fix(security): reject URL injection in Qualtrics datacenter and Piped… - #3912
Open
AnkitSegment wants to merge 1 commit into
Open
fix(security): reject URL injection in Qualtrics datacenter and Piped…#3912AnkitSegment wants to merge 1 commit into
AnkitSegment wants to merge 1 commit into
Conversation
…rive domain settings Validates that user-supplied datacenter (Qualtrics) and domain (Pipedrive) fields contain only alphanumeric characters and hyphens before interpolating them into API base URLs. Without this check, an attacker-controlled value could redirect requests — including bearer tokens and API keys — to an arbitrary host. Fixes SECOPS-25215 (Qualtrics) and SECOPS-25240 (Pipedrive). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Adds input validation to prevent URL injection via user-controlled subdomain components used to construct Qualtrics and Pipedrive API base URLs (SECOPS-25215 / SECOPS-25240).
Changes:
- Validate
datacenter(Qualtrics) to allow only alphanumeric characters and hyphens before building the base URL. - Validate
domain(Pipedrive) to allow only alphanumeric characters and hyphens before making API requests. - Add unit tests covering common URL-injection payload patterns (
/,?,@).
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/destination-actions/src/destinations/qualtrics/qualtricsApiClient.ts | Rejects unsafe datacenter strings before interpolating into Qualtrics base URL. |
| packages/destination-actions/src/destinations/qualtrics/tests/index.test.ts | Adds tests ensuring injected datacenter values are rejected. |
| packages/destination-actions/src/destinations/pipedrive/utils.ts | Introduces validateDomain to reject unsafe domain strings before URL construction. |
| packages/destination-actions/src/destinations/pipedrive/pipedriveApi/pipedrive-client.ts | Calls validateDomain when constructing the Pipedrive client. |
| packages/destination-actions/src/destinations/pipedrive/index.ts | Calls validateDomain during testAuthentication before issuing the request. |
| packages/destination-actions/src/destinations/pipedrive/createUpdatePerson/tests/index.test.ts | Adds tests ensuring injected domain values are rejected. |
| await expect(testDestination.testAuthentication(authData)).rejects.toThrowError(/401/) | ||
| }) | ||
|
|
||
| it('throw error when datacenter contains URL injection characters', async () => { |
| await expect(testDestination.testAuthentication(authData)).rejects.toThrowError(/Invalid datacenter ID/) | ||
| }) | ||
|
|
||
| it('throw error when datacenter contains @ injection', async () => { |
| const PERSON_ID = 33333 | ||
|
|
||
| describe('Pipedrive domain validation', () => { | ||
| it('should throw when domain contains URL injection characters', async () => { |
| ).rejects.toThrowError(/Invalid domain/) | ||
| }) | ||
|
|
||
| it('should throw when domain contains @ injection', async () => { |
Comment on lines
+5
to
+11
| export function validateDomain(domain: string): void { | ||
| if (!/^[a-zA-Z0-9-]+$/.test(domain)) { | ||
| throw new InvalidAuthenticationError( | ||
| 'Invalid domain. Domain must contain only alphanumeric characters and hyphens.' | ||
| ) | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A summary of your pull request, including the what change you're making and why.
Validates that user-supplied datacenter (Qualtrics) and domain (Pipedrive) fields contain only alphanumeric characters and hyphens before interpolating them into API base URLs. Without this check, an attacker-controlled value could redirect requests — including bearer tokens and API keys — to an arbitrary host. Fixes SECOPS-25215 (Qualtrics) and SECOPS-25240 (Pipedrive).
Testing
Include any additional information about the testing you have completed to
ensure your changes behave as expected. For a speedy review, please check
any of the tasks you completed below during your testing.
Security Review
Please ensure sensitive data is properly protected in your integration.
type: 'password'New Destination Checklist
verioning-info.tsfile. example