fix(elasticsearch): reject a surviving colon in a decoded Cloud ID component

Author: waleedlatif1

apps/sim/tools/elasticsearch/utils.test.ts

@@ -69,12 +69,33 @@ describe('parseCloudId', () => {
 
   /**
    * `extractPortFromName` splits at the last colon, so a second colon survives
-   * in the *name* half, where the `#@?/\` reject set does not catch it. Left
-   * unchecked this builds `https://<uuid>.<host>:<port>:<port>`, which throws a
-   * bare `TypeError: Invalid URL` inside the transport instead of naming the
-   * real problem.
+   * in the *name* half. Both halves are numeric here on purpose: the all-digits
+   * port check passes, so only the reject set can catch it. Left unchecked this
+   * assembles `https://<uuid>.<host>:9243:5`, which surfaces as a bare
+   * `TypeError: Invalid URL` inside the transport instead of naming the real
+   * problem.
    */
-  it('rejects a second colon in the parent domain rather than building an invalid authority', () => {
+  it('rejects a second colon in the parent domain when both halves are numeric', () => {
+    const hostile = cloudId(`${PARENT_DOMAIN}:9243:5$${ES_UUID}$${KIBANA_UUID}`)
+    expect(() => parseCloudId(hostile)).toThrow(/Invalid Cloud ID/)
+  })
+
+  it('rejects a second colon in the parent domain when the service port is explicit', () => {
+    const hostile = cloudId(`${PARENT_DOMAIN}:9243:5$${ES_UUID}:9200$${KIBANA_UUID}`)
+    expect(() => parseCloudId(hostile)).toThrow(/Invalid Cloud ID/)
+  })
+
+  it('rejects a second colon in the Elasticsearch component', () => {
+    const hostile = cloudId(`${PARENT_DOMAIN}$${ES_UUID}:9243:5$${KIBANA_UUID}`)
+    expect(() => parseCloudId(hostile)).toThrow(/Invalid Cloud ID/)
+  })
+
+  /**
+   * Distinct from the cases above: here the trailing half is non-numeric, so
+   * the all-digits port check rejects it before the reject set is reached.
+   * Kept separate so neither check can silently stop carrying its own case.
+   */
+  it('rejects a second colon whose trailing half is not a port', () => {
     const hostile = cloudId(`${PARENT_DOMAIN}:9243:evil@x$${ES_UUID}:9243$${KIBANA_UUID}`)
     expect(() => parseCloudId(hostile)).toThrow(/Invalid Cloud ID/)
   })

apps/sim/tools/elasticsearch/utils.ts

@@ -7,18 +7,23 @@ import type { ElasticsearchBaseParams } from '@/tools/elasticsearch/types'
 const DEFAULT_CLOUD_PORT = '443'
 
 /**
- * Characters that must not appear in a decoded Cloud ID component. An `@` would
- * turn the rest of the authority into a host and send the credential headers to
- * an attacker-controlled origin; `#`, `?` and `/` truncate the authority.
- * Mirrors the `strings.IndexAny(component, "#@?/")` reject set in Beats, plus
- * `\`, which the WHATWG URL parser treats as a path separator for special
- * schemes and which therefore truncates the authority exactly as `/` does.
+ * Characters that must not appear in a decoded Cloud ID component name. An `@`
+ * would turn the rest of the authority into a host and send the credential
+ * headers to an attacker-controlled origin; `#`, `?` and `/` truncate the
+ * authority. Mirrors the `strings.IndexAny(component, "#@?/")` reject set in
+ * Beats, plus two additions:
  *
- * A `:` is deliberately absent — `extractPortFromName` has already split each
- * component at its last colon, so a surviving colon means a second one, which
- * the all-digits port check below rejects.
+ * - `\`, which the WHATWG URL parser treats as a path separator for special
+ *   schemes and which therefore truncates the authority exactly as `/` does.
+ * - `:`, because `extractPortFromName` has already split the component at its
+ *   last colon, so a colon surviving in the *name* half means the component
+ *   carried two. The all-digits port check below does not catch that when the
+ *   trailing half is numeric: `found.io:9243:5` yields name `found.io:9243`
+ *   and port `5`, which assembles `https://<uuid>.found.io:9243:5` and fails
+ *   as a bare `TypeError: Invalid URL` inside the transport. A hostname cannot
+ *   contain a colon, so rejecting it here cannot refuse a legitimate ID.
  */
-const CLOUD_ID_REJECTED_CHARACTERS = /[#@?/\\]/
+const CLOUD_ID_REJECTED_CHARACTERS = /[#@?/\\:]/
 
 /**
  * Splits a Cloud ID component of the form `name:port` at its last colon.