fix(zoho-desk): apply the Zoho host allowlist to the organizations route

The organizations route built its URL from the client-supplied apiDomain and
attached the OAuth token without the https-Zoho-host allowlist the attachment
route already enforced, so a session-access caller could point the server at an
arbitrary origin and leak the token. Extract the shared isZohoHost allowlist and
an assertZohoUrl guard into tools/zoho_desk/utils (two consumers now), guard the
organizations URL before fetching, and refactor the attachment route to reuse
the shared helper. Adds tests for the allowlist and guard.

Author: mzxchandra

apps/sim/app/api/tools/zoho_desk/attachment/route.ts

@@ -10,6 +10,7 @@ import {
   buildZohoDeskHeaders,
   deriveAttachmentName,
   getZohoDeskApiBase,
+  isZohoHost,
   resolveZohoAttachmentUrl,
 } from '@/tools/zoho_desk/utils'
 
@@ -19,40 +20,6 @@ const logger = createLogger('ZohoDeskAttachmentAPI')
 
 const MAX_ATTACHMENT_BYTES = 50 * 1024 * 1024
 
-/**
- * Zoho-owned apex domains across data centers. The `href` on an attachment is
- * user/LLM-influenced, so the download host must be anchored to one of these
- * with a strict suffix match — a naive `contains "zoho."` check would accept an
- * attacker domain like `zoho.attacker.com` or `desk.zoho.com.attacker.com` and
- * leak the OAuth token + orgId to it.
- */
-const ZOHO_ALLOWED_APEX_DOMAINS = [
-  'zoho.com',
-  'zoho.eu',
-  'zoho.in',
-  'zoho.com.au',
-  'zoho.jp',
-  'zoho.ca',
-  'zoho.sa',
-  'zoho.com.cn',
-  'zoho.uk',
-  'zohoapis.com',
-  'zohoapis.eu',
-  'zohoapis.in',
-  'zohoapis.com.au',
-  'zohoapis.jp',
-  'zohoapis.ca',
-  'zohoapis.sa',
-  'zohoapis.com.cn',
-  'zohoapis.uk',
-]
-
-/** True only when the hostname is exactly a Zoho apex or a subdomain of one. */
-function isZohoHost(hostname: string): boolean {
-  const host = hostname.toLowerCase()
-  return ZOHO_ALLOWED_APEX_DOMAINS.some((apex) => host === apex || host.endsWith(`.${apex}`))
-}
-
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
   if (!authResult.success) {

apps/sim/app/api/tools/zoho_desk/organizations/route.ts

@@ -5,7 +5,7 @@ import { zohoDeskListOrganizationsContract } from '@/lib/api/contracts/tools/zoh
 import { parseRequest } from '@/lib/api/server'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { getZohoDeskApiBase, getZohoDeskErrorMessage } from '@/tools/zoho_desk/utils'
+import { assertZohoUrl, getZohoDeskApiBase, getZohoDeskErrorMessage } from '@/tools/zoho_desk/utils'
 
 export const dynamic = 'force-dynamic'
 
@@ -27,21 +27,30 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   if (!parsed.success) return parsed.response
   const { accessToken, apiDomain } = parsed.data.body
 
+  // apiDomain is client-supplied, so anchor the outbound host to a Zoho apex
+  // before attaching the OAuth token - otherwise a caller could point the server
+  // at an arbitrary origin and leak the token.
+  let organizationsUrl: URL
+  try {
+    organizationsUrl = assertZohoUrl(
+      `${getZohoDeskApiBase({ apiDomain: apiDomain ?? undefined })}/organizations`
+    )
+  } catch {
+    return NextResponse.json({ error: 'apiDomain must be an https Zoho host' }, { status: 400 })
+  }
+
   try {
     // The organizations endpoint is the one Desk call that does not require an
     // orgId header, so it can bootstrap the organization selector before a
     // portal has been chosen.
-    const response = await fetch(
-      `${getZohoDeskApiBase({ apiDomain: apiDomain ?? undefined })}/organizations`,
-      {
-        method: 'GET',
-        headers: {
-          Authorization: `Zoho-oauthtoken ${accessToken}`,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-      }
-    )
+    const response = await fetch(organizationsUrl.toString(), {
+      method: 'GET',
+      headers: {
+        Authorization: `Zoho-oauthtoken ${accessToken}`,
+        'Content-Type': 'application/json',
+      },
+      signal: AbortSignal.timeout(15_000),
+    })
 
     const data = await response.json().catch(() => ({}))
     if (!response.ok) {

apps/sim/tools/zoho_desk/utils.test.ts

@@ -3,12 +3,14 @@
  */
 import { describe, expect, it } from 'vitest'
 import {
+  assertZohoUrl,
   buildZohoDeskHeaders,
   convertZohoHtmlToText,
   deriveAttachmentName,
   deriveZohoContentText,
   getZohoDeskApiBase,
   getZohoDeskErrorMessage,
+  isZohoHost,
   resolveZohoAttachmentUrl,
   withDerivedContentText,
 } from '@/tools/zoho_desk/utils'
@@ -93,6 +95,33 @@ describe('zoho desk tool utils', () => {
     })
   })
 
+  describe('isZohoHost', () => {
+    it('accepts Zoho apex hosts and their subdomains across data centers', () => {
+      expect(isZohoHost('desk.zoho.com')).toBe(true)
+      expect(isZohoHost('desk.zoho.eu')).toBe(true)
+      expect(isZohoHost('zohoapis.com.au')).toBe(true)
+      expect(isZohoHost('DESK.ZOHO.IN')).toBe(true)
+    })
+
+    it('rejects lookalike and attacker hosts', () => {
+      expect(isZohoHost('zoho.attacker.com')).toBe(false)
+      expect(isZohoHost('desk.zoho.com.attacker.com')).toBe(false)
+      expect(isZohoHost('notzoho.com')).toBe(false)
+      expect(isZohoHost('evil.com')).toBe(false)
+    })
+  })
+
+  describe('assertZohoUrl', () => {
+    it('returns the URL for an https Zoho host', () => {
+      expect(assertZohoUrl('https://desk.zoho.eu/api/v1/organizations').host).toBe('desk.zoho.eu')
+    })
+
+    it('throws for a non-Zoho host or non-https scheme', () => {
+      expect(() => assertZohoUrl('https://attacker.com/api/v1/organizations')).toThrow()
+      expect(() => assertZohoUrl('http://desk.zoho.com/api/v1/organizations')).toThrow()
+    })
+  })
+
   describe('resolveZohoAttachmentUrl', () => {
     const apiBase = 'https://desk.zoho.com/api/v1'
 

apps/sim/tools/zoho_desk/utils.ts

@@ -4,6 +4,54 @@ import type { ZohoDeskBaseParams } from '@/tools/zoho_desk/types'
 /** Default Zoho Desk REST host when no data-center-specific base was persisted. */
 const DEFAULT_ZOHO_DESK_BASE = 'https://desk.zoho.com'
 
+/**
+ * Zoho-owned apex domains across data centers. `apiDomain` and attachment `href`
+ * values are user/LLM-influenced, so any outbound request that carries the OAuth
+ * token must anchor its host to one of these with a strict suffix match - a naive
+ * `contains "zoho."` check would accept an attacker domain like
+ * `zoho.attacker.com` or `desk.zoho.com.attacker.com` and leak the token to it.
+ */
+const ZOHO_ALLOWED_APEX_DOMAINS = [
+  'zoho.com',
+  'zoho.eu',
+  'zoho.in',
+  'zoho.com.au',
+  'zoho.jp',
+  'zoho.ca',
+  'zoho.sa',
+  'zoho.com.cn',
+  'zoho.uk',
+  'zohoapis.com',
+  'zohoapis.eu',
+  'zohoapis.in',
+  'zohoapis.com.au',
+  'zohoapis.jp',
+  'zohoapis.ca',
+  'zohoapis.sa',
+  'zohoapis.com.cn',
+  'zohoapis.uk',
+]
+
+/** True only when the hostname is exactly a Zoho apex or a subdomain of one. */
+export function isZohoHost(hostname: string): boolean {
+  const host = hostname.toLowerCase()
+  return ZOHO_ALLOWED_APEX_DOMAINS.some((apex) => host === apex || host.endsWith(`.${apex}`))
+}
+
+/**
+ * Assert that a URL is a token-safe Zoho target: it must be `https:` and its host
+ * must be a Zoho apex or subdomain. Returns the parsed URL, or throws (the caller
+ * maps that to a 400) - used by every route that sends the OAuth token to a host
+ * derived from user/LLM-influenced input.
+ */
+export function assertZohoUrl(rawUrl: string): URL {
+  const url = new URL(rawUrl)
+  if (url.protocol !== 'https:' || !isZohoHost(url.hostname)) {
+    throw new Error('URL must be an https Zoho host')
+  }
+  return url
+}
+
 /**
  * Convert Zoho Desk rich-text HTML (comment / thread / ticket bodies) to
  * readable plain text. Mirrors the per-integration `html-to-text` configuration