fix(elasticsearch): require a scheme on the host, restore numeric index coercion

buildBaseUrl accepted a scheme-less host and returned it relative, so the
executor resolved it against Sim's own origin while buildAuthHeaders still
attached the credential:

  'es.internal'    -> https://sim.ai/es.internal/...   credential to Sim
  '//evil.com'     -> https://evil.com/...             credential to an
                                                       attacker-chosen origin

The protocol-relative form is the serious one -- it inherits Sim's scheme and
exfiltrates the ES ApiKey to any host. The SSRF check passes in both cases
because the resolved host is not the user's cluster. A scheme is now required,
and the original string is returned rather than the parser's normalized href so
hosts reach ES exactly as typed. No auto-prefixing: silently upgrading a
plaintext cluster to https would turn a typo into a different host.

safeIndexPathSegment, added for the date-math carve-out, had copied the
'typeof value === string ? trim : ""' form that toGuardedString had just been
changed away from -- so a numeric index threw 'index is required' while a
numeric documentId in the same URL worked. It now mirrors the shared helper,
and a test pins the two producing identical output.

The parseCloudId comment attributed its rules to the wrong clients. The
first-colon split is Python and .NET; Beats uses last-colon. Per-service ports
are Beats and .NET. Omitting :443 is .NET only. The forbidden-character set is
Beats only, and only on recent branches. Rewritten to attribute each rule and
to state where Sim deliberately diverges.

The block required an index for bulk while the tool declares it optional -- and
_bulk legitimately runs against /_bulk with per-action _index.

Author: waleedlatif1

apps/sim/blocks/blocks/elasticsearch.ts

@@ -187,7 +187,28 @@ export const ElasticsearchBlock: BlockConfig<ElasticsearchResponse> = {
       title: 'Index Name',
       type: 'short-input',
       placeholder: 'my-index',
-      required: true,
+      /**
+       * Required for every operation that addresses an index, but *not* for
+       * `_bulk`. Bulk legitimately runs against `/_bulk` with a per-action
+       * `_index` — the `operations` placeholder below shows exactly that — so
+       * `bulk.ts` declares `index` optional and its URL builder branches on
+       * the absence. The field still renders for bulk, where it supplies the
+       * default target for actions that omit `_index`.
+       */
+      required: {
+        field: 'operation',
+        value: [
+          'elasticsearch_search',
+          'elasticsearch_index_document',
+          'elasticsearch_get_document',
+          'elasticsearch_update_document',
+          'elasticsearch_delete_document',
+          'elasticsearch_count',
+          'elasticsearch_create_index',
+          'elasticsearch_delete_index',
+          'elasticsearch_get_index',
+        ],
+      },
       condition: {
         field: 'operation',
         value: [

apps/sim/tools/elasticsearch/block-params.test.ts

@@ -102,3 +102,47 @@ describe('elasticsearch block declares no unreachable aggregations', () => {
     expect(transform({ timeout: '45s' }).esTimeout).toBe('45s')
   })
 })
+
+/**
+ * `_bulk` legitimately runs against `/_bulk` with a per-action `_index`, which
+ * the block's own `operations` placeholder demonstrates
+ * (`{"index":{"_index":"my-index","_id":"1"}}`). `bulk.ts` therefore declares
+ * `index` optional, and `bulk`'s URL builder branches on its absence — the
+ * block marking it `required: true` blocked a call the tool supports.
+ */
+describe('elasticsearch block index requirement agrees with the tools', () => {
+  const indexSubBlock = ElasticsearchBlock.subBlocks.find((b) => b.id === 'index')
+
+  it('does not require index for bulk', () => {
+    expect(indexSubBlock?.required).not.toBe(true)
+
+    const required = indexSubBlock?.required as { field: string; value: string[] }
+
+    expect(required.field).toBe('operation')
+    expect(required.value).not.toContain('elasticsearch_bulk')
+  })
+
+  it('still renders the index field for bulk, where it sets the default target', () => {
+    const condition = indexSubBlock?.condition as { field: string; value: string[] }
+
+    expect(condition.value).toContain('elasticsearch_bulk')
+  })
+
+  it('keeps requiring index for every operation that addresses one', () => {
+    const required = indexSubBlock?.required as { field: string; value: string[] }
+
+    for (const operation of [
+      'elasticsearch_search',
+      'elasticsearch_index_document',
+      'elasticsearch_get_document',
+      'elasticsearch_update_document',
+      'elasticsearch_delete_document',
+      'elasticsearch_count',
+      'elasticsearch_create_index',
+      'elasticsearch_delete_index',
+      'elasticsearch_get_index',
+    ]) {
+      expect(required.value).toContain(operation)
+    }
+  })
+})

apps/sim/tools/elasticsearch/utils.test.ts

@@ -9,6 +9,7 @@ import {
   parseCloudId,
   safeIndexPathSegment,
 } from '@/tools/elasticsearch/utils'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 /**
  * Builds a Cloud ID from its decoded parts the way the Elastic Cloud console does.
@@ -456,3 +457,93 @@ describe('parseCloudId rejects URL-special characters in decoded components', ()
     expect(parseCloudId(id)).toBe(`https://${ES_UUID}.es-prod.eu-west-1.aws.found.io`)
   })
 })
+
+/**
+ * A self-hosted host without an explicit scheme stays *relative*, and the
+ * executor resolves the tool URL with `new URL(endpointUrl, getBaseUrl())` —
+ * Sim's own origin. `buildAuthHeaders` attaches the caller's Elasticsearch
+ * credential regardless, so the credential is sent to Sim, and the SSRF check
+ * passes because the resolved host is Sim itself.
+ */
+describe('buildBaseUrl requires an explicit http(s) scheme', () => {
+  const SIM_ORIGIN = 'https://sim.ai'
+
+  function selfHosted(host: string) {
+    return buildBaseUrl({ deploymentType: 'self_hosted', host, authMethod: 'api_key' })
+  }
+
+  it('rejects a bare hostname that would otherwise resolve against Sim’s own origin', () => {
+    expect(new URL('es.internal/products/_search', SIM_ORIGIN).origin).toBe(SIM_ORIGIN)
+
+    expect(() => selfHosted('es.internal')).toThrow(/must start with "http:\/\/" or "https:\/\//)
+  })
+
+  it('rejects a scheme-less host:port, which parses as a bogus "localhost:" scheme', () => {
+    expect(new URL('localhost:9200/products/_search', SIM_ORIGIN).protocol).toBe('localhost:')
+
+    expect(() => selfHosted('localhost:9200')).toThrow(/must start with "http:\/\/" or "https:\/\//)
+  })
+
+  it('rejects a protocol-relative host, which silently inherits Sim’s scheme', () => {
+    expect(new URL('//evil.example.com/x', SIM_ORIGIN).origin).toBe('https://evil.example.com')
+
+    expect(() => selfHosted('//evil.example.com')).toThrow(
+      /must start with "http:\/\/" or "https:\/\//
+    )
+  })
+
+  it('rejects a non-http scheme', () => {
+    expect(() => selfHosted('ftp://es.example.com')).toThrow(
+      /must start with "http:\/\/" or "https:\/\//
+    )
+    expect(() => selfHosted('file:///etc/passwd')).toThrow(
+      /must start with "http:\/\/" or "https:\/\//
+    )
+  })
+
+  it('rejects a scheme-ful host the URL parser cannot give an origin', () => {
+    expect(() => selfHosted('https://')).toThrow(/is not a valid URL/)
+  })
+
+  it('keeps every legitimate host shape working', () => {
+    expect(selfHosted('https://localhost:9200')).toBe('https://localhost:9200')
+    expect(selfHosted('http://localhost:9200')).toBe('http://localhost:9200')
+    expect(selfHosted('https://es.example.com')).toBe('https://es.example.com')
+    expect(selfHosted('https://es.example.com:9200///')).toBe('https://es.example.com:9200')
+    expect(selfHosted('  https://es.example.com  ')).toBe('https://es.example.com')
+    expect(selfHosted('HTTPS://es.example.com')).toBe('HTTPS://es.example.com')
+    expect(selfHosted('http://10.0.0.5:9200')).toBe('http://10.0.0.5:9200')
+    expect(selfHosted('https://user:pw@es.example.com:9200')).toBe(
+      'https://user:pw@es.example.com:9200'
+    )
+  })
+
+  it('produces an absolute URL that no longer resolves against Sim', () => {
+    const built = new URL(`${selfHosted('https://localhost:9200')}/products/_search`, SIM_ORIGIN)
+
+    expect(built.origin).toBe('https://localhost:9200')
+  })
+})
+
+/**
+ * `safeIndexPathSegment` is a local variant of the shared `safeUrlPathSegment`,
+ * whose `toGuardedString` deliberately abandoned the
+ * `typeof value === 'string' ? value.trim() : ''` form: a non-string became
+ * `''` and was then reported as *"is required"*, a confusing error for a value
+ * the caller did supply. The local variant only needed to drop the `/`
+ * rejection, not the number coercion.
+ */
+describe('safeIndexPathSegment coerces a non-string index', () => {
+  it('stringifies a numeric index emitted as a JSON number', () => {
+    expect(safeIndexPathSegment(2024, 'index')).toBe('2024')
+  })
+
+  it('matches the shared helper, which already accepts a numeric documentId', () => {
+    expect(safeIndexPathSegment(2024, 'index')).toBe(safeUrlPathSegment(2024, 'documentId'))
+  })
+
+  it('still reports null and undefined as missing rather than addressing "null"', () => {
+    expect(() => safeIndexPathSegment(null as never, 'index')).toThrow(/index is required/)
+    expect(() => safeIndexPathSegment(undefined as never, 'index')).toThrow(/index is required/)
+  })
+})