fix(zoho-desk): validate the persisted Desk base against the strict host allowlist

deriveZohoDeskBaseFromApiDomain trusted any host matching `desk.zoho.[a-z.]+`,
so a crafted api_domain like `desk.zoho.com.attacker.com` passed and was
persisted as the credential's `__zoho_domain__` REST base - later receiving the
OAuth token on every Desk tool/webhook call. Gate the derivation on the strict
isZohoHost apex allowlist (which rejects that lookalike), extracted with
assertZohoUrl into a dependency-free host-allowlist module so the auth
token-exchange path validates hosts without pulling in the tool utilities. The
attachment and organizations routes now import the shared guard from there.

Also: formatInput now emits the normalized null trigger shape for an empty/
malformed event array instead of leaking a raw `[]` to downstream steps. Tests
cover the empty-array shape and the lookalike-host rejection.

Author: mzxchandra

apps/sim/app/api/tools/zoho_desk/attachment/route.ts

@@ -6,11 +6,11 @@ import { parseRequest } from '@/lib/api/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
 import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { isZohoHost } from '@/tools/zoho_desk/host-allowlist'
 import {
   buildZohoDeskHeaders,
   deriveAttachmentName,
   getZohoDeskApiBase,
-  isZohoHost,
   resolveZohoAttachmentUrl,
 } from '@/tools/zoho_desk/utils'
 

apps/sim/app/api/tools/zoho_desk/organizations/route.ts

@@ -5,7 +5,8 @@ import { zohoDeskListOrganizationsContract } from '@/lib/api/contracts/tools/zoh
 import { parseRequest } from '@/lib/api/server'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { assertZohoUrl, getZohoDeskApiBase, getZohoDeskErrorMessage } from '@/tools/zoho_desk/utils'
+import { assertZohoUrl } from '@/tools/zoho_desk/host-allowlist'
+import { getZohoDeskApiBase, getZohoDeskErrorMessage } from '@/tools/zoho_desk/utils'
 
 export const dynamic = 'force-dynamic'
 

apps/sim/lib/auth/auth.ts

@@ -109,6 +109,7 @@ import { joinInstanceOrganization } from '@/lib/organizations/instance-org'
 import { captureServerEvent, getPostHogClient } from '@/lib/posthog/server'
 import { disableUserResources } from '@/lib/workflows/lifecycle'
 import { SSO_TRUSTED_PROVIDERS } from '@/ee/sso/constants'
+import { isZohoHost } from '@/tools/zoho_desk/host-allowlist'
 
 const logger = createLogger('Auth')
 
@@ -171,14 +172,14 @@ function deriveZohoDeskBaseFromApiDomain(apiDomain?: string): string {
   if (!apiDomain) return fallback
   try {
     const host = new URL(apiDomain).host.toLowerCase()
-    // Already a data-center Desk host (e.g. desk.zoho.eu) - preserve it so we
-    // never misroute a valid regional domain back to the US (.com) data center.
-    if (/(^|\.)desk\.zoho\.[a-z.]+$/.test(host)) return `https://${host}`
-    // Otherwise map the data-center TLD from the API host (www.zohoapis.<tld> or
-    // any zoho.<tld>) onto the Desk REST host in the same data center.
+    // Gate on the strict Zoho apex allowlist before trusting the host: a loose
+    // `desk.zoho.*` pattern would accept a lookalike like `desk.zoho.com.attacker.com`
+    // and persist it as the credential's REST base, later leaking the OAuth token.
+    if (!isZohoHost(host)) return fallback
+    // Map the data-center TLD from the (now trusted) host onto the Desk REST host
+    // in the same data center - works for both www.zohoapis.<tld> and desk.zoho.<tld>.
     const match = host.match(/zoho(?:apis)?\.([a-z.]+)$/)
-    if (match?.[1]) return `https://desk.zoho.${match[1]}`
-    return fallback
+    return match?.[1] ? `https://desk.zoho.${match[1]}` : fallback
   } catch {
     return fallback
   }

apps/sim/lib/webhooks/providers/zoho-desk.test.ts

@@ -149,6 +149,23 @@ describe('zohoDeskHandler', () => {
       expect(result?.input).toBe(body)
     })
 
+    it('emits a normalized null shape for an empty array instead of leaking []', async () => {
+      const result = await zohoDeskHandler.formatInput?.({
+        webhook: {},
+        workflow: { id: 'wf', userId: 'user' },
+        body: [],
+        headers: {},
+        requestId: 'test',
+      })
+      expect(result?.input).toEqual({
+        eventType: null,
+        eventTime: null,
+        orgId: null,
+        payload: null,
+        prevState: null,
+      })
+    })
+
     it('derives a plain-text contentText for html comment/thread payloads', async () => {
       const result = await zohoDeskHandler.formatInput?.({
         webhook: {},

apps/sim/lib/webhooks/providers/zoho-desk.ts

@@ -379,7 +379,12 @@ export const zohoDeskHandler: WebhookProviderHandler = {
     }
     const event = body[0]
     if (!event || typeof event !== 'object') {
-      return { input: body }
+      // Empty or malformed array (e.g. Zoho posts `[]`): emit the normalized
+      // trigger shape with null fields so downstream steps still see
+      // eventType/payload/etc. rather than a raw array leaking through.
+      return {
+        input: { eventType: null, eventTime: null, orgId: null, payload: null, prevState: null },
+      }
     }
     const record = event as Record<string, unknown>
     // Comment / thread event payloads carry a raw `content` + `contentType`

apps/sim/tools/zoho_desk/host-allowlist.ts

@@ -0,0 +1,51 @@
+/**
+ * Zoho-owned apex domains across data centers. `apiDomain` and attachment `href`
+ * values are user/LLM-influenced, so any outbound request that carries the OAuth
+ * token - and the data-center base persisted at token exchange - must anchor its
+ * host to one of these with a strict suffix match. A naive `contains "zoho."` or
+ * `desk.zoho.*` check would accept an attacker domain like `zoho.attacker.com` or
+ * `desk.zoho.com.attacker.com` and leak the token to it.
+ *
+ * Kept in its own dependency-free module so the auth token-exchange path can
+ * validate hosts without pulling in the heavier tool utilities (e.g. html-to-text).
+ */
+const ZOHO_ALLOWED_APEX_DOMAINS = [
+  'zoho.com',
+  'zoho.eu',
+  'zoho.in',
+  'zoho.com.au',
+  'zoho.jp',
+  'zoho.ca',
+  'zoho.sa',
+  'zoho.com.cn',
+  'zoho.uk',
+  'zohoapis.com',
+  'zohoapis.eu',
+  'zohoapis.in',
+  'zohoapis.com.au',
+  'zohoapis.jp',
+  'zohoapis.ca',
+  'zohoapis.sa',
+  'zohoapis.com.cn',
+  'zohoapis.uk',
+]
+
+/** True only when the hostname is exactly a Zoho apex or a subdomain of one. */
+export function isZohoHost(hostname: string): boolean {
+  const host = hostname.toLowerCase()
+  return ZOHO_ALLOWED_APEX_DOMAINS.some((apex) => host === apex || host.endsWith(`.${apex}`))
+}
+
+/**
+ * Assert that a URL is a token-safe Zoho target: it must be `https:` and its host
+ * must be a Zoho apex or subdomain. Returns the parsed URL, or throws (the caller
+ * maps that to a 400) - used by every route that sends the OAuth token to a host
+ * derived from user/LLM-influenced input.
+ */
+export function assertZohoUrl(rawUrl: string): URL {
+  const url = new URL(rawUrl)
+  if (url.protocol !== 'https:' || !isZohoHost(url.hostname)) {
+    throw new Error('URL must be an https Zoho host')
+  }
+  return url
+}

apps/sim/tools/zoho_desk/utils.test.ts

@@ -2,15 +2,14 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
+import { assertZohoUrl, isZohoHost } from '@/tools/zoho_desk/host-allowlist'
 import {
-  assertZohoUrl,
   buildZohoDeskHeaders,
   convertZohoHtmlToText,
   deriveAttachmentName,
   deriveZohoContentText,
   getZohoDeskApiBase,
   getZohoDeskErrorMessage,
-  isZohoHost,
   resolveZohoAttachmentUrl,
   withDerivedContentText,
 } from '@/tools/zoho_desk/utils'

apps/sim/tools/zoho_desk/utils.ts

@@ -4,54 +4,6 @@ import type { ZohoDeskBaseParams } from '@/tools/zoho_desk/types'
 /** Default Zoho Desk REST host when no data-center-specific base was persisted. */
 const DEFAULT_ZOHO_DESK_BASE = 'https://desk.zoho.com'
 
-/**
- * Zoho-owned apex domains across data centers. `apiDomain` and attachment `href`
- * values are user/LLM-influenced, so any outbound request that carries the OAuth
- * token must anchor its host to one of these with a strict suffix match - a naive
- * `contains "zoho."` check would accept an attacker domain like
- * `zoho.attacker.com` or `desk.zoho.com.attacker.com` and leak the token to it.
- */
-const ZOHO_ALLOWED_APEX_DOMAINS = [
-  'zoho.com',
-  'zoho.eu',
-  'zoho.in',
-  'zoho.com.au',
-  'zoho.jp',
-  'zoho.ca',
-  'zoho.sa',
-  'zoho.com.cn',
-  'zoho.uk',
-  'zohoapis.com',
-  'zohoapis.eu',
-  'zohoapis.in',
-  'zohoapis.com.au',
-  'zohoapis.jp',
-  'zohoapis.ca',
-  'zohoapis.sa',
-  'zohoapis.com.cn',
-  'zohoapis.uk',
-]
-
-/** True only when the hostname is exactly a Zoho apex or a subdomain of one. */
-export function isZohoHost(hostname: string): boolean {
-  const host = hostname.toLowerCase()
-  return ZOHO_ALLOWED_APEX_DOMAINS.some((apex) => host === apex || host.endsWith(`.${apex}`))
-}
-
-/**
- * Assert that a URL is a token-safe Zoho target: it must be `https:` and its host
- * must be a Zoho apex or subdomain. Returns the parsed URL, or throws (the caller
- * maps that to a 400) - used by every route that sends the OAuth token to a host
- * derived from user/LLM-influenced input.
- */
-export function assertZohoUrl(rawUrl: string): URL {
-  const url = new URL(rawUrl)
-  if (url.protocol !== 'https:' || !isZohoHost(url.hostname)) {
-    throw new Error('URL must be an https Zoho host')
-  }
-  return url
-}
-
 /**
  * Convert Zoho Desk rich-text HTML (comment / thread / ticket bodies) to
  * readable plain text. Mirrors the per-integration `html-to-text` configuration