fix(box_sign,twilio): guard the ids the sweep's scoping missed

box_sign is a separate tools directory exposed by the Box block, so a sweep
scoped by block name skipped it; signRequestId had no guard and no encoder,
and a '.' turned get-request into list-every-sign-request.

twilio get-recording built its provider URL inside an internal route, so
probing request.url could not see it. The existing accountSid.startsWith('AC')
check passes 'AC.../../..'; both ids now must match a real 34-char SID. Also
caps the media download at 7MB, below the 10MB response ceiling base64
inflation would otherwise blow past.

Author: waleedlatif1

apps/sim/app/api/tools/twilio/get-recording/route.test.ts

@@ -0,0 +1,208 @@
+/**
+ * @vitest-environment node
+ *
+ * Guards the provider URL this route builds from caller-supplied values.
+ *
+ * `accountSid` and `recordingSid` are NOT credential-derived — the tool body is
+ * `{accountSid, authToken, recordingSid}` (`tools/twilio_voice/get_recording.ts`)
+ * and `recordingSid` is `visibility: 'user-or-llm'`, so prompt injection controls
+ * it. The contract only enforces `.min(1)`, and `validateUrlWithDNS` pins the
+ * *host*, not the path. Before the guard, `recordingSid = '../Messages'` resolved
+ * `/2010-04-01/Accounts/{acct}/Recordings/../Messages.json` down to
+ * `/2010-04-01/Accounts/{acct}/Messages.json`; the route then follows `data.uri`,
+ * refetches it with the caller's Basic auth, and returns the body base64-encoded
+ * as a `file` output — an arbitrary authenticated GET across the caller's Twilio
+ * account, exfiltrated as an attachment.
+ *
+ * Every URL assertion resolves through `new URL(...)` — the same normalization
+ * `fetch` performs — and compares the full decoded `pathname` segment list.
+ */
+import {
+  createMockRequest,
+  hybridAuthMockFns,
+  inputValidationMock,
+  inputValidationMockFns,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+
+import { MAX_TWILIO_RECORDING_BYTES, POST } from '@/app/api/tools/twilio/get-recording/route'
+
+const { mockValidateUrlWithDNS, mockSecureFetchWithPinnedIP } = inputValidationMockFns
+
+const PINNED_IP = '3.89.10.20'
+
+/** A real Twilio SID: a two-letter prefix followed by 32 hexadecimal digits. */
+const ACCOUNT_SID = `AC${'a'.repeat(32)}`
+const RECORDING_SID = 'RE0123456789abcdef0123456789abcdef'
+
+const baseBody = {
+  accountSid: ACCOUNT_SID,
+  authToken: 'auth-token',
+  recordingSid: RECORDING_SID,
+}
+
+function jsonResponse(body: unknown, ok = true) {
+  return {
+    ok,
+    status: ok ? 200 : 400,
+    statusText: '',
+    headers: new Headers(),
+    body: null,
+    text: async () => JSON.stringify(body),
+    json: async () => body,
+    arrayBuffer: async () => new ArrayBuffer(0),
+  }
+}
+
+function mediaResponse(bytes: number) {
+  return {
+    ok: true,
+    status: 200,
+    statusText: '',
+    headers: new Headers({ 'content-type': 'audio/wav' }),
+    body: null,
+    text: async () => '',
+    json: async () => ({}),
+    arrayBuffer: async () => new ArrayBuffer(bytes),
+  }
+}
+
+const recordingPayload = {
+  sid: RECORDING_SID,
+  call_sid: 'CA0123456789abcdef0123456789abcdef',
+  duration: '12',
+  status: 'completed',
+  uri: `/2010-04-01/Accounts/${ACCOUNT_SID}/Recordings/${RECORDING_SID}.json`,
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValue({
+    success: true,
+    userId: 'user-1',
+    authType: 'internal_jwt',
+  })
+  mockValidateUrlWithDNS.mockResolvedValue({
+    isValid: true,
+    resolvedIP: PINNED_IP,
+    originalHostname: 'api.twilio.com',
+  })
+})
+
+/** Vectors that must never reach `secureFetchWithPinnedIP` at all. */
+const REJECTED_SIDS = [
+  '..',
+  '.',
+  '  ..  ',
+  '%2e%2e',
+  'a/b',
+  '../Messages',
+  '..\\..',
+  'RE0123456789abcdef0123456789abcdef/../../Messages',
+  'RE0123456789abcdef0123456789abcdef?PageSize=1000',
+  'RE0123456789abcdef0123456789abcdef.json',
+  'RE0123456789abcdef0123456789abcdefEXTRA',
+  'REzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz',
+] as const
+
+describe('POST /api/tools/twilio/get-recording — recordingSid guard', () => {
+  it.each(REJECTED_SIDS)(
+    'rejects recordingSid %j with a 400 and issues no request',
+    async (sid) => {
+      const response = await POST(createMockRequest('POST', { ...baseBody, recordingSid: sid }))
+
+      expect(response.status).toBe(400)
+      const data = (await response.json()) as { success: boolean; error: string }
+      expect(data.success).toBe(false)
+      expect(data.error).toMatch(/Recording SID/i)
+      expect(mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['..', 'a/b', `AC${'0123456789abcdef'.repeat(2)}/../..`, 'ACnothex'] as const)(
+    'rejects accountSid %j with a 400 and issues no request',
+    async (sid) => {
+      const response = await POST(createMockRequest('POST', { ...baseBody, accountSid: sid }))
+
+      expect(response.status).toBe(400)
+      const data = (await response.json()) as { success: boolean; error: string }
+      expect(data.success).toBe(false)
+      expect(data.error).toMatch(/Account SID/i)
+      expect(mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('POST /api/tools/twilio/get-recording — legitimate values', () => {
+  it('builds byte-identical Twilio URLs for real SIDs', async () => {
+    mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(jsonResponse(recordingPayload))
+      .mockResolvedValueOnce(jsonResponse({ transcriptions: [] }))
+      .mockResolvedValueOnce(mediaResponse(2048))
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(200)
+
+    const infoUrl = mockSecureFetchWithPinnedIP.mock.calls[0][0] as string
+    expect(infoUrl).toBe(
+      `https://api.twilio.com/2010-04-01/Accounts/${ACCOUNT_SID}/Recordings/${RECORDING_SID}.json`
+    )
+    const resolvedInfo = new URL(infoUrl)
+    expect(resolvedInfo.origin).toBe('https://api.twilio.com')
+    expect(resolvedInfo.search).toBe('')
+    expect(resolvedInfo.pathname.split('/').map(decodeURIComponent)).toEqual([
+      '',
+      '2010-04-01',
+      'Accounts',
+      ACCOUNT_SID,
+      'Recordings',
+      `${RECORDING_SID}.json`,
+    ])
+
+    const transcriptionUrl = new URL(mockSecureFetchWithPinnedIP.mock.calls[1][0] as string)
+    expect(transcriptionUrl.pathname.split('/').map(decodeURIComponent)).toEqual([
+      '',
+      '2010-04-01',
+      'Accounts',
+      ACCOUNT_SID,
+      'Transcriptions.json',
+    ])
+    expect(transcriptionUrl.searchParams.get('RecordingSid')).toBe(RECORDING_SID)
+
+    const data = (await response.json()) as { success: boolean; output: { file: { size: number } } }
+    expect(data.success).toBe(true)
+    expect(data.output.file.size).toBe(2048)
+  })
+
+  it('keeps a Twilio-supplied sid inside the query zone via URLSearchParams', async () => {
+    mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(jsonResponse({ ...recordingPayload, sid: 'RE&PageSize=1000' }))
+      .mockResolvedValueOnce(jsonResponse({ transcriptions: [] }))
+      .mockResolvedValueOnce(mediaResponse(16))
+
+    await POST(createMockRequest('POST', baseBody))
+
+    const transcriptionUrl = new URL(mockSecureFetchWithPinnedIP.mock.calls[1][0] as string)
+    expect(transcriptionUrl.searchParams.get('RecordingSid')).toBe('RE&PageSize=1000')
+    expect(transcriptionUrl.searchParams.get('PageSize')).toBeNull()
+    expect([...transcriptionUrl.searchParams.keys()]).toEqual(['RecordingSid'])
+  })
+})
+
+describe('POST /api/tools/twilio/get-recording — media size cap', () => {
+  it('caps the media download at the size the JSON transport can actually carry', async () => {
+    mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(jsonResponse(recordingPayload))
+      .mockResolvedValueOnce(jsonResponse({ transcriptions: [] }))
+      .mockResolvedValueOnce(mediaResponse(64))
+
+    await POST(createMockRequest('POST', baseBody))
+
+    expect(MAX_TWILIO_RECORDING_BYTES).toBeLessThanOrEqual(7.5 * 1024 * 1024)
+    expect(mockSecureFetchWithPinnedIP.mock.calls[2][2]).toMatchObject({
+      maxResponseBytes: MAX_TWILIO_RECORDING_BYTES,
+    })
+  })
+})

apps/sim/app/api/tools/twilio/get-recording/route.ts

@@ -16,6 +16,40 @@ export const dynamic = 'force-dynamic'
 
 const logger = createLogger('TwilioGetRecordingAPI')
 
+/**
+ * Shape of a Twilio resource identifier.
+ *
+ * Twilio documents every resource id as a 34-character String Identifier: a
+ * two-letter prefix followed by 32 hexadecimal digits. No `/`, `\`, dot
+ * segment, `?`, or `#` is legal in one, so pinning the shape has zero
+ * false-rejection risk while closing the path zone entirely.
+ *
+ * This matters because both `accountSid` and `recordingSid` arrive in the
+ * request body rather than from a credential, and `recordingSid` is
+ * `visibility: 'user-or-llm'` on the calling tool. `validateUrlWithDNS` pins
+ * the *host*, not the path, so an unguarded `recordingSid` of `../Messages`
+ * re-aimed this route at an arbitrary resource in the caller's account — which
+ * it then refetched with the caller's Basic auth and returned base64-encoded as
+ * a `file` output.
+ */
+const ACCOUNT_SID_PATTERN = /^AC[0-9a-fA-F]{32}$/
+const RECORDING_SID_PATTERN = /^RE[0-9a-fA-F]{32}$/
+
+/**
+ * Ceiling on the downloaded recording media.
+ *
+ * This route returns the media base64-encoded inside its JSON body, and the
+ * executor reads an internal tool response through `readToolResponseBody`,
+ * which caps at `MAX_TOOL_RESPONSE_BODY_BYTES` (10 MB). Base64 inflates by 4/3,
+ * so the largest recording that can survive the round trip is ~7.5 MB of raw
+ * audio. Inheriting `DEFAULT_MAX_RESPONSE_BYTES` (100 MB) meant anything larger
+ * downloaded and encoded in full — peaking at hundreds of MB of live
+ * allocation — only for the executor to reject the body afterwards with "Tool
+ * response size limit exceeded". Capping at the reachable size makes the
+ * transport limit enforce itself while the bytes are still streaming.
+ */
+export const MAX_TWILIO_RECORDING_BYTES = 7 * 1024 * 1024
+
 interface TwilioRecordingResponse {
   sid?: string
   call_sid?: string
@@ -67,11 +101,21 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     if (!parsed.success) return parsed.response
     const { accountSid, authToken, recordingSid } = parsed.data.body
 
-    if (!accountSid.startsWith('AC')) {
+    if (!ACCOUNT_SID_PATTERN.test(accountSid)) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Invalid Account SID format. Account SID must be "AC" followed by 32 hexadecimal digits (you provided: ${accountSid.substring(0, 2)}...)`,
+        },
+        { status: 400 }
+      )
+    }
+
+    if (!RECORDING_SID_PATTERN.test(recordingSid)) {
       return NextResponse.json(
         {
           success: false,
-          error: `Invalid Account SID format. Account SID must start with "AC" (you provided: ${accountSid.substring(0, 2)}...)`,
+          error: `Invalid Recording SID format. Recording SID must be "RE" followed by 32 hexadecimal digits (you provided: ${recordingSid.substring(0, 2)}...)`,
         },
         { status: 400 }
       )
@@ -134,7 +178,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       | undefined
 
     try {
-      const transcriptionUrl = `https://api.twilio.com/2010-04-01/Accounts/${accountSid}/Transcriptions.json?RecordingSid=${data.sid}`
+      const transcriptionQuery = new URLSearchParams({ RecordingSid: data.sid ?? recordingSid })
+      const transcriptionUrl = `https://api.twilio.com/2010-04-01/Accounts/${accountSid}/Transcriptions.json?${transcriptionQuery}`
       logger.info(`[${requestId}] Checking for transcriptions`)
 
       const transcriptionUrlValidation = await validateUrlWithDNS(
@@ -182,6 +227,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
             {
               method: 'GET',
               headers: { Authorization: `Basic ${twilioAuth}` },
+              maxResponseBytes: MAX_TWILIO_RECORDING_BYTES,
             }
           )
 

apps/sim/tools/box_sign/cancel_request.ts

@@ -1,4 +1,5 @@
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 import type { BoxSignCancelRequestParams, BoxSignResponse } from './types'
 import { SIGN_REQUEST_OUTPUT_PROPERTIES } from './types'
 
@@ -29,7 +30,8 @@ export const boxSignCancelRequestTool: ToolConfig<BoxSignCancelRequestParams, Bo
   },
 
   request: {
-    url: (params) => `https://api.box.com/2.0/sign_requests/${params.signRequestId}/cancel`,
+    url: (params) =>
+      `https://api.box.com/2.0/sign_requests/${safeUrlPathSegment(params.signRequestId, 'signRequestId')}/cancel`,
     method: 'POST',
     headers: (params) => ({
       Authorization: `Bearer ${params.accessToken}`,

apps/sim/tools/box_sign/get_request.ts

@@ -1,4 +1,5 @@
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 import type { BoxSignGetRequestParams, BoxSignResponse } from './types'
 import { SIGN_REQUEST_OUTPUT_PROPERTIES } from './types'
 
@@ -29,7 +30,8 @@ export const boxSignGetRequestTool: ToolConfig<BoxSignGetRequestParams, BoxSignR
   },
 
   request: {
-    url: (params) => `https://api.box.com/2.0/sign_requests/${params.signRequestId}`,
+    url: (params) =>
+      `https://api.box.com/2.0/sign_requests/${safeUrlPathSegment(params.signRequestId, 'signRequestId')}`,
     method: 'GET',
     headers: (params) => ({
       Authorization: `Bearer ${params.accessToken}`,