mirror of
https://github.com/simstudioai/sim.git
synced 2026-04-06 03:00:16 -04:00
ff2a1527ab
* fix(security): add SSRF protection to database tools and webhook delivery * fix(security): address review comments on SSRF PR - Remove Promise.race timeout pattern to avoid unhandled rejections (http.request timeout is sufficient for webhook delivery) - Use safeCompare in verifyCronAuth instead of inline HMAC logic - Strip IPv6 brackets before validateDatabaseHost in Redis route * fix(security): allow HTTP webhooks and fix misleading MCP error docs - Add allowHttp option to validateExternalUrl, validateUrlWithDNS, and secureFetchWithValidation to support HTTP webhook URLs - Pass allowHttp: true for webhook delivery and test endpoints - Fix misleading JSDoc on createMcpErrorResponse (doesn't log errors) - Mark unused error param with underscore prefix * fix(security): forward allowHttp option through redirect validation Pass allowHttp to validateUrlWithDNS in the redirect handler of secureFetchWithPinnedIP so HTTP-to-HTTP redirects work when allowHttp is enabled for webhook delivery. * fix(security): block localhost when allowHttp is enabled When allowHttp is true (user-supplied webhook URLs), explicitly block localhost/loopback in both validateExternalUrl and validateUrlWithDNS to prevent SSRF against internal services. * fix(security): always strip multi-line content in sanitizeConnectionError Take the first line of the error message regardless of length to prevent leaking sensitive data from multi-line error messages.
85 lines
2.3 KiB
TypeScript
85 lines
2.3 KiB
TypeScript
import type { Task } from '@a2a-js/sdk'
|
|
import { createLogger } from '@sim/logger'
|
|
import { type NextRequest, NextResponse } from 'next/server'
|
|
import { z } from 'zod'
|
|
import { createA2AClient } from '@/lib/a2a/utils'
|
|
import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
|
|
import { generateRequestId } from '@/lib/core/utils/request'
|
|
|
|
const logger = createLogger('A2ACancelTaskAPI')
|
|
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
const A2ACancelTaskSchema = z.object({
|
|
agentUrl: z.string().min(1, 'Agent URL is required'),
|
|
taskId: z.string().min(1, 'Task ID is required'),
|
|
apiKey: z.string().optional(),
|
|
})
|
|
|
|
export async function POST(request: NextRequest) {
|
|
const requestId = generateRequestId()
|
|
|
|
try {
|
|
const authResult = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
|
|
|
|
if (!authResult.success) {
|
|
logger.warn(`[${requestId}] Unauthorized A2A cancel task attempt`)
|
|
return NextResponse.json(
|
|
{
|
|
success: false,
|
|
error: authResult.error || 'Authentication required',
|
|
},
|
|
{ status: 401 }
|
|
)
|
|
}
|
|
|
|
const body = await request.json()
|
|
const validatedData = A2ACancelTaskSchema.parse(body)
|
|
|
|
logger.info(`[${requestId}] Canceling A2A task`, {
|
|
agentUrl: validatedData.agentUrl,
|
|
taskId: validatedData.taskId,
|
|
})
|
|
|
|
const client = await createA2AClient(validatedData.agentUrl, validatedData.apiKey)
|
|
|
|
const task = (await client.cancelTask({ id: validatedData.taskId })) as Task
|
|
|
|
logger.info(`[${requestId}] Successfully canceled A2A task`, {
|
|
taskId: validatedData.taskId,
|
|
state: task.status.state,
|
|
})
|
|
|
|
return NextResponse.json({
|
|
success: true,
|
|
output: {
|
|
cancelled: true,
|
|
state: task.status.state,
|
|
},
|
|
})
|
|
} catch (error) {
|
|
if (error instanceof z.ZodError) {
|
|
logger.warn(`[${requestId}] Invalid A2A cancel task request`, {
|
|
errors: error.errors,
|
|
})
|
|
return NextResponse.json(
|
|
{
|
|
success: false,
|
|
error: 'Invalid request data',
|
|
details: error.errors,
|
|
},
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
logger.error(`[${requestId}] Error canceling A2A task:`, error)
|
|
return NextResponse.json(
|
|
{
|
|
success: false,
|
|
error: 'Failed to cancel task',
|
|
},
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
}
|