fix(egress): address the second review round

Verified each finding before changing anything; one was rejected as unreachable.

The P1 is real and mine. `validateMcpServerSsrf` used one profile for every
caller, so OAuth legs — whose URLs come out of authorization-server metadata,
as that file's own docstring says — inherited configured-endpoint privileges. A
hostile MCP server could have steered discovery, token exchange or revocation at
whatever the operator allowlisted for their own workflows. Those legs take
`contentFetch` now.

That made two branches in the OAuth fetch dead, one of them badly: a null
resolution fell through to an unguarded `globalThis.fetch`. Under `contentFetch`
the only way to get there is an unresolved env-var hostname, which is never a
real authorization-server URL, so it refuses instead. No leg of that flow reaches
the network unguarded now.

Also restored: 26 tests for `validateSupabaseProjectId`, which is live in two
production call sites. Its suite was nested inside the `validateMondayColumnId`
describe on staging, so removing that dead block took it as collateral. It is
top-level now, where it belongs.

The rest:

- The boundary script missed `await import()` and `require()`, and falsely
  flagged `import type`. All four forms are covered and verified with probes.
- `validateVendorHostedUrl` accepted plain HTTP to ServiceNow, Workday and
  Databricks if an operator happened to allowlist the vendor's domain. They are
  HTTPS-only SaaS; enforced before the general policy runs.
- STT resolved an internal file to a presigned storage URL and then judged it as
  content, so a self-hosted MinIO on a private address would have failed. Same
  provenance threading as textract.
- The env-flags warning printed the allowlist entries; internal topology stays
  out of a log line that may leave the deployment.
- The testing mock served egress config while hosted, which production never
  does — a test could assert a posture that cannot exist.
- The security doc's example allowlisted `*.svc.cluster.local` and all of
  `10.0.0.0/8` directly under a warning to name specific hosts.
- `--strict` restored on lint:helm; it passes, and the original intent stands.
- My own end-to-end test rejected on scheme rather than address, so it would have
  passed even if `contentFetch` started honouring the allowlist.

Not changed: the guarded lookup ignoring the request profile. Both callers route
a private resolution to the pinned path (`client.ts`, `pinned-fetch.ts`), so an
allowlisted private address never reaches that lookup, and it fails closed.

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/security.mdx

@@ -149,10 +149,12 @@ Content fetches never reach a private destination, allowlist or not — that is
 Deployments frequently need to reach an internal service by name or address. Name the destinations:
 
 ```bash
-EGRESS_ALLOWED_HOSTS=host.docker.internal,*.svc.cluster.local
-EGRESS_ALLOWED_IP_RANGES=10.0.0.0/8,192.168.65.254/32
+EGRESS_ALLOWED_HOSTS=host.docker.internal,vllm.ai.svc.cluster.local
+EGRESS_ALLOWED_IP_RANGES=10.4.2.17/32,10.4.9.0/24
 ```
 
+A wildcard (`*.svc.cluster.local`) and a broad range (`10.0.0.0/8`) are accepted, but they hand every workflow author the whole namespace or network. Name the hosts you actually use.
+
 Naming a destination permits plain HTTP to it and lifts the blocked-port list for it, since those are the same decision about the same host. Cloud metadata endpoints (`169.254.169.254` and equivalents) stay blocked no matter how broad the allowlist is, and both variables are ignored entirely on Sim Cloud.
 
 To reach a service on the Docker host, pair the allowlist with the host alias that Compose already sets up:

apps/sim/app/api/mcp/servers/test-connection/route.test.ts

@@ -51,6 +51,7 @@ vi.mock('@/lib/mcp/client', () => ({
 
 vi.mock('@/lib/mcp/domain-check', () => ({
   MCP_EGRESS_PROFILE: 'selfHostedService',
+  OAUTH_EGRESS_PROFILE: 'contentFetch',
   McpDnsResolutionError: class extends Error {},
   McpDomainNotAllowedError: class extends Error {},
   McpSsrfError: MockMcpSsrfError,

apps/sim/lib/core/config/env-flags.ts

@@ -196,9 +196,10 @@ if (env.EGRESS_ALLOWED_HOSTS || env.EGRESS_ALLOWED_IP_RANGES) {
           'EGRESS_ALLOWED_HOSTS/EGRESS_ALLOWED_IP_RANGES are set but ignored on hosted environment. Private, reserved, and loopback destinations remain blocked for security.'
         )
       } else {
+        // The entries themselves are internal network topology and stay out of
+        // the log line, which may leave the deployment.
         logger.warn(
-          'Private-network egress allowlist is configured. Outbound requests may reach the listed destinations. Only use this on a trusted private network.',
-          { hosts: env.EGRESS_ALLOWED_HOSTS, ipRanges: env.EGRESS_ALLOWED_IP_RANGES }
+          'Private-network egress allowlist is configured. Outbound requests may reach the listed destinations. Only use this on a trusted private network.'
         )
       }
     })

apps/sim/lib/core/security/egress-end-to-end.server.test.ts

@@ -74,9 +74,11 @@ describe.skipIf(!host)('issue #7200 — reaching a service on a private network'
   it('does not extend that reach to a content-provenance URL', async () => {
     setEnvFlags({ egressAllowedIpRanges: `${host}/32` })
 
+    // https, so the refusal has to come from the address rather than the scheme —
+    // otherwise this passes even if contentFetch started honouring the allowlist.
     await expect(
-      secureFetchWithValidation(`http://${host}:${port}/`, { profile: 'contentFetch' })
-    ).rejects.toThrow()
+      secureFetchWithValidation(`https://${host}:${port}/`, { profile: 'contentFetch' })
+    ).rejects.toThrow(/private or reserved address/)
   })
 
   it('reaches a loopback service without any allowlist, as a self-hosted deployment does', async () => {

apps/sim/lib/core/security/input-validation.test.ts

@@ -17,6 +17,7 @@ import {
   validatePathSegment,
   validateS3BucketName,
   validateServiceNowInstanceUrl,
+  validateSupabaseProjectId,
   validateWorkdayTenantUrl,
 } from '@/lib/core/security/input-validation'
 import {
@@ -1931,3 +1932,122 @@ describe('validateWorkdayTenantUrl', () => {
     })
   })
 })
+
+describe('validateSupabaseProjectId', () => {
+  describe('valid inputs', () => {
+    it.concurrent('should accept a typical 20-char lowercase alphanumeric project ID', () => {
+      const result = validateSupabaseProjectId('jdrkgepadsdopsntdlom')
+      expect(result.isValid).toBe(true)
+      expect(result.sanitized).toBe('jdrkgepadsdopsntdlom')
+    })
+
+    it.concurrent('should accept project IDs with digits', () => {
+      const result = validateSupabaseProjectId('abc123def456ghi789jk')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should accept IDs at the minimum length boundary (10)', () => {
+      const result = validateSupabaseProjectId('abcdefghij')
+      expect(result.isValid).toBe(true)
+    })
+
+    it.concurrent('should accept IDs at the maximum length boundary (40)', () => {
+      const result = validateSupabaseProjectId('a'.repeat(40))
+      expect(result.isValid).toBe(true)
+    })
+  })
+
+  describe('SSRF attack vectors', () => {
+    it.concurrent('should reject fragment injection (#)', () => {
+      const result = validateSupabaseProjectId('evil#attacker.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject @ for authority injection', () => {
+      const result = validateSupabaseProjectId('evil@attacker.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject path traversal with slashes', () => {
+      const result = validateSupabaseProjectId('evil/../../etc/passwd')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject dots (subdomain manipulation)', () => {
+      const result = validateSupabaseProjectId('evil.attacker.com')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject backslashes', () => {
+      const result = validateSupabaseProjectId('evil\\path')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject colons (port injection)', () => {
+      const result = validateSupabaseProjectId('evil:8080')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject URL-encoded characters', () => {
+      const result = validateSupabaseProjectId('evil%23attacker')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject spaces', () => {
+      const result = validateSupabaseProjectId('evil host')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject newlines (header injection)', () => {
+      const result = validateSupabaseProjectId('evil\r\nHost: attacker.com')
+      expect(result.isValid).toBe(false)
+    })
+  })
+
+  describe('invalid formats', () => {
+    it.concurrent('should reject null', () => {
+      const result = validateSupabaseProjectId(null)
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject undefined', () => {
+      const result = validateSupabaseProjectId(undefined)
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject empty string', () => {
+      const result = validateSupabaseProjectId('')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject uppercase letters', () => {
+      const result = validateSupabaseProjectId('JDRKGEPADSDOPSNTDLOM')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject mixed case', () => {
+      const result = validateSupabaseProjectId('jdrkGEPadsdOPSntdlom')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject hyphens', () => {
+      const result = validateSupabaseProjectId('jdrk-gepa-dsdo-psnt')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject underscores', () => {
+      const result = validateSupabaseProjectId('jdrk_gepa_dsdo_psnt')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject IDs shorter than 10 characters', () => {
+      const result = validateSupabaseProjectId('abcdefghi')
+      expect(result.isValid).toBe(false)
+    })
+
+    it.concurrent('should reject IDs longer than 40 characters', () => {
+      const result = validateSupabaseProjectId('a'.repeat(41))
+      expect(result.isValid).toBe(false)
+    })
+  })
+})

apps/sim/lib/core/security/input-validation.ts

@@ -1123,6 +1123,13 @@ function validateVendorHostedUrl(
 
   const candidate = assumeHttps && !/^https?:\/\//i.test(raw) ? `https://${raw}` : raw
 
+  // These vendors are public SaaS reached over TLS. Enforced here rather than
+  // left to the egress policy, which would permit plain HTTP to a host an
+  // operator happened to put in their allowlist.
+  if (/^http:\/\//i.test(candidate)) {
+    return { isValid: false, error: `${paramName} must use https://` }
+  }
+
   const urlResult = validateExternalUrl(candidate, paramName, 'configuredEndpoint')
   if (!urlResult.isValid) return urlResult
 

apps/sim/lib/internal/stt/operations.ts

@@ -3,6 +3,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { extractAudioFromVideo, isVideoFile } from '@/lib/audio/extractor'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
+import type { EgressProfile } from '@/lib/core/security/egress/profiles'
 import {
   secureFetchWithPinnedIP,
   validateUrlWithDNS,
@@ -255,13 +256,18 @@ export async function executeSttOperation(
         }
       }
 
-      const urlValidation = await validateUrlWithDNS(audioUrl, 'audioUrl', 'contentFetch')
+      // A caller-supplied audio URL is content; a resolved internal one is a
+      // presigned URL against Sim's own storage, which on a self-hosted
+      // deployment legitimately sits on a private address.
+      const audioProfile: EgressProfile = internalAudioUrl ? 'configuredEndpoint' : 'contentFetch'
+
+      const urlValidation = await validateUrlWithDNS(audioUrl, 'audioUrl', audioProfile)
       if (!urlValidation.isValid) {
         return Response.json({ error: urlValidation.error }, { status: 400 })
       }
 
       const response = await secureFetchWithPinnedIP(audioUrl, urlValidation.resolvedIP, {
-        profile: 'contentFetch',
+        profile: audioProfile,
         method: 'GET',
         maxResponseBytes: MAX_FILE_SIZE,
         signal,

apps/sim/lib/mcp/domain-check.ts

@@ -13,6 +13,17 @@ const logger = createLogger('McpDomainCheck')
  */
 export const MCP_EGRESS_PROFILE: EgressProfile = 'selfHostedService'
 
+/**
+ * Profile for an MCP OAuth leg — discovery, registration, token exchange,
+ * revocation.
+ *
+ * Every hop after the first takes its URL from authorization-server metadata,
+ * which the remote server controls. Treating those as configured endpoints would
+ * let a hostile server steer a leg at whatever the operator allowlisted for their
+ * own workflows, so they get the provenance they actually have.
+ */
+export const OAUTH_EGRESS_PROFILE: EgressProfile = 'contentFetch'
+
 export class McpDomainNotAllowedError extends Error {
   constructor(domain: string) {
     super(`MCP server domain "${domain}" is not allowed by the server's ALLOWED_MCP_DOMAINS policy`)
@@ -113,18 +124,25 @@ export function validateMcpDomain(url: string | undefined): void {
  * list disabled this entirely — which left an allowlisted domain free to redirect
  * anywhere, cloud metadata included.
  *
+ * `profile` defaults to the configured-server one. An OAuth leg passes
+ * `contentFetch` instead, because those URLs come out of authorization-server
+ * metadata rather than from whoever configured the server.
+ *
  * Returns null only when the hostname still contains an unresolved env-var
  * reference. That URL is checked again after resolution, at which point it takes
  * the normal path.
  *
  * @throws McpSsrfError when the policy refuses the destination
  * @throws McpDnsResolutionError when the hostname cannot be resolved
  */
-export async function validateMcpServerSsrf(url: string | undefined): Promise<string | null> {
+export async function validateMcpServerSsrf(
+  url: string | undefined,
+  profile: EgressProfile = MCP_EGRESS_PROFILE
+): Promise<string | null> {
   if (!url) return null
   if (hasEnvVarInHostname(url)) return null
 
-  const validation = await validateUrlWithDNS(url, 'MCP server URL', MCP_EGRESS_PROFILE)
+  const validation = await validateUrlWithDNS(url, 'MCP server URL', profile)
   if (validation.isValid) return validation.resolvedIP
 
   const error = validation.error ?? 'MCP server URL is not reachable'

apps/sim/lib/mcp/oauth/revoke.test.ts

@@ -45,6 +45,8 @@ vi.mock('@sim/security/ssrf', () => ({
 }))
 vi.mock('@/lib/mcp/domain-check', () => ({
   MCP_EGRESS_PROFILE: 'selfHostedService',
+  OAUTH_EGRESS_PROFILE: 'contentFetch',
+  McpSsrfError: class McpSsrfError extends Error {},
   validateMcpServerSsrf: mockValidateMcpServerSsrf,
 }))
 vi.mock('@modelcontextprotocol/sdk/client/auth.js', () => ({
@@ -115,7 +117,7 @@ describe('revokeMcpOauthTokens — SSRF guard', () => {
   it('validates the attacker-controlled revocation_endpoint before issuing the request', async () => {
     await revokeMcpOauthTokens('server-1', 'workspace-1')
 
-    expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith(BLOCKED_ENDPOINT)
+    expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith(BLOCKED_ENDPOINT, 'contentFetch')
   })
 
   it('never issues an outbound request to the blocked revocation endpoint', async () => {
@@ -146,7 +148,7 @@ describe('revokeMcpOauthTokens — SSRF guard', () => {
 
     await revokeMcpOauthTokens('server-1', 'workspace-1')
 
-    expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith(publicEndpoint)
+    expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith(publicEndpoint, 'contentFetch')
     const revokeCalls = mockUndiciFetch.mock.calls.filter((call) => {
       const target = typeof call[0] === 'string' ? call[0] : String(call[0])
       return target === publicEndpoint

apps/sim/lib/mcp/orchestration/server-lifecycle.test.ts

@@ -39,6 +39,7 @@ vi.mock('@sim/utils/id', () => ({ generateId: vi.fn() }))
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/lib/mcp/domain-check', () => ({
   MCP_EGRESS_PROFILE: 'selfHostedService',
+  OAUTH_EGRESS_PROFILE: 'contentFetch',
   McpDnsResolutionError: class extends Error {},
   McpDomainNotAllowedError: class extends Error {},
   McpSsrfError: class extends Error {},