fix(quickbooks): stop cancelled attachment downloads

Author: Bill Leoutsakos

apps/sim/app/api/tools/quickbooks/documents.test.ts

@@ -553,6 +553,27 @@ describe('QuickBooks document API routes', () => {
     expect(mockUploadCopilotFile).not.toHaveBeenCalled()
   })
 
+  it('does not begin the pinned attachment fetch when cancellation arrives during DNS validation', async () => {
+    const controller = new AbortController()
+    const request = createAbortableRequest({ ...auth, attachmentId: '15' }, controller.signal)
+    mockFetch.mockResolvedValueOnce(new Response('https://intuit-download.example/receipt.pdf'))
+    mockValidateUrlWithDNS.mockImplementationOnce(async () => {
+      controller.abort()
+      return {
+        isValid: true,
+        resolvedIP: '203.0.113.8',
+        originalHostname: 'intuit-download.example',
+      }
+    })
+
+    const response = await downloadAttachment(request)
+
+    expect(response.status).toBe(500)
+    expect(mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+    expect(mockUploadExecutionFile).not.toHaveBeenCalled()
+    expect(mockUploadCopilotFile).not.toHaveBeenCalled()
+  })
+
   it('does not begin an attachment mutation when cancellation arrives after file loading', async () => {
     const controller = new AbortController()
     const request = createAbortableRequest(

apps/sim/app/api/tools/quickbooks/download-attachment/route.ts

@@ -90,6 +90,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const validation = await validateUrlWithDNS(temporaryUrl, 'QuickBooks attachment URL')
     if (!validation.isValid || !validation.resolvedIP)
       throw new Error(validation.error || 'QuickBooks attachment URL is invalid')
+    request.signal.throwIfAborted()
 
     const downloadResponse = await secureFetchWithPinnedIP(temporaryUrl, validation.resolvedIP, {
       method: 'GET',

apps/sim/lib/core/security/input-validation.server.ts

@@ -966,6 +966,7 @@ export async function secureFetchWithPinnedIP(
   options: SecureFetchOptions & { allowHttp?: boolean } = {},
   redirectCount = 0
 ): Promise<SecureFetchResponse> {
+  options.signal?.throwIfAborted()
   const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS
   const requestedMaxResponseBytes = options.maxResponseBytes
   const maxResponseBytes =
@@ -1014,6 +1015,7 @@ export async function secureFetchWithPinnedIP(
 
         validateUrlWithDNS(redirectUrl, 'redirectUrl', { allowHttp: options.allowHttp })
           .then((validation) => {
+            options.signal?.throwIfAborted()
             if (!validation.isValid) {
               settledReject(new Error(`Redirect blocked: ${validation.error}`))
               return

apps/sim/lib/core/security/secure-fetch-response-cap.server.test.ts

@@ -16,15 +16,18 @@ vi.mock('@/lib/core/config/env-flags', () => ({
   getProxyUrl: () => undefined,
 }))
 
+import { resolveHostAddresses } from '@sim/security/dns'
 import {
   DEFAULT_MAX_RESPONSE_BYTES,
   secureFetchWithPinnedIP,
 } from '@/lib/core/security/input-validation.server'
 
 const servers: http.Server[] = []
+const mockResolveHostAddresses = vi.mocked(resolveHostAddresses)
 
 afterEach(() => {
   for (const server of servers.splice(0)) server.close()
+  vi.clearAllMocks()
 })
 
 /** Starts a throwaway loopback server and returns its origin. */
@@ -36,6 +39,49 @@ async function startServer(handler: http.RequestListener): Promise<string> {
 }
 
 describe('secureFetchWithPinnedIP response cap', () => {
+  it('does not open a request when the signal is already aborted', async () => {
+    let requests = 0
+    const origin = await startServer((_req, res) => {
+      requests += 1
+      res.end('unexpected')
+    })
+    const controller = new AbortController()
+    controller.abort(new Error('cancelled'))
+
+    await expect(
+      secureFetchWithPinnedIP(origin, '127.0.0.1', {
+        allowHttp: true,
+        signal: controller.signal,
+      })
+    ).rejects.toThrow('cancelled')
+    expect(requests).toBe(0)
+  })
+
+  it('does not follow a redirect when cancellation arrives during redirect DNS validation', async () => {
+    let targetRequests = 0
+    const targetOrigin = await startServer((_req, res) => {
+      targetRequests += 1
+      res.end('unexpected')
+    })
+    const redirectOrigin = await startServer((_req, res) => {
+      res.writeHead(302, { Location: targetOrigin.replace('127.0.0.1', 'localhost') })
+      res.end()
+    })
+    const controller = new AbortController()
+    mockResolveHostAddresses.mockImplementationOnce(async () => {
+      controller.abort(new Error('cancelled during redirect DNS'))
+      return { addresses: ['127.0.0.1'], preferred: '127.0.0.1' }
+    })
+
+    await expect(
+      secureFetchWithPinnedIP(redirectOrigin, '127.0.0.1', {
+        allowHttp: true,
+        signal: controller.signal,
+      })
+    ).rejects.toThrow('cancelled during redirect DNS')
+    expect(targetRequests).toBe(0)
+  })
+
   it('rejects a body that exceeds an explicit cap instead of buffering it', async () => {
     const origin = await startServer((_req, res) => {
       res.writeHead(200, { 'Content-Type': 'application/octet-stream' })