fix(security): reject path-traversal IDs in Google Vault, AgentMail and Algolia tools

apps/sim/tools/agentmail/create_draft.ts

@@ -1,5 +1,6 @@
 import type { CreateDraftParams, CreateDraftResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailCreateDraftTool: ToolConfig<CreateDraftParams, CreateDraftResult> = {
   id: 'agentmail_create_draft',
@@ -71,7 +72,8 @@ export const agentmailCreateDraftTool: ToolConfig<CreateDraftParams, CreateDraft
   },
 
   request: {
-    url: (params) => `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/drafts`,
+    url: (params) =>
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/drafts`,
     method: 'POST',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/delete_draft.ts

@@ -1,5 +1,6 @@
 import type { DeleteDraftParams, DeleteDraftResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailDeleteDraftTool: ToolConfig<DeleteDraftParams, DeleteDraftResult> = {
   id: 'agentmail_delete_draft',
@@ -30,7 +31,7 @@ export const agentmailDeleteDraftTool: ToolConfig<DeleteDraftParams, DeleteDraft
 
   request: {
     url: (params) =>
-      `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/drafts/${params.draftId.trim()}`,
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/drafts/${safeUrlPathSegment(params.draftId, 'draftId')}`,
     method: 'DELETE',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/delete_inbox.ts

@@ -1,5 +1,6 @@
 import type { DeleteInboxParams, DeleteInboxResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailDeleteInboxTool: ToolConfig<DeleteInboxParams, DeleteInboxResult> = {
   id: 'agentmail_delete_inbox',
@@ -23,7 +24,8 @@ export const agentmailDeleteInboxTool: ToolConfig<DeleteInboxParams, DeleteInbox
   },
 
   request: {
-    url: (params) => `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}`,
+    url: (params) =>
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}`,
     method: 'DELETE',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/delete_thread.ts

@@ -1,5 +1,6 @@
 import type { DeleteThreadParams, DeleteThreadResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailDeleteThreadTool: ToolConfig<DeleteThreadParams, DeleteThreadResult> = {
   id: 'agentmail_delete_thread',
@@ -40,7 +41,7 @@ export const agentmailDeleteThreadTool: ToolConfig<DeleteThreadParams, DeleteThr
       const query = new URLSearchParams()
       if (params.permanent) query.set('permanent', 'true')
       const qs = query.toString()
-      return `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/threads/${params.threadId.trim()}${qs ? `?${qs}` : ''}`
+      return `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/threads/${safeUrlPathSegment(params.threadId, 'threadId')}${qs ? `?${qs}` : ''}`
     },
     method: 'DELETE',
     headers: (params) => ({

apps/sim/tools/agentmail/forward_message.ts

@@ -1,5 +1,6 @@
 import type { ForwardMessageParams, ForwardMessageResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailForwardMessageTool: ToolConfig<ForwardMessageParams, ForwardMessageResult> = {
   id: 'agentmail_forward_message',
@@ -66,7 +67,7 @@ export const agentmailForwardMessageTool: ToolConfig<ForwardMessageParams, Forwa
 
   request: {
     url: (params) =>
-      `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/messages/${params.messageId.trim()}/forward`,
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/messages/${safeUrlPathSegment(params.messageId, 'messageId')}/forward`,
     method: 'POST',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/get_draft.ts

@@ -1,5 +1,6 @@
 import type { GetDraftParams, GetDraftResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailGetDraftTool: ToolConfig<GetDraftParams, GetDraftResult> = {
   id: 'agentmail_get_draft',
@@ -30,7 +31,7 @@ export const agentmailGetDraftTool: ToolConfig<GetDraftParams, GetDraftResult> =
 
   request: {
     url: (params) =>
-      `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/drafts/${params.draftId.trim()}`,
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/drafts/${safeUrlPathSegment(params.draftId, 'draftId')}`,
     method: 'GET',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/get_inbox.ts

@@ -1,5 +1,6 @@
 import type { GetInboxParams, GetInboxResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailGetInboxTool: ToolConfig<GetInboxParams, GetInboxResult> = {
   id: 'agentmail_get_inbox',
@@ -23,7 +24,8 @@ export const agentmailGetInboxTool: ToolConfig<GetInboxParams, GetInboxResult> =
   },
 
   request: {
-    url: (params) => `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}`,
+    url: (params) =>
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}`,
     method: 'GET',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/get_message.ts

@@ -1,5 +1,6 @@
 import type { GetMessageParams, GetMessageResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailGetMessageTool: ToolConfig<GetMessageParams, GetMessageResult> = {
   id: 'agentmail_get_message',
@@ -30,7 +31,7 @@ export const agentmailGetMessageTool: ToolConfig<GetMessageParams, GetMessageRes
 
   request: {
     url: (params) =>
-      `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/messages/${params.messageId.trim()}`,
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/messages/${safeUrlPathSegment(params.messageId, 'messageId')}`,
     method: 'GET',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/get_thread.ts

@@ -1,5 +1,6 @@
 import type { GetThreadParams, GetThreadResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailGetThreadTool: ToolConfig<GetThreadParams, GetThreadResult> = {
   id: 'agentmail_get_thread',
@@ -30,7 +31,7 @@ export const agentmailGetThreadTool: ToolConfig<GetThreadParams, GetThreadResult
 
   request: {
     url: (params) =>
-      `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/threads/${params.threadId.trim()}`,
+      `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/threads/${safeUrlPathSegment(params.threadId, 'threadId')}`,
     method: 'GET',
     headers: (params) => ({
       Authorization: `Bearer ${params.apiKey}`,

apps/sim/tools/agentmail/list_drafts.ts

@@ -1,5 +1,6 @@
 import type { ListDraftsParams, ListDraftsResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailListDraftsTool: ToolConfig<ListDraftsParams, ListDraftsResult> = {
   id: 'agentmail_list_drafts',
@@ -40,7 +41,7 @@ export const agentmailListDraftsTool: ToolConfig<ListDraftsParams, ListDraftsRes
       if (params.limit) query.set('limit', String(params.limit))
       if (params.pageToken) query.set('page_token', params.pageToken)
       const qs = query.toString()
-      return `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/drafts${qs ? `?${qs}` : ''}`
+      return `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/drafts${qs ? `?${qs}` : ''}`
     },
     method: 'GET',
     headers: (params) => ({

apps/sim/tools/agentmail/list_messages.ts

@@ -1,5 +1,6 @@
 import type { ListMessagesParams, ListMessagesResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailListMessagesTool: ToolConfig<ListMessagesParams, ListMessagesResult> = {
   id: 'agentmail_list_messages',
@@ -40,7 +41,7 @@ export const agentmailListMessagesTool: ToolConfig<ListMessagesParams, ListMessa
       if (params.limit) query.set('limit', String(params.limit))
       if (params.pageToken) query.set('page_token', params.pageToken)
       const qs = query.toString()
-      return `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/messages${qs ? `?${qs}` : ''}`
+      return `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/messages${qs ? `?${qs}` : ''}`
     },
     method: 'GET',
     headers: (params) => ({

apps/sim/tools/agentmail/list_threads.ts

@@ -1,5 +1,6 @@
 import type { ListThreadsParams, ListThreadsResult } from '@/tools/agentmail/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const agentmailListThreadsTool: ToolConfig<ListThreadsParams, ListThreadsResult> = {
   id: 'agentmail_list_threads',
@@ -65,7 +66,7 @@ export const agentmailListThreadsTool: ToolConfig<ListThreadsParams, ListThreads
       if (params.before) query.set('before', params.before)
       if (params.after) query.set('after', params.after)
       const qs = query.toString()
-      return `https://api.agentmail.to/v0/inboxes/${params.inboxId.trim()}/threads${qs ? `?${qs}` : ''}`
+      return `https://api.agentmail.to/v0/inboxes/${safeUrlPathSegment(params.inboxId, 'inboxId')}/threads${qs ? `?${qs}` : ''}`
     },
     method: 'GET',
     headers: (params) => ({