fix(oracle-epm): harden guarded foundation

BillLeoutsakosvl346 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
commit 7ba3213c9fb042fdb4f9be2e26a845df73600d01
diff --git a/apps/sim/lib/credentials/orchestration/index.test.ts b/apps/sim/lib/credentials/orchestration/index.test.ts
@@ -286,6 +286,9 @@ describe('performUpdateCredential — service-account secret rotation', () => {
   it('carries the stored dataCenter forward for a client-credential reconnect', async () => {
     mockCredential({ providerId: 'zoho-desk-service-account', displayName: 'Acme Desk' })
     mockIsClientCredentialAccountProviderId.mockReturnValue(true)
+    mockGetClientCredentialAccountDescriptor.mockReturnValue({
+      fields: [{ id: 'dataCenter' }],
+    } as never)
     mockStoredBlob({ type: 'client_credential_account', dataCenter: 'eu' })
     mockVerifyAndBuildServiceAccountSecret.mockResolvedValue({
       providerId: 'zoho-desk-service-account',
@@ -331,6 +334,7 @@ describe('performUpdateCredential — service-account secret rotation', () => {
     mockIsClientCredentialAccountProviderId.mockReturnValue(true)
     mockGetClientCredentialAccountDescriptor.mockReturnValue({
       defaultAuthMethod: 'client_credentials',
+      fields: [],
     } as never)
     mockStoredBlob({
       type: 'client_credential_account',
@@ -420,6 +424,10 @@ describe('performUpdateCredential — service-account secret rotation', () => {
       displayName: 'Production EPM',
     })
     mockIsClientCredentialAccountProviderId.mockReturnValue(true)
+    mockGetClientCredentialAccountDescriptor.mockReturnValue({
+      fields: [{ id: 'orgId' }, { id: 'clientId' }, { id: 'clientSecret' }],
+    } as never)
+    mockStoredBlob({ type: 'client_credential_account' })
     mockVerifyAndBuildServiceAccountSecret.mockResolvedValue({
       providerId: 'oracle-epm-service-account',
       encryptedServiceAccountKey: 'new-cipher',

diff --git a/apps/sim/lib/credentials/orchestration/index.ts b/apps/sim/lib/credentials/orchestration/index.ts
@@ -292,12 +292,16 @@ export async function updateCredentialRecord(
       // credential back to the US accounts server. Carry the stored value forward
       // when the caller did not supply one.
       const isClientCredentialProvider = isClientCredentialAccountProviderId(providerId)
-      const needsStoredDataCenter = params.dataCenter === undefined && isClientCredentialProvider
+      const clientCredentialDescriptor = isClientCredentialProvider
+        ? getClientCredentialAccountDescriptor(providerId)
+        : undefined
+      const storesDataCenter = Boolean(
+        clientCredentialDescriptor?.fields.some((field) => field.id === 'dataCenter')
+      )
+      const needsStoredDataCenter = params.dataCenter === undefined && storesDataCenter
       // Only a multi-grant provider stores these, so single-grant ones must not
       // pay for a row read + decrypt that can only ever return undefined.
-      const isMultiGrantProvider = Boolean(
-        getClientCredentialAccountDescriptor(providerId)?.defaultAuthMethod
-      )
+      const isMultiGrantProvider = Boolean(clientCredentialDescriptor?.defaultAuthMethod)
       const needsStoredAuthMethod = params.authMethod === undefined && isMultiGrantProvider
       const needsStoredUsername = params.username === undefined && isMultiGrantProvider
 

diff --git a/apps/sim/lib/internal/oracle-epm/client.server.test.ts b/apps/sim/lib/internal/oracle-epm/client.server.test.ts
@@ -135,6 +135,17 @@ describe('Oracle EPM guarded client', () => {
     expect(mockSecureFetch.mock.calls[0][0]).toContain('%252e%252e%252fadmin')
   })
 
+  it('rejects malformed UTF-16 path input before URL encoding', async () => {
+    const client = createOracleEpmClient({
+      instanceUrl: 'https://epm.example.com',
+      accessToken: Buffer.from('u:p').toString('base64'),
+    })
+    await expect(client.request(getJob, { pathParams: { jobId: '\uD800' } })).rejects.toMatchObject(
+      { category: 'invalid_input' }
+    )
+    expect(mockValidateUrl).not.toHaveBeenCalled()
+  })
+
   it('suppresses arbitrary provider bodies in failed requests', async () => {
     mockSecureFetch.mockResolvedValue(
       secureResponse({
@@ -200,6 +211,39 @@ describe('Oracle EPM guarded client', () => {
     expect(mockSecureFetch).not.toHaveBeenCalled()
   })
 
+  it('rejects accessors and inherited JSON serializers without invoking them', async () => {
+    const endpoint = routes.defineEndpoint({
+      method: 'POST',
+      version: 'v3',
+      path: [oracleEpmLiteral('jobs')],
+      body: 'json',
+      maxRequestBytes: 1_024,
+      response: 'json',
+      timeoutMs: 2_000,
+      maxResponseBytes: 1_024,
+    })
+    const inheritedSerializer = vi.fn(() => ({ changed: true }))
+    const inherited = Object.create({ toJSON: inheritedSerializer }) as Record<string, unknown>
+    inherited.value = 'safe'
+    const getter = vi.fn(() => 'secret')
+    const accessor = {}
+    Object.defineProperty(accessor, 'value', { enumerable: true, get: getter })
+    const client = createOracleEpmClient({
+      instanceUrl: 'https://epm.example.com',
+      accessToken: Buffer.from('u:p').toString('base64'),
+    })
+
+    await expect(client.request(endpoint, { json: inherited })).rejects.toMatchObject({
+      category: 'invalid_input',
+    })
+    await expect(client.request(endpoint, { json: accessor })).rejects.toMatchObject({
+      category: 'invalid_input',
+    })
+    expect(inheritedSerializer).not.toHaveBeenCalled()
+    expect(getter).not.toHaveBeenCalled()
+    expect(mockValidateUrl).not.toHaveBeenCalled()
+  })
+
   it('propagates caller aborts before opening a pinned request', async () => {
     const controller = new AbortController()
     controller.abort(new DOMException('user', 'AbortError'))

diff --git a/apps/sim/lib/internal/oracle-epm/client.server.ts b/apps/sim/lib/internal/oracle-epm/client.server.ts
@@ -36,6 +36,7 @@ import type {
 } from '@/lib/internal/oracle-epm/types'
 
 const SAFE_TOKEN = /^[A-Za-z0-9+/]+={0,2}$/
+const LONE_SURROGATE = /[\uD800-\uDFFF]/
 const validatedLinks = new WeakMap<
   object,
   { owner: object; url: string; policy: OracleEpmReturnedLinkPolicyDefinition }
@@ -63,6 +64,7 @@ function validatePathValue(
     value === '.' ||
     value === '..' ||
     /[/\\\u0000-\u001f\u007f]/.test(value) ||
+    LONE_SURROGATE.test(value) ||
     Buffer.byteLength(value, 'utf8') > declaration.maxBytes ||
     (declaration.pattern && !declaration.pattern.test(value))
   ) {
@@ -91,6 +93,7 @@ function serializeQueryValue(value: unknown, declaration: OracleEpmQueryParamete
   if (declaration.kind === 'string') {
     if (
       typeof value !== 'string' ||
+      LONE_SURROGATE.test(value) ||
       Buffer.byteLength(value, 'utf8') > declaration.maxBytes ||
       (declaration.pattern && !declaration.pattern.test(value))
     )
@@ -149,6 +152,7 @@ function buildHeaders(
     }
     if (
       /\r|\n|\u0000/.test(value) ||
+      LONE_SURROGATE.test(value) ||
       Buffer.byteLength(value, 'utf8') > declaration.maxBytes ||
       (declaration.pattern && !declaration.pattern.test(value))
     )
@@ -161,6 +165,77 @@ function buildHeaders(
   return headers
 }
 
+type JsonData = null | boolean | number | string | JsonData[] | { [key: string]: JsonData }
+
+function hasPrototypeToJson(value: object): boolean {
+  let prototype = Object.getPrototypeOf(value)
+  while (prototype) {
+    if (Object.getOwnPropertyDescriptor(prototype, 'toJSON')) return true
+    prototype = Object.getPrototypeOf(prototype)
+  }
+  return false
+}
+
+/** Copies only ordinary JSON data without invoking accessors or custom serializers. */
+function cloneJsonData(value: unknown, ancestors = new WeakSet<object>()): JsonData {
+  if (
+    value === null ||
+    typeof value === 'string' ||
+    typeof value === 'boolean' ||
+    (typeof value === 'number' && Number.isFinite(value))
+  ) {
+    return value
+  }
+  if (typeof value !== 'object') throw oracleEpmLocalError('invalid_input')
+  if (ancestors.has(value)) throw oracleEpmLocalError('invalid_input')
+
+  const prototype = Object.getPrototypeOf(value)
+  if (Array.isArray(value)) {
+    if (prototype !== Array.prototype || hasPrototypeToJson(value)) {
+      throw oracleEpmLocalError('invalid_input')
+    }
+    const ownKeys = Reflect.ownKeys(value)
+    if (
+      ownKeys.some(
+        (key) => typeof key !== 'string' || (key !== 'length' && !/^(0|[1-9][0-9]*)$/.test(key))
+      )
+    ) {
+      throw oracleEpmLocalError('invalid_input')
+    }
+    ancestors.add(value)
+    try {
+      return Array.from({ length: value.length }, (_, index) => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index))
+        if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+          throw oracleEpmLocalError('invalid_input')
+        }
+        return cloneJsonData(descriptor.value, ancestors)
+      })
+    } finally {
+      ancestors.delete(value)
+    }
+  }
+
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw oracleEpmLocalError('invalid_input')
+  }
+  const clone: { [key: string]: JsonData } = Object.create(null)
+  ancestors.add(value)
+  try {
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== 'string') throw oracleEpmLocalError('invalid_input')
+      const descriptor = Object.getOwnPropertyDescriptor(value, key)
+      if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) {
+        throw oracleEpmLocalError('invalid_input')
+      }
+      clone[key] = cloneJsonData(descriptor.value, ancestors)
+    }
+  } finally {
+    ancestors.delete(value)
+  }
+  return clone
+}
+
 function buildBody(
   endpoint: OracleEpmEndpointDefinition,
   input: OracleEpmRequestInput
@@ -175,7 +250,7 @@ function buildBody(
       throw oracleEpmLocalError('invalid_input')
     let body: string
     try {
-      body = JSON.stringify(input.json)
+      body = JSON.stringify(cloneJsonData(input.json))
     } catch {
       throw oracleEpmLocalError('invalid_input')
     }
@@ -308,7 +383,8 @@ export function createOracleEpmClient(input: {
     }
     if (deadlineSignal.aborted) throw oracleEpmLocalError('timeout', true)
     if (!validation.isValid) throw oracleEpmLocalError('invalid_configuration')
-    const maxAttempts = endpoint.retry?.maxAttempts ?? 1
+    const maxAttempts =
+      endpoint.method === 'GET' ? Math.min(endpoint.retry?.maxAttempts ?? 1, 2) : 1
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
       let response: SecureFetchResponse
       try {

diff --git a/apps/sim/lib/internal/oracle-epm/destination.test.ts b/apps/sim/lib/internal/oracle-epm/destination.test.ts
@@ -20,13 +20,23 @@ describe('Oracle EPM destination', () => {
     })
   })
 
+  it('round-trips canonical percent-encoding in a credential-owned base path', () => {
+    const normalized = normalizeOracleEpmDestination(
+      'https://epm.example.com/gateway/My Folder/日本'
+    )
+    expect(normalized).toBe('https://epm.example.com/gateway/My%20Folder/%E6%97%A5%E6%9C%AC')
+    expect(normalizeOracleEpmDestination(normalized)).toBe(normalized)
+  })
+
   it.each([
     'http://epm.example.com',
     'https://user@epm.example.com',
     'https://epm.example.com?token=secret',
     'https://epm.example.com/#fragment',
     'https://epm.example.com/%2e%2e/admin',
+    'https://epm.example.com/%252e%252e/admin',
     'https://epm.example.com/a%2Fb',
+    'https:////epm.example.com/gateway',
     'https://epm.example.com/a\\b',
   ])('rejects unsafe destination %j', (value) => {
     expect(() => defineOracleEpmDestination(value)).toThrow()

diff --git a/apps/sim/lib/internal/oracle-epm/destination.ts b/apps/sim/lib/internal/oracle-epm/destination.ts
@@ -14,15 +14,36 @@ function decodeSegment(segment: string): string {
   }
 }
 
+function rawPathSegments(value: string): string[] {
+  const match = /^https:\/\/[^/?#]+(\/[^?#]*)?(?:[?#].*)?$/i.exec(value)
+  if (!match) throw new Error('Oracle EPM environment URL is invalid')
+  return (match[1] ?? '').split('/').filter(Boolean)
+}
+
+function validateAndDecodeSegment(encoded: string): string {
+  const decoded = decodeSegment(encoded)
+  let safetyValue = decoded
+  for (let depth = 0; depth < 4 && /%[0-9A-Fa-f]{2}/.test(safetyValue); depth += 1) {
+    safetyValue = decodeSegment(safetyValue)
+  }
+  if (
+    !decoded ||
+    /%[0-9A-Fa-f]{2}/.test(safetyValue) ||
+    safetyValue === '.' ||
+    safetyValue === '..' ||
+    safetyValue.includes('/') ||
+    FORBIDDEN_TEXT.test(safetyValue) ||
+    Buffer.byteLength(decoded, 'utf8') > MAX_PATH_SEGMENT_BYTES
+  ) {
+    throw new Error('Oracle EPM environment URL base path is invalid')
+  }
+  return decoded
+}
+
 /** Validates and freezes the credential-bound Oracle EPM environment URL. */
 export function defineOracleEpmDestination(rawUrl: string): OracleEpmDestination {
   const value = rawUrl.trim()
-  if (
-    !value ||
-    value.length > MAX_DESTINATION_LENGTH ||
-    value.includes('%') ||
-    FORBIDDEN_TEXT.test(value)
-  ) {
+  if (!value || value.length > MAX_DESTINATION_LENGTH || FORBIDDEN_TEXT.test(value)) {
     throw new Error('Oracle EPM environment URL is invalid')
   }
 
@@ -44,24 +65,11 @@ export function defineOracleEpmDestination(rawUrl: string): OracleEpmDestination
     )
   }
 
-  const encodedSegments = parsed.pathname.split('/').filter(Boolean)
+  const encodedSegments = rawPathSegments(value)
   if (encodedSegments.length > MAX_PATH_SEGMENTS) {
     throw new Error('Oracle EPM environment URL base path has too many segments')
   }
-  const baseSegments = encodedSegments.map((encoded) => {
-    const decoded = decodeSegment(encoded)
-    if (
-      !decoded ||
-      decoded === '.' ||
-      decoded === '..' ||
-      decoded.includes('/') ||
-      FORBIDDEN_TEXT.test(decoded) ||
-      Buffer.byteLength(decoded, 'utf8') > MAX_PATH_SEGMENT_BYTES
-    ) {
-      throw new Error('Oracle EPM environment URL base path is invalid')
-    }
-    return decoded
-  })
+  const baseSegments = encodedSegments.map(validateAndDecodeSegment)
 
   const destination = Object.freeze({}) as OracleEpmDestination
   destinations.set(destination, {

diff --git a/apps/sim/lib/internal/oracle-epm/endpoint.test.ts b/apps/sim/lib/internal/oracle-epm/endpoint.test.ts
@@ -58,6 +58,21 @@ describe('Oracle EPM endpoints', () => {
         maxResponseBytes: 100,
       })
     ).toThrow('header')
+
+    for (const correlationHeader of ['Authorization', 'Set-Cookie', 'WWW-Authenticate']) {
+      expect(() =>
+        routes.defineEndpoint({
+          method: 'GET',
+          version: 'v3',
+          path: [],
+          body: 'none',
+          response: 'json',
+          timeoutMs: 1_000,
+          maxResponseBytes: 100,
+          errors: { correlationHeaders: [correlationHeader] },
+        })
+      ).toThrow('error policy')
+    }
   })
 
   it('requires bounded request bodies and safe retry policies', () => {
@@ -85,6 +100,31 @@ describe('Oracle EPM endpoints', () => {
         retry: { maxAttempts: 2, statuses: [503], initialDelayMs: 1, maxDelayMs: 2 },
       })
     ).toThrow('retry policy')
+    expect(() =>
+      routes.defineEndpoint({
+        method: 'PUT',
+        version: 'v3',
+        path: [],
+        body: 'json',
+        maxRequestBytes: 100,
+        response: 'json',
+        timeoutMs: 1_000,
+        maxResponseBytes: 100,
+        retry: { maxAttempts: 2, statuses: [503], initialDelayMs: 1, maxDelayMs: 2 },
+      })
+    ).toThrow('retry policy')
+    expect(() =>
+      routes.defineEndpoint({
+        method: 'GET',
+        version: 'v3',
+        path: [],
+        body: 'none',
+        response: 'json',
+        timeoutMs: 1_000,
+        maxResponseBytes: 100,
+        retry: { maxAttempts: 3, statuses: [503], initialDelayMs: 1, maxDelayMs: 2 },
+      })
+    ).toThrow('retry policy')
   })
 
   it('rejects forged endpoints', () => {