fix(elasticsearch): reject a malformed parent-domain port in a Cloud ID

Author: waleedlatif1

apps/sim/tools/elasticsearch/utils.test.ts

@@ -62,6 +62,23 @@ describe('parseCloudId', () => {
     expect(() => parseCloudId(hostile)).toThrow(/Invalid Cloud ID/)
   })
 
+  it('rejects a malformed parent-domain port even when the service port is valid', () => {
+    const hostile = cloudId(`${PARENT_DOMAIN}:abc$${ES_UUID}:9243$${KIBANA_UUID}`)
+    expect(() => parseCloudId(hostile)).toThrow(/Invalid Cloud ID/)
+  })
+
+  /**
+   * `extractPortFromName` splits at the last colon, so a second colon survives
+   * in the *name* half, where the `#@?/\` reject set does not catch it. Left
+   * unchecked this builds `https://<uuid>.<host>:<port>:<port>`, which throws a
+   * bare `TypeError: Invalid URL` inside the transport instead of naming the
+   * real problem.
+   */
+  it('rejects a second colon in the parent domain rather than building an invalid authority', () => {
+    const hostile = cloudId(`${PARENT_DOMAIN}:9243:evil@x$${ES_UUID}:9243$${KIBANA_UUID}`)
+    expect(() => parseCloudId(hostile)).toThrow(/Invalid Cloud ID/)
+  })
+
   it('rejects a payload with fewer than three $-separated components', () => {
     expect(() => parseCloudId(cloudId(`${PARENT_DOMAIN}$${ES_UUID}`))).toThrow(/Invalid Cloud ID/)
   })

apps/sim/tools/elasticsearch/utils.ts

@@ -13,6 +13,10 @@ const DEFAULT_CLOUD_PORT = '443'
  * Mirrors the `strings.IndexAny(component, "#@?/")` reject set in Beats, plus
  * `\`, which the WHATWG URL parser treats as a path separator for special
  * schemes and which therefore truncates the authority exactly as `/` does.
+ *
+ * A `:` is deliberately absent — `extractPortFromName` has already split each
+ * component at its last colon, so a surviving colon means a second one, which
+ * the all-digits port check below rejects.
  */
 const CLOUD_ID_REJECTED_CHARACTERS = /[#@?/\\]/
 
@@ -59,8 +63,10 @@ export function parseCloudId(cloudId: string): string {
     }
   }
 
-  if (!/^\d+$/.test(elasticsearch.port)) {
-    throw new Error('Invalid Cloud ID format')
+  for (const port of [parentDomain.port, elasticsearch.port]) {
+    if (!/^\d+$/.test(port)) {
+      throw new Error('Invalid Cloud ID format')
+    }
   }
 
   const host = `${elasticsearch.name}.${parentDomain.name}`