fix(security): strip a trailing FQDN dot from vendor-hosted URLs

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.test.ts

@@ -615,6 +615,12 @@ describe('validateServiceNowInstanceUrl (vendor-hosted allowlist)', () => {
     expect(result.sanitized).toBe('https://acme.servicenowservices.com/api/now')
   })
 
+  it.concurrent('drops a trailing FQDN dot, which TLS hostname verification rejects', () => {
+    const result = validateServiceNowInstanceUrl('https://acme.service-now.com./api/now')
+    expect(result.isValid).toBe(true)
+    expect(result.sanitized).toBe('https://acme.service-now.com/api/now')
+  })
+
   it.concurrent.each([
     ['https://support.acme.com', 'vanity CNAME'],
     ['https://acme.service-now.com.evil.com', 'lookalike suffix'],

apps/sim/lib/core/security/input-validation.ts

@@ -1167,8 +1167,10 @@ function validateVendorHostedUrl(
   if (!urlResult.isValid) return urlResult
 
   const parsed = new URL(candidate)
-  // A fully qualified name's trailing dot names the same host.
-  const hostname = parsed.hostname.toLowerCase().replace(/\.$/, '')
+  // A trailing FQDN dot names the same host, but TLS hostname verification rejects it.
+  const fullyQualified = parsed.hostname.endsWith('.')
+  if (fullyQualified) parsed.hostname = parsed.hostname.slice(0, -1)
+  const hostname = parsed.hostname.toLowerCase()
   const allowed = suffixes.some(
     (suffix) => (allowBareSuffix && hostname === suffix.slice(1)) || hostname.endsWith(suffix)
   )
@@ -1186,7 +1188,8 @@ function validateVendorHostedUrl(
     }
   }
 
-  return { isValid: true, sanitized: sanitize === 'origin' ? parsed.origin : candidate }
+  if (sanitize === 'origin') return { isValid: true, sanitized: parsed.origin }
+  return { isValid: true, sanitized: fullyQualified ? parsed.href : candidate }
 }
 
 /**

apps/sim/tools/databricks/databricks.test.ts

@@ -84,7 +84,6 @@ describe('databricks workspace host allowlist', () => {
     ['adb-123.4.databricks.azure.cn', 'https://adb-123.4.databricks.azure.cn'],
     ['dbc-a1b2.cloud.databricks.mil', 'https://dbc-a1b2.cloud.databricks.mil'],
     ['https://acme.databricks.com/', 'https://acme.databricks.com'],
-    ['dbc-a1b2.cloud.databricks.com.', 'https://dbc-a1b2.cloud.databricks.com.'],
   ])('builds the same request URLs for workspace host %s', (host, origin) => {
     const params = { ...REQUEST_PARAMS, host }
     expect(urlBuilder('databricks_list_clusters')(params)).toBe(`${origin}/api/2.0/clusters/list`)
@@ -97,4 +96,16 @@ describe('databricks workspace host allowlist', () => {
       `${origin}/api/2.0/genie/spaces/space1/conversations/conv1/messages/msg1`
     )
   })
+
+  it.each([
+    ['dbc-a1b2.cloud.databricks.com.', 'https://dbc-a1b2.cloud.databricks.com'],
+    ['https://dbc-a1b2.cloud.databricks.com.:8443/', 'https://dbc-a1b2.cloud.databricks.com:8443'],
+  ])(
+    'drops the trailing FQDN dot of %s, which the old tools kept and Bun TLS rejects',
+    (host, origin) => {
+      expect(urlBuilder('databricks_list_clusters')({ ...REQUEST_PARAMS, host })).toBe(
+        `${origin}/api/2.0/clusters/list`
+      )
+    }
+  )
 })