fix(rootly,clerk,jira): reject path-traversal ids in URL segments

apps/sim/tools/clerk/add_organization_member.ts

@@ -6,6 +6,7 @@ import type {
   ClerkOrganizationMembership,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkAddOrganizationMember')
 
@@ -47,7 +48,7 @@ export const clerkAddOrganizationMemberTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `https://api.clerk.com/v1/organizations/${params.organizationId?.trim()}/memberships`,
+      `https://api.clerk.com/v1/organizations/${safeUrlPathSegment(params.organizationId, 'organizationId')}/memberships`,
     method: 'POST',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/ban_user.ts

@@ -6,6 +6,7 @@ import type {
   ClerkUser,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkBanUser')
 
@@ -31,7 +32,8 @@ export const clerkBanUserTool: ToolConfig<ClerkBanUserParams, ClerkBanUserRespon
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/users/${params.userId?.trim()}/ban`,
+    url: (params) =>
+      `https://api.clerk.com/v1/users/${safeUrlPathSegment(params.userId, 'userId')}/ban`,
     method: 'POST',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/create_organization_invitation.ts

@@ -6,6 +6,7 @@ import type {
   ClerkOrganizationInvitation,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkCreateOrganizationInvitation')
 
@@ -83,7 +84,7 @@ export const clerkCreateOrganizationInvitationTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `https://api.clerk.com/v1/organizations/${params.organizationId?.trim()}/invitations`,
+      `https://api.clerk.com/v1/organizations/${safeUrlPathSegment(params.organizationId, 'organizationId')}/invitations`,
     method: 'POST',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/delete_allowlist_identifier.ts

@@ -6,6 +6,7 @@ import type {
   ClerkDeleteResponse,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkDeleteAllowlistIdentifier')
 
@@ -35,7 +36,7 @@ export const clerkDeleteAllowlistIdentifierTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `https://api.clerk.com/v1/allowlist_identifiers/${params.identifierId?.trim()}`,
+      `https://api.clerk.com/v1/allowlist_identifiers/${safeUrlPathSegment(params.identifierId, 'identifierId')}`,
     method: 'DELETE',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/delete_blocklist_identifier.ts

@@ -6,6 +6,7 @@ import type {
   ClerkDeleteResponse,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkDeleteBlocklistIdentifier')
 
@@ -35,7 +36,7 @@ export const clerkDeleteBlocklistIdentifierTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `https://api.clerk.com/v1/blocklist_identifiers/${params.identifierId?.trim()}`,
+      `https://api.clerk.com/v1/blocklist_identifiers/${safeUrlPathSegment(params.identifierId, 'identifierId')}`,
     method: 'DELETE',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/delete_organization.ts

@@ -6,6 +6,7 @@ import type {
   ClerkDeleteResponse,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkDeleteOrganization')
 
@@ -34,7 +35,8 @@ export const clerkDeleteOrganizationTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/organizations/${params.organizationId?.trim()}`,
+    url: (params) =>
+      `https://api.clerk.com/v1/organizations/${safeUrlPathSegment(params.organizationId, 'organizationId')}`,
     method: 'DELETE',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/delete_user.ts

@@ -6,6 +6,7 @@ import type {
   ClerkDeleteUserResponse,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkDeleteUser')
 
@@ -31,7 +32,8 @@ export const clerkDeleteUserTool: ToolConfig<ClerkDeleteUserParams, ClerkDeleteU
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/users/${params.userId?.trim()}`,
+    url: (params) =>
+      `https://api.clerk.com/v1/users/${safeUrlPathSegment(params.userId, 'userId')}`,
     method: 'DELETE',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/get_jwt_template.ts

@@ -6,6 +6,7 @@ import type {
   ClerkJwtTemplate,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkGetJwtTemplate')
 
@@ -34,7 +35,8 @@ export const clerkGetJwtTemplateTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/jwt_templates/${params.templateId?.trim()}`,
+    url: (params) =>
+      `https://api.clerk.com/v1/jwt_templates/${safeUrlPathSegment(params.templateId, 'templateId')}`,
     method: 'GET',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/get_organization.ts

@@ -6,6 +6,7 @@ import type {
   ClerkOrganization,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkGetOrganization')
 
@@ -35,7 +36,8 @@ export const clerkGetOrganizationTool: ToolConfig<
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/organizations/${params.organizationId?.trim()}`,
+    url: (params) =>
+      `https://api.clerk.com/v1/organizations/${safeUrlPathSegment(params.organizationId, 'organizationId')}`,
     method: 'GET',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/get_session.ts

@@ -6,6 +6,7 @@ import type {
   ClerkSession,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkGetSession')
 
@@ -31,7 +32,8 @@ export const clerkGetSessionTool: ToolConfig<ClerkGetSessionParams, ClerkGetSess
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/sessions/${params.sessionId?.trim()}`,
+    url: (params) =>
+      `https://api.clerk.com/v1/sessions/${safeUrlPathSegment(params.sessionId, 'sessionId')}`,
     method: 'GET',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/get_user.ts

@@ -8,6 +8,7 @@ import type {
   ClerkUser,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkGetUser')
 
@@ -33,7 +34,8 @@ export const clerkGetUserTool: ToolConfig<ClerkGetUserParams, ClerkGetUserRespon
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/users/${params.userId?.trim()}`,
+    url: (params) =>
+      `https://api.clerk.com/v1/users/${safeUrlPathSegment(params.userId, 'userId')}`,
     method: 'GET',
     headers: (params) => {
       if (!params.secretKey) {

apps/sim/tools/clerk/get_user_oauth_token.ts

@@ -6,6 +6,7 @@ import type {
   ClerkOAuthAccessToken,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkGetUserOauthToken')
 
@@ -43,8 +44,8 @@ export const clerkGetUserOauthTokenTool: ToolConfig<
 
   request: {
     url: (params) => {
-      const providerSlug = params.provider?.trim().replace(/^oauth_/, '')
-      return `https://api.clerk.com/v1/users/${params.userId?.trim()}/oauth_access_tokens/oauth_${providerSlug}`
+      const providerSlug = safeUrlPathSegment(params.provider, 'provider').replace(/^oauth_/, '')
+      return `https://api.clerk.com/v1/users/${safeUrlPathSegment(params.userId, 'userId')}/oauth_access_tokens/oauth_${providerSlug}`
     },
     method: 'GET',
     headers: (params) => {

apps/sim/tools/clerk/list_organization_invitations.ts

@@ -6,6 +6,7 @@ import type {
   ClerkOrganizationInvitation,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkListOrganizationInvitations')
 
@@ -74,7 +75,7 @@ export const clerkListOrganizationInvitationsTool: ToolConfig<
       if (params.offset) queryParams.append('offset', params.offset.toString())
 
       const queryString = queryParams.toString()
-      const base = `https://api.clerk.com/v1/organizations/${params.organizationId?.trim()}/invitations`
+      const base = `https://api.clerk.com/v1/organizations/${safeUrlPathSegment(params.organizationId, 'organizationId')}/invitations`
       return queryString ? `${base}?${queryString}` : base
     },
     method: 'GET',

apps/sim/tools/clerk/list_organization_memberships.ts

@@ -6,6 +6,7 @@ import type {
   ClerkOrganizationMembership,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkListOrganizationMemberships')
 
@@ -71,7 +72,7 @@ export const clerkListOrganizationMembershipsTool: ToolConfig<
       }
 
       const queryString = queryParams.toString()
-      const base = `https://api.clerk.com/v1/organizations/${params.organizationId?.trim()}/memberships`
+      const base = `https://api.clerk.com/v1/organizations/${safeUrlPathSegment(params.organizationId, 'organizationId')}/memberships`
       return queryString ? `${base}?${queryString}` : base
     },
     method: 'GET',

apps/sim/tools/clerk/lock_user.ts

@@ -6,6 +6,7 @@ import type {
   ClerkUser,
 } from '@/tools/clerk/types'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 const logger = createLogger('ClerkLockUser')
 
@@ -31,7 +32,8 @@ export const clerkLockUserTool: ToolConfig<ClerkLockUserParams, ClerkLockUserRes
   },
 
   request: {
-    url: (params) => `https://api.clerk.com/v1/users/${params.userId?.trim()}/lock`,
+    url: (params) =>
+      `https://api.clerk.com/v1/users/${safeUrlPathSegment(params.userId, 'userId')}/lock`,
     method: 'POST',
     headers: (params) => {
       if (!params.secretKey) {