchema = destinationSchema.refine(
-  hasFixedHttpOrigin,
+  (url) => simLinkOrigin(url) !== null,
   `Enter a full http:// or https:// URL. ${SIM_LINK_VARIABLE} can't replace the domain.`
 )
 

apps/sim/scripts/test-sim-links-e2e.ts

@@ -219,7 +219,12 @@ async function run() {
   })
 
   await check('destinations must be http(s) with a fixed origin', async () => {
-    for (const url of ['javascript:alert(1)', 'https://{*}.example.com', 'example.com']) {
+    for (const url of [
+      'javascript:alert(1)',
+      'https://{*}.example.com',
+      'https://{*}@corp.example.com/',
+      'example.com',
+    ]) {
       await api(owner, '', { method: 'POST', body: fields({ name: 'bad', url }), expected: 400 })
     }
     await api(owner, '', {