fix(salesforce): pin instance URL to Salesforce domains and guard upd…

…ate-custom-field egress (#9177) * fix(salesforce): pin instance URL to Salesforce domains and guard update-custom-field egress * fix(security): check vendor-hosted URL scheme on the parsed URL and pass abort signal to DNS validation * test(salesforce): cover private-address DNS refusal in update-custom-field
waleedlatif1 · Oct 17, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
commit 2d0ac795bc9190cfbea1036c45dc46c5af76918c
diff --git a/apps/sim/lib/core/security/input-validation.ts b/apps/sim/lib/core/security/input-validation.ts
@@ -1158,8 +1158,14 @@ function validateVendorHostedUrl(
 
   // These vendors are public SaaS reached over TLS. Enforced here rather than
   // left to the egress policy, which would permit plain HTTP to a host an
-  // operator happened to put in their allowlist.
-  if (/^http:\/\//i.test(candidate)) {
+  // operator happened to put in their allowlist. Checked on the parsed URL:
+  // the parser also reads `http:\\host`, `http:host`, and a scheme split by a
+  // tab or newline as `http://host`.
+  let scheme: string | undefined
+  try {
+    scheme = new URL(candidate).protocol
+  } catch {}
+  if (scheme === 'http:') {
     return { isValid: false, error: `${paramName} must use https://` }
   }
 
@@ -1270,6 +1276,40 @@ export function validateWorkdayTenantUrl(
   })
 }
 
+const SALESFORCE_ALLOWED_HOST_SUFFIXES = [
+  '.salesforce.com',
+  '.force.com',
+  '.cloudforce.com',
+  '.database.com',
+  '.salesforce.mil',
+  '.sfcrmproducts.cn',
+] as const
+
+/**
+ * Validates a Salesforce org instance URL to prevent SSRF attacks.
+ *
+ * Org API hosts live on Salesforce-owned domains: `*.my.salesforce.com` (including
+ * sandbox, scratch, and legacy `na1.salesforce.com` pods), `*.force.com`, the legacy
+ * `cloudforce.com` and `database.com` hosts, Government Cloud Plus on
+ * `salesforce.mil`, and Salesforce on Alibaba Cloud on `sfcrmproducts.cn`.
+ *
+ * @param url - The instance URL to validate
+ * @param paramName - Name of the parameter for error messages
+ * @returns ValidationResult whose `sanitized` value is the https origin
+ */
+export function validateSalesforceInstanceUrl(
+  url: string | null | undefined,
+  paramName = 'instanceUrl'
+): ValidationResult {
+  return validateVendorHostedUrl(url, {
+    suffixes: SALESFORCE_ALLOWED_HOST_SUFFIXES,
+    vendor: 'Salesforce',
+    paramName,
+    sanitize: 'origin',
+    allowBareSuffix: false,
+  })
+}
+
 /**
  * Every production Databricks control-plane DNS zone. All but `.cloud.databricks.mil` mirror
  * `ALL_ENVS` in the Databricks SDK (`databricks/sdk/environments.py`); the DoD zone comes from the

diff --git a/apps/sim/lib/internal/salesforce/operations/update-custom-field.test.ts b/apps/sim/lib/internal/salesforce/operations/update-custom-field.test.ts
@@ -1,4 +1,14 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockResolveHostAddresses } = vi.hoisted(() => ({
+  mockResolveHostAddresses: vi.fn(),
+}))
+
+vi.mock('@sim/security/dns', () => ({
+  resolveHostAddresses: mockResolveHostAddresses,
+  preferIpv4: (addresses: string[]) => addresses[0],
+}))
+
 import { executeSalesforceUpdateCustomFieldOperation } from '@/lib/internal/salesforce/operations/update-custom-field'
 
 const PARAMS = {
@@ -14,14 +24,29 @@ describe('salesforce update custom field operation', () => {
   })
 
   it('rejects a field ID that could escape the CustomField path before provider work', async () => {
-    const fetchMock = vi.mocked(fetch)
-
     await expect(
       executeSalesforceUpdateCustomFieldOperation({
         ...PARAMS,
         fieldId: '../CustomObject',
       } as never)
     ).rejects.toThrow('Field ID must be a 15- or 18-character Salesforce record ID')
-    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('refuses an instance URL off Salesforce', async () => {
+    await expect(
+      executeSalesforceUpdateCustomFieldOperation({
+        ...PARAMS,
+        instanceUrl: 'http://169.254.169.254/latest/meta-data/iam/security-credentials/?x=',
+      } as never)
+    ).rejects.toThrow('Salesforce instance URL must be on a Salesforce domain')
+  })
+
+  it('refuses a Salesforce host that resolves to a private address before sending the token', async () => {
+    mockResolveHostAddresses.mockResolvedValue({ addresses: ['10.0.0.5'] })
+
+    await expect(executeSalesforceUpdateCustomFieldOperation(PARAMS as never)).rejects.toThrow(
+      'instanceUrl resolves to a private or reserved address'
+    )
+    expect(fetch).not.toHaveBeenCalled()
   })
 })
diff --git a/apps/sim/lib/internal/salesforce/operations/update-custom-field.ts b/apps/sim/lib/internal/salesforce/operations/update-custom-field.ts
@@ -1,5 +1,10 @@
 import { createLogger } from '@sim/logger'
 import { isRecordLike } from '@sim/utils/object'
+import {
+  MAX_JSON_API_RESPONSE_BYTES,
+  secureFetchWithPinnedIP,
+  validateUrlWithDNS,
+} from '@/lib/core/security/input-validation.server'
 import type { InternalToolOperationImplementation } from '@/lib/internal/tool-operations/types'
 import type {
   SalesforceUpdateCustomFieldParams,
@@ -28,8 +33,22 @@ export const executeSalesforceUpdateCustomFieldOperation: InternalToolOperationI
     Authorization: `Bearer ${params.accessToken}`,
     'Content-Type': 'application/json',
   }
+  const validation = await validateUrlWithDNS(url, 'instanceUrl', 'configuredEndpoint', { signal })
+  signal?.throwIfAborted()
+  if (!validation.isValid) {
+    throw new Error(validation.error || 'Invalid Salesforce instance URL')
+  }
+  const fetchOptions = {
+    profile: 'configuredEndpoint',
+    headers,
+    maxResponseBytes: MAX_JSON_API_RESPONSE_BYTES,
+    signal,
+  } as const
 
-  const readResponse = await fetch(url, { headers, signal })
+  const readResponse = await secureFetchWithPinnedIP(url, validation.resolvedIP, {
+    ...fetchOptions,
+    method: 'GET',
+  })
   let existing: unknown
   try {
     existing = await readResponse.json()
@@ -56,11 +75,10 @@ export const executeSalesforceUpdateCustomFieldOperation: InternalToolOperationI
 
   const metadata = mergeCustomFieldMetadata(existing.Metadata, params)
 
-  const patchResponse = await fetch(url, {
+  const patchResponse = await secureFetchWithPinnedIP(url, validation.resolvedIP, {
+    ...fetchOptions,
     method: 'PATCH',
-    headers,
     body: JSON.stringify({ Metadata: metadata }),
-    signal,
   })
   if (!patchResponse.ok) {
     const errorData = await patchResponse.json().catch(() => {

diff --git a/apps/sim/tools/salesforce/utils.test.ts b/apps/sim/tools/salesforce/utils.test.ts
@@ -64,4 +64,28 @@ describe('getInstanceUrl', () => {
     expect(() => getInstanceUrl()).toThrow('Salesforce instance URL is required')
     expect(() => getInstanceUrl('not-a-jwt')).toThrow('Salesforce instance URL is required')
   })
+
+  it('reduces a provided instance URL to its origin', () => {
+    expect(getInstanceUrl(undefined, `${ORG}/services/data?x=1`)).toBe(ORG)
+  })
+
+  it.each([
+    ['cloud metadata', 'https://169.254.169.254/latest/meta-data/?x='],
+    ['plain http on a Salesforce host', 'http://acme.my.salesforce.com'],
+    ['a lookalike suffix', 'https://acme.my.salesforce.com.attacker.example'],
+    ['a lookalike label', 'https://attackersalesforce.com'],
+    ['a bare Salesforce domain', 'https://salesforce.com'],
+    ['a login host', 'https://login.salesforce.com'],
+    ['a non-URL', 'not a url'],
+  ])('rejects a provided instance URL with %s', (_label, instanceUrl) => {
+    expect(() => getInstanceUrl(idTokenWith({ profile: `${ORG}/005` }), instanceUrl)).toThrow(
+      'Salesforce instance URL must be on a Salesforce domain'
+    )
+  })
+
+  it('skips an id token claim off Salesforce', () => {
+    expect(() => getInstanceUrl(idTokenWith({ profile: 'https://169.254.169.254/005' }))).toThrow(
+      'Salesforce instance URL is required'
+    )
+  })
 })
diff --git a/apps/sim/tools/salesforce/utils.ts b/apps/sim/tools/salesforce/utils.ts
@@ -1,17 +1,31 @@
 import { createLogger } from '@sim/logger'
+import { validateSalesforceInstanceUrl } from '@/lib/core/security/input-validation'
 import { isSalesforceLoginOrigin } from '@/lib/oauth/salesforce'
 
 const logger = createLogger('SalesforceUtils')
 
+/** The https origin of `url` when it is an org API host on a Salesforce domain. */
+function toInstanceOrigin(url: string): string | undefined {
+  const result = validateSalesforceInstanceUrl(url)
+  if (!result.isValid || !result.sanitized || isSalesforceLoginOrigin(result.sanitized)) {
+    return undefined
+  }
+  return result.sanitized
+}
+
 /**
  * Extracts Salesforce instance URL from ID token or uses provided instance URL
  * @param idToken - The Salesforce ID token containing instance URL
  * @param instanceUrl - Direct instance URL if provided
- * @returns The Salesforce instance URL
- * @throws Error if instance URL cannot be determined
+ * @returns The Salesforce instance URL, as an https origin on a Salesforce domain
+ * @throws Error if instance URL cannot be determined or is not on a Salesforce domain
  */
 export function getInstanceUrl(idToken?: string, instanceUrl?: string): string {
-  if (instanceUrl) return instanceUrl
+  if (instanceUrl) {
+    const origin = toInstanceOrigin(instanceUrl)
+    if (!origin) throw new Error('Salesforce instance URL must be on a Salesforce domain')
+    return origin
+  }
   if (idToken) {
     try {
       const base64Url = idToken.split('.')[1]
@@ -29,18 +43,8 @@ export function getInstanceUrl(idToken?: string, instanceUrl?: string): string {
       // `sub` be tried rather than short-circuiting the whole lookup.
       for (const claim of [decoded.profile, decoded.sub]) {
         if (typeof claim !== 'string') continue
-        // `URL` rather than a hand-rolled prefix regex: it normalizes away
-        // userinfo, default ports, and case, so the origin compared against the
-        // login-host set is the same one a fetch would actually use.
-        let origin: string
-        try {
-          const url = new URL(claim)
-          if (url.protocol !== 'https:') continue
-          origin = url.origin
-        } catch {
-          continue
-        }
-        if (!isSalesforceLoginOrigin(origin)) return origin
+        const origin = toInstanceOrigin(claim)
+        if (origin) return origin
       }
     } catch (error) {
       logger.error('Failed to decode Salesforce idToken', { error })