feat(microsoft-excel): add SharePoint drive support for Excel integration by waleedlatif1 · Pull Request #4162 · simstudioai/sim

waleedlatif1 · 2026-04-14T21:30:33Z

Summary

Add optional driveId parameter to all Microsoft Excel tools for SharePoint file access
Add cascading site/drive selectors in basic mode (site → document library → spreadsheet → sheet)
Add manual drive ID input in advanced mode
Create /api/tools/microsoft_excel/drives route to list SharePoint document libraries
Update file and sheet selectors to pass driveId context through the selector chain
Fully backward-compatible — OneDrive users unaffected when driveId is omitted

Type of Change

New feature

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…tion

vercel · 2026-04-14T21:30:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 15, 2026 3:33am

cursor · 2026-04-14T21:30:42Z

PR Summary

Medium Risk
Adds a new SharePoint drive-selection flow and threads an optional driveId through Excel file/sheet discovery and tool execution, changing Microsoft Graph request paths. Moderate risk due to new API surface (/api/tools/microsoft_excel/drives) and updated request construction/validation in multiple Excel endpoints.

Overview
Enables Microsoft Excel tooling to target SharePoint document libraries by introducing an optional driveId parameter and switching Graph calls from me/drive to drives/{driveId} when provided.

Adds a new /api/tools/microsoft_excel/drives endpoint plus a new microsoft.excel.drives selector and UI wiring (site → drive → spreadsheet → sheet) in the MicrosoftExcelV2Block, while keeping OneDrive behavior unchanged when driveId is omitted.

Hardens the new path-based inputs by validating driveId/spreadsheetId in API routes and centralizing Graph base-path construction via getItemBasePath, then updating read, write, table_add, and worksheet_add tools (and docs) to use it.

^{Reviewed by Cursor Bugbot for commit 8148260. Configure here.}

greptile-apps · 2026-04-14T21:34:47Z

Greptile Summary

This PR adds SharePoint drive support to all four Microsoft Excel tools by introducing an optional driveId parameter and a cascading site → drive → spreadsheet → sheet selector chain in basic mode (with a manual drive ID input for advanced mode). All previously flagged security concerns around path traversal via unvalidated IDs have been addressed with validatePathSegment / validateSharePointSiteId guards.

P1 – stale driveId in advanced mode: manualDriveId has condition: { field: 'fileSource', value: 'sharepoint' } but no dependsOn: ['fileSource']. Switching back to OneDrive hides the field but does not clear its value, so driveId is still forwarded to the tool, routing the request through the SharePoint drive path and causing a Graph API error for any OneDrive spreadsheet.

Confidence Score: 4/5

Safe to merge after fixing the stale driveId in advanced mode — all security concerns from prior review rounds are addressed.

One P1 remains: manualDriveId is missing dependsOn: ['fileSource'], so advanced-mode users who switch from SharePoint back to OneDrive will have a stale drive ID forwarded to the tool, causing Graph API errors. The fix is a single-line addition. All previously raised security/path-traversal issues are resolved.

apps/sim/blocks/blocks/microsoft_excel.ts — the manualDriveId subblock configuration

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/microsoft_excel.ts	Adds SharePoint selectors and file-source dropdown to V2 block; manualDriveId is missing dependsOn: ['fileSource'], so switching from SharePoint to OneDrive in advanced mode leaves a stale driveId that is forwarded to the tool
apps/sim/app/api/tools/microsoft_excel/drives/route.ts	New route listing/fetching SharePoint drives; validates both siteId and driveId before URL interpolation; supports single-drive lookup via POST body
apps/sim/tools/microsoft_excel/utils.ts	Adds getItemBasePath with input validation; TSDoc comment for the function is misplaced above the GRAPH_ID_PATTERN constant instead of the function
apps/sim/app/api/auth/oauth/microsoft/files/route.ts	Adds optional driveId query param with /^[a-zA-Z0-9!_-]+$/ validation; routes file search to the appropriate drive path
apps/sim/app/api/tools/microsoft_excel/sheets/route.ts	Adds driveId query param with validatePathSegment guard; switches worksheet fetch to drives/{driveId} or me/drive as appropriate
apps/sim/hooks/selectors/registry.ts	Adds microsoft.excel.drives selector with proper fetchList/fetchById; threads driveId context through the existing microsoft.excel and microsoft.excel.sheets selectors
apps/sim/tools/microsoft_excel/read.ts	Uses getItemBasePath throughout; removes fragile URL-parsing logic for spreadsheetId extraction; passes driveId to getSpreadsheetWebUrl
apps/sim/tools/microsoft_excel/write.ts	Same getItemBasePath refactor as read.ts; backward-compatible for OneDrive

Sequence Diagram

sequenceDiagram
    participant UI as Block UI
    participant FilesAPI as /api/auth/oauth/microsoft/files
    participant DrivesAPI as /api/tools/microsoft_excel/drives
    participant SheetsAPI as /api/tools/microsoft_excel/sheets
    participant Graph as Microsoft Graph API

    UI->>FilesAPI: GET ?credentialId&driveId (optional)
    FilesAPI->>Graph: GET /drives/{driveId}/root/search OR /me/drive/root/search
    Graph-->>FilesAPI: file list
    FilesAPI-->>UI: { files }

    UI->>DrivesAPI: POST { credential, siteId }
    DrivesAPI->>Graph: GET /sites/{siteId}/drives
    Graph-->>DrivesAPI: drive list
    DrivesAPI-->>UI: { drives }

    UI->>DrivesAPI: POST { credential, siteId, driveId } (fetchById)
    DrivesAPI->>Graph: GET /sites/{siteId}/drives/{driveId}
    Graph-->>DrivesAPI: single drive
    DrivesAPI-->>UI: { drive }

    UI->>SheetsAPI: GET ?credentialId&spreadsheetId&driveId (optional)
    SheetsAPI->>Graph: GET /drives/{driveId}/items/{id}/workbook/worksheets OR /me/drive/items/{id}/workbook/worksheets
    Graph-->>SheetsAPI: worksheet list
    SheetsAPI-->>UI: { sheets }

_{Reviews (9): Last reviewed commit: "fix(microsoft-excel): reorder driveId be..." | Re-trigger Greptile}

apps/sim/app/api/tools/microsoft_excel/drives/route.ts

apps/sim/hooks/selectors/registry.ts

apps/sim/blocks/blocks/microsoft_excel.ts

- Validate siteId/driveId format in drives route to prevent path traversal - Use direct single-drive endpoint for fetchById instead of filtering full list - Fix dependsOn on sheet/spreadsheet selectors so driveId flows into context - Fix NextRequest type in drives route for build compatibility

waleedlatif1 · 2026-04-14T21:45:33Z

@greptile

waleedlatif1 · 2026-04-14T21:45:36Z

@cusror review

apps/sim/app/api/auth/oauth/microsoft/files/route.ts

Add regex validation for driveId query param in the Microsoft OAuth files route to prevent path traversal, matching the drives route.

waleedlatif1 · 2026-04-14T21:55:11Z

@greptile

waleedlatif1 · 2026-04-14T21:55:14Z

@cursor review

apps/sim/blocks/blocks/microsoft_excel.ts

apps/sim/app/api/tools/microsoft_excel/sheets/route.ts

apps/sim/blocks/blocks/microsoft_excel.ts

…sheets route - Add credential to any[] arrays so OneDrive users (no drive selected) still pass the dependsOn gate while driveSelector remains in the dependency list for context flow to SharePoint users - Add /^[\w-]+$/ validation for driveId in sheets API route

waleedlatif1 · 2026-04-14T22:07:36Z

@greptile

waleedlatif1 · 2026-04-14T22:07:40Z

@cursor review

apps/sim/tools/microsoft_excel/utils.ts

apps/sim/blocks/blocks/microsoft_excel.ts

Add regex validation for driveId at the shared utility level to prevent path traversal through the tool execution path, which bypasses the API route validators.

waleedlatif1 · 2026-04-14T22:16:08Z

@greptile

waleedlatif1 · 2026-04-14T22:16:11Z

@cursor review

Replace inline regex validation with platform validators from @/lib/core/security/input-validation: - validateSharePointSiteId for siteId in drives route - validateAlphanumericId for driveId in drives, sheets, files routes and getItemBasePath utility

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f18af3c. Configure here.}

…rePoint visibility Replace always-visible optional SharePoint fields with a File Source dropdown (OneDrive/SharePoint) that conditionally shows site and drive selectors. OneDrive users see zero extra fields (default). SharePoint users switch the dropdown and get the full cascade.

Make fileSource dropdown mode:'both' so it appears in basic and advanced modes. Add condition to manualDriveId to match driveSelector's condition, satisfying the canonical pair consistency test.

waleedlatif1 · 2026-04-15T00:50:13Z

@greptile

waleedlatif1 · 2026-04-15T00:50:17Z

@cursor review

apps/sim/blocks/blocks/microsoft_excel.ts

apps/sim/tools/microsoft_excel/utils.ts

… support - Clear stale driveId/siteId/spreadsheetId when fileSource changes by adding fileSource to dependsOn arrays for siteSelector, driveSelector, and spreadsheetId selectors - Reorder manualDriveId before manualSpreadsheetId in advanced mode for logical top-down flow - Validate spreadsheetId with validateMicrosoftGraphId in getItemBasePath() and sheets route to close injection vector (uses permissive validator that accepts ! chars in OneDrive item IDs) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-15T02:08:38Z

@greptile

waleedlatif1 · 2026-04-15T02:08:41Z

@cursor review

apps/sim/tools/microsoft_excel/utils.ts

…tion SharePoint drive IDs use the format b!<base64-string> which contains ! characters rejected by validateAlphanumericId. Switch all driveId validation to validateMicrosoftGraphId which blocks path traversal and control characters while accepting valid Microsoft Graph identifiers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-15T02:33:11Z

@greptile

waleedlatif1 · 2026-04-15T02:33:15Z

@cursor review

apps/sim/tools/microsoft_excel/utils.ts

… driveId/spreadsheetId Replace validateMicrosoftGraphId with validatePathSegment using a custom pattern ^[a-zA-Z0-9!_-]+$ for all URL-interpolated IDs. validatePathSegment blocks /, \, path traversal, and null bytes before checking the pattern, preventing URL-modifying characters like ?, #, & from altering the Graph API endpoint. The pattern allows ! for SharePoint b!<base64> drive IDs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-15T03:24:07Z

@greptile

waleedlatif1 · 2026-04-15T03:24:12Z

@cursor review

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8148260. Configure here.}

apps/sim/blocks/blocks/microsoft_excel.ts

Move driveId subBlock before manualSpreadsheetId in the legacy v1 block to match the logical top-down flow (Drive ID → Spreadsheet ID), consistent with the v2 block ordering. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

greptile-apps · 2026-04-15T03:37:18Z

apps/sim/blocks/blocks/microsoft_excel.ts

+    // Drive ID for SharePoint (advanced mode, only when SharePoint is selected)
+    {
+      id: 'manualDriveId',
+      title: 'Drive ID',
+      type: 'short-input',
+      canonicalParamId: 'driveId',
+      placeholder: 'Enter the SharePoint drive ID',
+      condition: { field: 'fileSource', value: 'sharepoint' },
+      mode: 'advanced',
+    },


Stale driveId not cleared when switching back to OneDrive

condition only controls visibility — it never clears the stored value. dependsOn is what tells the subblock system to clear a value when a dependency changes. Without dependsOn: ['fileSource'] here, a user who:

Sets fileSource = 'sharepoint' in advanced mode and enters a manualDriveId

Then switches fileSource back to 'onedrive'

…will have the hidden-but-still-serialized driveId canonical value forwarded to the tool, causing getItemBasePath to route through the SharePoint drive path instead of me/drive, producing a Graph API 404 or permission error for any OneDrive spreadsheet.

Suggested change

// Drive ID for SharePoint (advanced mode, only when SharePoint is selected)

{

id: 'manualDriveId',

title: 'Drive ID',

type: 'short-input',

canonicalParamId: 'driveId',

placeholder: 'Enter the SharePoint drive ID',

condition: { field: 'fileSource', value: 'sharepoint' },

mode: 'advanced',

},

{

id: 'manualDriveId',

title: 'Drive ID',

type: 'short-input',

canonicalParamId: 'driveId',

placeholder: 'Enter the SharePoint drive ID',

condition: { field: 'fileSource', value: 'sharepoint' },

dependsOn: ['fileSource'],

mode: 'advanced',

},

feat(microsoft-excel): add SharePoint drive support for Excel integra…

9669ca4

…tion

vercel bot deployed to Preview April 14, 2026 21:33 View deployment

greptile-apps bot reviewed Apr 14, 2026

View reviewed changes

apps/sim/app/api/tools/microsoft_excel/drives/route.ts Show resolved Hide resolved

apps/sim/hooks/selectors/registry.ts Show resolved Hide resolved

cursor bot reviewed Apr 14, 2026

View reviewed changes

apps/sim/blocks/blocks/microsoft_excel.ts Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 14, 2026 21:42 Inactive

greptile-apps bot reviewed Apr 14, 2026

View reviewed changes

apps/sim/app/api/auth/oauth/microsoft/files/route.ts Show resolved Hide resolved

fix(microsoft-excel): validate driveId in files route

a3c93ee

Add regex validation for driveId query param in the Microsoft OAuth files route to prevent path traversal, matching the drives route.

vercel bot temporarily deployed to Preview April 14, 2026 21:53 Inactive

cursor bot reviewed Apr 14, 2026

View reviewed changes

apps/sim/blocks/blocks/microsoft_excel.ts Outdated Show resolved Hide resolved

apps/sim/app/api/tools/microsoft_excel/sheets/route.ts Show resolved Hide resolved

greptile-apps bot reviewed Apr 14, 2026

View reviewed changes

apps/sim/blocks/blocks/microsoft_excel.ts Outdated Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 14, 2026 22:02 Inactive

cursor bot reviewed Apr 14, 2026

View reviewed changes

apps/sim/tools/microsoft_excel/utils.ts Show resolved Hide resolved

apps/sim/blocks/blocks/microsoft_excel.ts Show resolved Hide resolved

fix(microsoft-excel): validate driveId in getItemBasePath utility

f18af3c

Add regex validation for driveId at the shared utility level to prevent path traversal through the tool execution path, which bypasses the API route validators.

vercel bot temporarily deployed to Preview April 14, 2026 22:15 Inactive

vercel bot temporarily deployed to Preview April 14, 2026 22:21 Inactive

lint

2884587

vercel bot temporarily deployed to Preview April 14, 2026 22:24 Inactive

cursor bot reviewed Apr 14, 2026

View reviewed changes

vercel bot temporarily deployed to Preview April 14, 2026 22:42 Inactive

fix(microsoft-excel): fix canonical param test failures

8b1c88c

Make fileSource dropdown mode:'both' so it appears in basic and advanced modes. Add condition to manualDriveId to match driveSelector's condition, satisfying the canonical pair consistency test.

vercel bot temporarily deployed to Preview April 15, 2026 00:43 Inactive

cursor bot reviewed Apr 15, 2026

View reviewed changes

apps/sim/blocks/blocks/microsoft_excel.ts Outdated Show resolved Hide resolved

apps/sim/blocks/blocks/microsoft_excel.ts Show resolved Hide resolved

greptile-apps bot reviewed Apr 15, 2026

View reviewed changes

apps/sim/tools/microsoft_excel/utils.ts Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 15, 2026 01:07 Inactive

cursor bot reviewed Apr 15, 2026

View reviewed changes

apps/sim/tools/microsoft_excel/utils.ts Outdated Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 15, 2026 02:25 Inactive

cursor bot reviewed Apr 15, 2026

View reviewed changes

apps/sim/tools/microsoft_excel/utils.ts Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 15, 2026 02:53 Inactive

lint

8148260

vercel bot temporarily deployed to Preview April 15, 2026 03:21 Inactive

cursor bot reviewed Apr 15, 2026

View reviewed changes

apps/sim/blocks/blocks/microsoft_excel.ts Outdated Show resolved Hide resolved

apps/sim/blocks/blocks/microsoft_excel.ts Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 15, 2026 03:33 Inactive

greptile-apps bot reviewed Apr 15, 2026

View reviewed changes

Conversation

waleedlatif1 commented Apr 14, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

waleedlatif1 commented Apr 14, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

waleedlatif1 commented Apr 15, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

vercel bot commented Apr 14, 2026 •

edited

Loading

cursor bot commented Apr 14, 2026 •

edited

Loading

greptile-apps bot commented Apr 14, 2026 •

edited

Loading