feat(slack): add file attachment support to slack webhook trigger

[waleedlatif1]

Summary

• Added file download support to Slack webhook trigger, matching Gmail's attachment pattern
• Slack events now extract event.files metadata and optionally download file content
• Added botToken and includeFiles fields to trigger config for authenticated file downloads
• Files flow through WebhookAttachmentProcessor pipeline → UserFile[] objects available to downstream blocks
• Security: host allowlist (files.slack.com), DNS validation, IP pinning, 50MB/file and 10 file limits

Type of Change

• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Feb 6, 2026 8:24am

[greptile-apps]

Greptile Overview

Greptile Summary

Added file attachment support to Slack webhook trigger, matching the established pattern from Gmail trigger. Slack events now extract event.files metadata and optionally download file content using the bot token with files:read scope.

Key changes:

• Added botToken and includeFiles configuration fields to the Slack trigger
• Implemented downloadSlackFiles() function with SSRF protection (host allowlist, DNS validation, IP pinning)
• Files flow through WebhookAttachmentProcessor pipeline to become UserFile[] objects for downstream blocks
• Enhanced processTriggerFileOutputs() to handle explicit object schemas with type: 'object' and properties
• Security limits: 50MB per file, max 10 files per event

Issues found:

• Type mismatch in downloadSlackFiles: returns data: string (base64) but WebhookAttachment expects data: Buffer - works at runtime but bypasses TypeScript safety

Confidence Score: 4/5

• Safe to merge with one type safety fix needed
• The implementation follows established patterns from Gmail trigger, includes comprehensive security validations (SSRF protection, size limits, host allowlist), and handles edge cases properly. One type mismatch needs correction (base64 string vs Buffer), but it won't cause runtime errors since the upload function handles both formats.
• apps/sim/lib/webhooks/utils.server.ts - fix the type mismatch on line 620-625 where data should be Buffer not base64 string

Important Files Changed

Filename	Overview
apps/sim/background/webhook-execution.ts	Added support for processing file outputs from triggers with explicit object schemas (type='object' with properties), and fallback logic to resolve trigger IDs from block configuration
apps/sim/lib/webhooks/utils.server.ts	Added downloadSlackFiles function with security validations, and updated formatWebhookInput to extract and optionally download Slack file attachments
apps/sim/triggers/slack/webhook.ts	Added botToken and includeFiles configuration fields, updated setup instructions, and added hasFiles and files to the event output schema

Sequence Diagram

sequenceDiagram
    participant Slack as Slack API
    participant Webhook as Webhook Handler
    participant Utils as formatWebhookInput
    participant Download as downloadSlackFiles
    participant Security as validateUrlWithDNS
    participant Fetch as secureFetchWithPinnedIP
    participant Processor as processTriggerFileOutputs
    participant Attachment as WebhookAttachmentProcessor
    participant Storage as uploadFileFromRawData
    participant Workflow as Workflow Execution

    Slack->>Webhook: POST /webhook (event with files)
    Webhook->>Utils: formatWebhookInput(webhook, workflow, body)
    
    alt Has files && includeFiles && botToken
        Utils->>Download: downloadSlackFiles(rawFiles, botToken)
        
        loop For each file (max 10)
            Download->>Download: Validate file.url_private host
            Download->>Download: Check file size <= 50MB
            Download->>Security: validateUrlWithDNS(url_private)
            Security-->>Download: resolvedIP
            Download->>Fetch: secureFetchWithPinnedIP(url, resolvedIP, botToken)
            Fetch-->>Download: file arrayBuffer
            Download->>Download: Verify downloaded size
            Download->>Download: Convert to base64 string
        end
        
        Download-->>Utils: files array [{name, data: base64, mimeType, size}]
    end
    
    Utils-->>Webhook: {event: {files, hasFiles, ...}}
    Webhook->>Processor: processTriggerFileOutputs(input, outputSchema)
    
    Processor->>Processor: Detect outputs.event.properties.files (type: file[])
    Processor->>Attachment: processAttachments(files)
    
    loop For each file
        Attachment->>Storage: uploadFileFromRawData({name, data, mimeType})
        Storage->>Storage: Convert base64 to Buffer
        Storage->>Storage: Upload to execution storage
        Storage-->>Attachment: UserFile
    end
    
    Attachment-->>Processor: UserFile[]
    Processor-->>Webhook: Processed trigger input
    Webhook->>Workflow: Execute with file attachments as UserFile[]

Loading

[greptile-apps]

_{2 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[greptile-apps]

_{3 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR