fix(oracle-fusion): confine request origin

Author: Bill Leoutsakos

apps/sim/lib/internal/oracle-fusion-financials/client.ts

@@ -229,6 +229,9 @@ export interface OracleFusionRequest {
 
 function buildRequestUrl(origin: string, request: OracleFusionRequest): string {
   const url = new URL(request.path, origin)
+  if (url.origin !== origin || url.username || url.password) {
+    throw new Error('Oracle Fusion request path must remain on the credential-bound origin')
+  }
   for (const [key, value] of Object.entries(request.query ?? {})) {
     if (value !== undefined) url.searchParams.set(key, String(value))
   }

apps/sim/lib/internal/oracle-fusion-financials/oracle-fusion-financials.test.ts

@@ -849,6 +849,17 @@ describe('Oracle Fusion Financials provider', () => {
     expect(url.searchParams.has('totalResults')).toBe(false)
   })
 
+  it.each([
+    'https://attacker.example/fscmRestApi/resources/11.13.18.05/invoices',
+    '//attacker.example/fscmRestApi/resources/11.13.18.05/invoices',
+    `https://user:password@vision.fa.us2.oraclecloud.com${RESOURCE_PATH}/invoices`,
+  ])('rejects request paths that leave the credential-bound origin: %s', async (path) => {
+    await expect(requestOracleFusionJson(AUTH, { path })).rejects.toThrow(
+      'Oracle Fusion request path must remain on the credential-bound origin'
+    )
+    expect(mockSecureFetch).not.toHaveBeenCalled()
+  })
+
   it('encodes every opaque parent key in nested resource paths', async () => {
     const invoiceUniqId = 'INVOICE key+1'
     const invoiceLineUniqId = 'LINE key+2'