Skip to content

Commit 903c94e

Browse files
waleedlatif1waleedlatif1
committed
fix(dataverse): strip the bearer token when a request redirects
The host allowlist added alongside the connector work only constrains the initial destination. `secureFetchWithPinnedIP` follows redirects and keeps the `Authorization` header unless a tool opts out, so a redirect away from an allowed Dataverse origin would forward the caller's OAuth token to whatever host answers. Dataverse redirects in normal operation — file downloads hand back a signed storage URL, and environment hosts move between regional origins — so this is reachable without a compromised environment URL. Sets `stripAuthOnRedirect` on all 18 Dataverse tools, matching the existing GitHub job-logs and Windchill precedent.
1 parent fba0f13 commit 903c94e

18 files changed

Lines changed: 108 additions & 0 deletions

‎apps/sim/tools/microsoft_dataverse/associate.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,12 @@ export const dataverseAssociateTool: ToolConfig<
8080
return `${baseUrl}/api/data/v9.2/${params.entitySetName.trim()}(${params.recordId.trim()})/${params.navigationProperty.trim()}/$ref`
8181
},
8282
method: (params) => (params.navigationType === 'single' ? 'PUT' : 'POST'),
83+
/**
84+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
85+
* and environment hosts redirect between regional origins), so drop the
86+
* bearer token rather than forward it to whatever origin answers.
87+
*/
88+
stripAuthOnRedirect: true,
8389
headers: (params) => ({
8490
Authorization: `Bearer ${params.accessToken}`,
8591
'Content-Type': 'application/json',

‎apps/sim/tools/microsoft_dataverse/create_multiple.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@ export const dataverseCreateMultipleTool: ToolConfig<
6262
return `${baseUrl}/api/data/v9.2/${params.entitySetName.trim()}/Microsoft.Dynamics.CRM.CreateMultiple`
6363
},
6464
method: 'POST',
65+
/**
66+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
67+
* and environment hosts redirect between regional origins), so drop the
68+
* bearer token rather than forward it to whatever origin answers.
69+
*/
70+
stripAuthOnRedirect: true,
6571
headers: (params) => ({
6672
Authorization: `Bearer ${params.accessToken}`,
6773
'Content-Type': 'application/json',

‎apps/sim/tools/microsoft_dataverse/create_record.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,12 @@ export const dataverseCreateRecordTool: ToolConfig<
5555
return `${baseUrl}/api/data/v9.2/${params.entitySetName.trim()}`
5656
},
5757
method: 'POST',
58+
/**
59+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
60+
* and environment hosts redirect between regional origins), so drop the
61+
* bearer token rather than forward it to whatever origin answers.
62+
*/
63+
stripAuthOnRedirect: true,
5864
headers: (params) => ({
5965
Authorization: `Bearer ${params.accessToken}`,
6066
'Content-Type': 'application/json',

‎apps/sim/tools/microsoft_dataverse/delete_record.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ export const dataverseDeleteRecordTool: ToolConfig<
5353
return `${baseUrl}/api/data/v9.2/${params.entitySetName.trim()}(${params.recordId.trim()})`
5454
},
5555
method: 'DELETE',
56+
/**
57+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
58+
* and environment hosts redirect between regional origins), so drop the
59+
* bearer token rather than forward it to whatever origin answers.
60+
*/
61+
stripAuthOnRedirect: true,
5662
headers: (params) => ({
5763
Authorization: `Bearer ${params.accessToken}`,
5864
'OData-MaxVersion': '4.0',

‎apps/sim/tools/microsoft_dataverse/disassociate.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,12 @@ export const dataverseDisassociateTool: ToolConfig<
7474
return `${baseUrl}/api/data/v9.2/${entitySetName}(${recordId})/${navigationProperty}/$ref`
7575
},
7676
method: 'DELETE',
77+
/**
78+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
79+
* and environment hosts redirect between regional origins), so drop the
80+
* bearer token rather than forward it to whatever origin answers.
81+
*/
82+
stripAuthOnRedirect: true,
7783
headers: (params) => ({
7884
Authorization: `Bearer ${params.accessToken}`,
7985
'OData-MaxVersion': '4.0',

‎apps/sim/tools/microsoft_dataverse/download_file.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,12 @@ export const dataverseDownloadFileTool: ToolConfig<
6060
return `${baseUrl}/api/data/v9.2/${params.entitySetName.trim()}(${params.recordId.trim()})/${params.fileColumn.trim()}/$value`
6161
},
6262
method: 'GET',
63+
/**
64+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
65+
* and environment hosts redirect between regional origins), so drop the
66+
* bearer token rather than forward it to whatever origin answers.
67+
*/
68+
stripAuthOnRedirect: true,
6369
headers: (params) => ({
6470
Authorization: `Bearer ${params.accessToken}`,
6571
'OData-MaxVersion': '4.0',

‎apps/sim/tools/microsoft_dataverse/execute_action.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ export const dataverseExecuteActionTool: ToolConfig<
7878
return `${baseUrl}/api/data/v9.2/${actionName}`
7979
},
8080
method: 'POST',
81+
/**
82+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
83+
* and environment hosts redirect between regional origins), so drop the
84+
* bearer token rather than forward it to whatever origin answers.
85+
*/
86+
stripAuthOnRedirect: true,
8187
headers: (params) => ({
8288
Authorization: `Bearer ${params.accessToken}`,
8389
'Content-Type': 'application/json',

‎apps/sim/tools/microsoft_dataverse/execute_function.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,12 @@ export const dataverseExecuteFunctionTool: ToolConfig<
8383
return `${baseUrl}/api/data/v9.2/${functionName}${paramStr}${querySuffix}`
8484
},
8585
method: 'GET',
86+
/**
87+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
88+
* and environment hosts redirect between regional origins), so drop the
89+
* bearer token rather than forward it to whatever origin answers.
90+
*/
91+
stripAuthOnRedirect: true,
8692
headers: (params) => ({
8793
Authorization: `Bearer ${params.accessToken}`,
8894
'OData-MaxVersion': '4.0',

‎apps/sim/tools/microsoft_dataverse/fetchxml_query.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,12 @@ export const dataverseFetchXmlQueryTool: ToolConfig<
5757
return `${baseUrl}/api/data/v9.2/${params.entitySetName.trim()}?fetchXml=${encodedFetchXml}`
5858
},
5959
method: 'GET',
60+
/**
61+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
62+
* and environment hosts redirect between regional origins), so drop the
63+
* bearer token rather than forward it to whatever origin answers.
64+
*/
65+
stripAuthOnRedirect: true,
6066
headers: (params) => ({
6167
Authorization: `Bearer ${params.accessToken}`,
6268
'OData-MaxVersion': '4.0',

‎apps/sim/tools/microsoft_dataverse/get_entity_metadata.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,12 @@ export const dataverseGetEntityMetadataTool: ToolConfig<
7676
return `${baseUrl}/api/data/v9.2/EntityDefinitions(LogicalName='${entityLogicalName}')${query}`
7777
},
7878
method: 'GET',
79+
/**
80+
* Dataverse endpoints redirect (file downloads issue a signed storage URL,
81+
* and environment hosts redirect between regional origins), so drop the
82+
* bearer token rather than forward it to whatever origin answers.
83+
*/
84+
stripAuthOnRedirect: true,
7985
headers: (params) => ({
8086
Authorization: `Bearer ${params.accessToken}`,
8187
'OData-MaxVersion': '4.0',

0 commit comments

Comments
 (0)