improvement(brex): validate pre-signed upload URL with DNS pinning and harden API key input

Author: waleedlatif1

apps/sim/app/api/tools/brex/upload-receipt/route.test.ts

@@ -1,7 +1,12 @@
 /**
  * @vitest-environment node
  */
-import { createMockRequest, hybridAuthMockFns } from '@sim/testing'
+import {
+  createMockRequest,
+  hybridAuthMockFns,
+  inputValidationMock,
+  inputValidationMockFns,
+} from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockProcessFilesToUserFiles, mockDownloadFileFromStorage, mockAssertToolFileAccess } =
@@ -11,6 +16,7 @@ const { mockProcessFilesToUserFiles, mockDownloadFileFromStorage, mockAssertTool
     mockAssertToolFileAccess: vi.fn(),
   }))
 
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
 vi.mock('@/lib/uploads/utils/file-utils', () => ({
   processFilesToUserFiles: mockProcessFilesToUserFiles,
 }))
@@ -25,6 +31,8 @@ import { POST } from '@/app/api/tools/brex/upload-receipt/route'
 
 const mockFetch = vi.fn()
 
+const PINNED_IP = '52.216.0.1'
+
 const baseBody = {
   apiKey: 'bxt_test_token',
   expenseId: 'expense_123',
@@ -48,6 +56,11 @@ beforeEach(() => {
     userId: 'user-1',
     authType: 'internal_jwt',
   })
+  inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
+    isValid: true,
+    resolvedIP: PINNED_IP,
+  })
+  inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(jsonResponse({}))
   mockProcessFilesToUserFiles.mockReturnValue([
     { key: 'uploads/receipt.pdf', name: 'receipt.pdf', size: 5, type: 'application/pdf' },
   ])
@@ -68,11 +81,9 @@ describe('POST /api/tools/brex/upload-receipt', () => {
   })
 
   it('creates a receipt upload for an expense and PUTs the file to the pre-signed URL', async () => {
-    mockFetch
-      .mockResolvedValueOnce(
-        jsonResponse({ id: 'receipt_1', uri: 'https://s3.example.com/presigned' })
-      )
-      .mockResolvedValueOnce(jsonResponse({}))
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_1', uri: 'https://s3.example.com/presigned' })
+    )
 
     const response = await POST(createMockRequest('POST', baseBody))
     expect(response.status).toBe(200)
@@ -82,15 +93,21 @@ describe('POST /api/tools/brex/upload-receipt', () => {
       output: { receiptId: 'receipt_1', receiptName: 'receipt.pdf', expenseId: 'expense_123' },
     })
 
-    expect(mockFetch).toHaveBeenCalledTimes(2)
+    expect(mockFetch).toHaveBeenCalledTimes(1)
     const [createUrl, createInit] = mockFetch.mock.calls[0]
     expect(createUrl).toBe('https://api.brex.com/v1/expenses/card/expense_123/receipt_upload')
     expect(createInit.method).toBe('POST')
     expect(createInit.headers.Authorization).toBe('Bearer bxt_test_token')
     expect(JSON.parse(createInit.body)).toEqual({ receipt_name: 'receipt.pdf' })
 
-    const [uploadUrl, uploadInit] = mockFetch.mock.calls[1]
+    expect(inputValidationMockFns.mockValidateUrlWithDNS).toHaveBeenCalledWith(
+      'https://s3.example.com/presigned',
+      'uri'
+    )
+    const [uploadUrl, pinnedIP, uploadInit] =
+      inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[0]
     expect(uploadUrl).toBe('https://s3.example.com/presigned')
+    expect(pinnedIP).toBe(PINNED_IP)
     expect(uploadInit.method).toBe('PUT')
   })
 
@@ -101,11 +118,9 @@ describe('POST /api/tools/brex/upload-receipt', () => {
   })
 
   it('trims a padded expense ID before building the upload URL', async () => {
-    mockFetch
-      .mockResolvedValueOnce(
-        jsonResponse({ id: 'receipt_5', uri: 'https://s3.example.com/presigned' })
-      )
-      .mockResolvedValueOnce(jsonResponse({}))
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_5', uri: 'https://s3.example.com/presigned' })
+    )
 
     const response = await POST(
       createMockRequest('POST', { ...baseBody, expenseId: '  expense_123  ' })
@@ -123,12 +138,18 @@ describe('POST /api/tools/brex/upload-receipt', () => {
     expect(mockFetch).not.toHaveBeenCalled()
   })
 
+  it('rejects an API key containing header-breaking characters', async () => {
+    const response = await POST(
+      createMockRequest('POST', { ...baseBody, apiKey: 'bxt_test\r\nX-Injected: 1' })
+    )
+    expect(response.status).toBe(400)
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
   it('uses receipt match when no expense ID is provided', async () => {
-    mockFetch
-      .mockResolvedValueOnce(
-        jsonResponse({ id: 'receipt_2', uri: 'https://s3.example.com/presigned' })
-      )
-      .mockResolvedValueOnce(jsonResponse({}))
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_2', uri: 'https://s3.example.com/presigned' })
+    )
 
     const response = await POST(
       createMockRequest('POST', { apiKey: 'bxt_test_token', file: baseBody.file })
@@ -146,11 +167,9 @@ describe('POST /api/tools/brex/upload-receipt', () => {
   })
 
   it('honors a receipt name override', async () => {
-    mockFetch
-      .mockResolvedValueOnce(
-        jsonResponse({ id: 'receipt_3', uri: 'https://s3.example.com/presigned' })
-      )
-      .mockResolvedValueOnce(jsonResponse({}))
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_3', uri: 'https://s3.example.com/presigned' })
+    )
 
     const response = await POST(
       createMockRequest('POST', { ...baseBody, receiptName: 'march-dinner.pdf' })
@@ -169,6 +188,7 @@ describe('POST /api/tools/brex/upload-receipt', () => {
     expect(data.success).toBe(false)
     expect(data.error).toContain('Expense not found')
     expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
   })
 
   it('rejects files over the 50 MB limit', async () => {
@@ -181,12 +201,27 @@ describe('POST /api/tools/brex/upload-receipt', () => {
     expect(mockFetch).not.toHaveBeenCalled()
   })
 
+  it('blocks pre-signed URLs that fail SSRF validation', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_6', uri: 'https://169.254.169.254/latest/meta-data' })
+    )
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValueOnce({
+      isValid: false,
+      error: 'uri resolves to a blocked IP address',
+    })
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(502)
+    const data = await response.json()
+    expect(data.error).toContain('invalid upload URL')
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
   it('fails when the pre-signed upload fails', async () => {
-    mockFetch
-      .mockResolvedValueOnce(
-        jsonResponse({ id: 'receipt_4', uri: 'https://s3.example.com/presigned' })
-      )
-      .mockResolvedValueOnce(jsonResponse({}, 403))
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_4', uri: 'https://s3.example.com/presigned' })
+    )
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValueOnce(jsonResponse({}, 403))
 
     const response = await POST(createMockRequest('POST', baseBody))
     expect(response.status).toBe(502)

apps/sim/app/api/tools/brex/upload-receipt/route.ts

@@ -4,6 +4,10 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { brexUploadReceiptContract } from '@/lib/api/contracts/tools/brex'
 import { parseRequest } from '@/lib/api/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
+import {
+  secureFetchWithPinnedIP,
+  validateUrlWithDNS,
+} from '@/lib/core/security/input-validation.server'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { processFilesToUserFiles, type RawFileInput } from '@/lib/uploads/utils/file-utils'
@@ -93,10 +97,25 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       )
     }
 
-    const uploadResponse = await fetch(createData.uri, {
-      method: 'PUT',
-      body: new Uint8Array(fileBuffer),
-    })
+    const uriValidation = await validateUrlWithDNS(createData.uri, 'uri')
+    if (!uriValidation.isValid) {
+      logger.error(`[${requestId}] Pre-signed upload URL failed SSRF validation:`, {
+        error: uriValidation.error,
+      })
+      return NextResponse.json(
+        { success: false, error: 'Brex returned an invalid upload URL' },
+        { status: 502 }
+      )
+    }
+
+    const uploadResponse = await secureFetchWithPinnedIP(
+      createData.uri,
+      uriValidation.resolvedIP!,
+      {
+        method: 'PUT',
+        body: new Uint8Array(fileBuffer),
+      }
+    )
 
     if (!uploadResponse.ok) {
       logger.error(`[${requestId}] Receipt upload to pre-signed URL failed:`, {

apps/sim/lib/api/contracts/tools/brex.ts

@@ -4,7 +4,11 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 import { RawFileInputSchema } from '@/lib/uploads/utils/file-schemas'
 
 export const brexUploadReceiptBodySchema = z.object({
-  apiKey: z.string().min(1, 'API key is required').max(512, 'API key is too long'),
+  apiKey: z
+    .string()
+    .min(1, 'API key is required')
+    .max(512, 'API key is too long')
+    .regex(/^[\x21-\x7e]+$/, 'API key contains invalid characters'),
   expenseId: z
     .string()
     .trim()