fix(changelog): harden feed rendering and media validation

Author: waleedlatif1

apps/sim/app/changelog.xml/route.ts

@@ -3,8 +3,8 @@ import { getAllEntryMeta } from '@/lib/changelog'
 import { SITE_URL } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
-export const dynamic = 'force-static'
-export const revalidate = 3600
+/** Request-scoped logging needs dynamic handling; successful feeds are cached by the CDN. */
+export const dynamic = 'force-dynamic'
 
 function escapeXml(value: string): string {
   return value
@@ -16,31 +16,40 @@ function escapeXml(value: string): string {
 }
 
 /** RSS is a public XML protocol; its summaries share the website's published content source. */
-export const GET = withRouteHandler(async () => {
-  const entries = (await getAllEntryMeta()).slice(0, 50)
-  const items = entries
-    .map(
-      (entry) => `
+export const GET = withRouteHandler(
+  async () => {
+    const entries = (await getAllEntryMeta()).slice(0, 50)
+    const items = entries
+      .map(
+        (entry) => `
     <item>
       <title>${escapeXml(entry.title)}</title>
       <link>${escapeXml(entry.canonical)}</link>
       <guid isPermaLink="true">${escapeXml(entry.release?.url ?? entry.canonical)}</guid>
       <pubDate>${new Date(entry.date).toUTCString()}</pubDate>
       <description>${escapeXml(entry.description)}</description>
     </item>`
-    )
-    .join('')
-  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+      )
+      .join('')
+    const xml = `<?xml version="1.0" encoding="UTF-8"?>
 <rss version="2.0"><channel>
   <title>Sim Changelog</title>
   <link>${SITE_URL}/changelog</link>
   <description>New features, improvements, and fixes in Sim.</description>
   <language>en-us</language>${items}
 </channel></rss>`
-  return new NextResponse(xml, {
-    headers: {
-      'Content-Type': 'application/rss+xml; charset=utf-8',
-      'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=3600',
-    },
-  })
-})
+    return new NextResponse(xml, {
+      headers: {
+        'Content-Type': 'application/rss+xml; charset=utf-8',
+        'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=3600',
+      },
+    })
+  },
+  {
+    unhandledErrorResponse: () =>
+      new NextResponse('Service Unavailable', {
+        status: 503,
+        headers: { 'Cache-Control': 'no-store', 'Retry-After': '60' },
+      }),
+  }
+)

apps/sim/content/changelog/power-bi-for-agents/index.mdx

@@ -17,7 +17,7 @@ Add [Power BI](/integrations/power-bi) to a workflow to bring business data into
 
 The integration includes eight actions for finding workspaces, reading reports and semantic models, running queries, requesting refreshes, and checking refresh history. A refresh request starts the work; use the history action to check its progress.
 
-For example, summarize weekly revenue by region and use those results to prepare a sales update. The sample below shows query configuration; connect your Power BI account and choose a model before running it.
+For example, summarize revenue by region and use those results to prepare a weekly sales update. The sample below shows query configuration; connect your Power BI account and choose a model before running it.
 
 <ChangelogImage
   src="/changelog/power-bi-query-v1.jpg"

apps/sim/lib/changelog/media.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest'
+import { isChangelogMediaSource } from '@/lib/changelog/media'
+
+describe('changelog media origins', () => {
+  it.each([
+    { kind: 'tab padding', source: '/\t/example.test/demo.mp4' },
+    { kind: 'newline padding', source: '/\n//example.test/demo.mp4' },
+    { kind: 'carriage-return padding', source: '/\r/example.test/demo.mp4' },
+    { kind: 'backslash separators', source: '/\\example.test/demo.mp4' },
+  ])('rejects $kind that browsers resolve to another origin', ({ source }) => {
+    expect(new URL(source, 'https://www.sim.ai').origin).toBe('https://example.test')
+    expect(isChangelogMediaSource(source)).toBe(false)
+  })
+})

apps/sim/lib/changelog/media.ts

@@ -3,7 +3,7 @@ export const CHANGELOG_MEDIA_ORIGIN = 'https://nnjgp7vypgx4myuq.public.blob.verc
 
 /** Shared by rendering and content validation; CSP imports this leaf before aliases resolve. */
 export function isChangelogMediaSource(source: string): boolean {
-  if (typeof source !== 'string') return false
+  if (typeof source !== 'string' || /[\r\n\t\\]/.test(source)) return false
   if (source.startsWith('/') && !source.startsWith('//')) return true
   try {
     const url = new URL(source)

scripts/check-library-content.ts

@@ -270,11 +270,11 @@ function checkChangelogBody(
       )
     const asset = (field: string, localOnly: boolean) => {
       const value = literal(field)
-      if (!localOnly && value && !value.startsWith('/') && isChangelogMediaSource(value)) return
-      if (!value?.startsWith('/') || value.startsWith('//')) {
+      if (!value || !isChangelogMediaSource(value) || (localOnly && !value.startsWith('/'))) {
         fail(field, 'must be a literal same-origin path or approved media CDN URL')
         return
       }
+      if (!value.startsWith('/')) return
       const target = path.resolve(config.publicDir, `.${value}`)
       const relative = path.relative(config.publicDir, target)
       if (relative.startsWith('..') || path.isAbsolute(relative)) {