fix(security): close ReDoS, zip-bomb, SSRF and redaction gaps found by audit

A dependency re-audit asked "does this library actually deliver the guarantee
the calling code assumes" rather than "is it popular". These are the results.

Security:
- Copilot VFS glob() handed a caller-controlled pattern to micromatch, whose
  picomatch backend compiles `*` into a backtracking regex. A 25-char pattern
  took 41s; 29 chars exceeded 180s. Matching now runs on RE2, mirroring the
  grep() sibling in the same file that already did this. micromatch.makeRe()
  emits lookaheads RE2 cannot express, so picomatch's dot-assertions are
  translated into character exclusions; a differential test covers 519,688
  pattern/path pairs against micromatch with no mismatches. Patterns that
  still carry an assertion fail closed rather than falling back.
- doc-parser was the only OOXML-adjacent parser without the zip-bomb guard.
  officeparser sniffs content rather than extension, so a docx renamed .doc
  reached an unguarded unzip and could OOM the shared server. Genuine OLE2
  .doc files are unaffected. Same guard added to the copilot style reader.
- json-yaml-chunker called yaml.load with no alias-expansion cap. js-yaml has
  no maxAliasCount, so this is routed through assertYamlWithinLimits like the
  file parser already was.
- Video tools and falai fetched provider-supplied URLs raw, including one that
  replayed an Authorization header to a polled status_url. Those URLs are now
  origin-pinned and revalidated on every poll. Cross-origin redirects drop
  credential headers by default, keyed on registrable domain rather than exact
  origin so same-site subdomain hops and http->https upgrades keep working.
- Redaction key patterns were fully anchored, so openai_api_key, x-api-key,
  set-cookie, secretAccessKey and session_id were logged in the clear. The
  matcher now tokenizes keys, with exemptions so token-usage fields such as
  promptTokens stay readable.
- drawtext escaping did not match ffmpeg's quoting grammar; a quote in agent
  supplied text escaped into filter options. Text is passed via textfile= so
  it never enters the filter string.
- Loop conditions interpolated a resolved value into a JS string by hand.

Supply chain:
- Vendor free-email-domains' data. Its postinstall fetched a CDN CSV and
  overwrote the shipped list, so the lockfile hash covered the tarball but not
  the data actually used. It is inert under Bun today only because the package
  is outside trustedDependencies.
- Document why xlsx is pinned to the SheetJS CDN: the npm copy is frozen at
  0.18.5 with two unfixed CVEs, and a URL dependency is invisible to audit
  tooling, so upgrades have to be tracked by hand.

Dependencies:
- @daytonaio/sdk is deprecated in favour of @daytona/sdk (same API).
- The @react-email/components 0.x line is deprecated; 1.0.12 needs no source
  changes here since no template uses <Tailwind> and render() already moved.
- Load the pptx preview lazily so echarts leaves the Home, Files and share
  page bundles.
- Drop autoprefixer (absent from the PostCSS config, so it never ran) and
  tailwind-merge (no importers; @sim/emcn declares its own).

Author: Waleed Latif

apps/sim/app/api/tools/onedrive/upload/route.ts

@@ -1,6 +1,17 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
+/**
+ * `xlsx` is pinned in `package.json` to the SheetJS CDN tarball
+ * (`https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz`), not the npm registry.
+ * This is deliberate: npm's `xlsx` is abandoned at 0.18.5 (2022) and permanently
+ * vulnerable to CVE-2023-30533 (prototype pollution) and CVE-2024-22363 (ReDoS)
+ * — SheetJS shipped the fixes only to their own CDN and never republished to npm.
+ * Do not "fix" this back to a registry version; that reintroduces both CVEs.
+ *
+ * A URL dependency is invisible to Dependabot and `bun audit`, so upgrades must
+ * be tracked by hand against https://cdn.sheetjs.com/ / the SheetJS changelog.
+ */
 import * as XLSX from 'xlsx'
 import { onedriveUploadContract } from '@/lib/api/contracts/tools/microsoft'
 import { parseRequest } from '@/lib/api/server'

apps/sim/app/api/tools/video/route.ts

@@ -8,6 +8,10 @@ import { videoProviders, videoToolContract } from '@/lib/api/contracts/tools/med
 import { getValidationErrorMessage, parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
+import {
+  secureFetchWithPinnedIP,
+  validateUrlWithDNS,
+} from '@/lib/core/security/input-validation.server'
 import {
   assertKnownSizeWithinLimit,
   DEFAULT_MAX_ERROR_BODY_BYTES,
@@ -36,15 +40,31 @@ export const dynamic = 'force-dynamic'
  */
 export const maxDuration = 5400
 
-async function readVideoResponseBuffer(response: Response, label: string): Promise<Buffer> {
+/**
+ * Structural shape shared by `fetch`'s `Response` and the SSRF-guarded
+ * `SecureFetchResponse`, so the body readers below accept either.
+ */
+interface ReadableHttpResponse {
+  ok: boolean
+  status: number
+  headers: { get(name: string): string | null }
+  body?: ReadableStream<Uint8Array> | null
+  arrayBuffer?: () => Promise<ArrayBuffer>
+  text?: () => Promise<string>
+}
+
+async function readVideoResponseBuffer(
+  response: ReadableHttpResponse,
+  label: string
+): Promise<Buffer> {
   return readResponseToBufferWithLimit(response, {
     maxBytes: MAX_VIDEO_OUTPUT_BYTES,
     label,
   })
 }
 
 async function readVideoJson<T = Record<string, unknown>>(
-  response: Response,
+  response: ReadableHttpResponse,
   label: string
 ): Promise<T> {
   return readResponseJsonWithLimit<T>(response, {
@@ -53,13 +73,54 @@ async function readVideoJson<T = Record<string, unknown>>(
   })
 }
 
-async function readVideoErrorText(response: Response, label: string): Promise<string> {
+async function readVideoErrorText(response: ReadableHttpResponse, label: string): Promise<string> {
   return readResponseTextWithLimit(response, {
     maxBytes: DEFAULT_MAX_ERROR_BODY_BYTES,
     label,
   }).catch(() => '')
 }
 
+/**
+ * Fetches a provider-supplied URL through the SSRF-guarded client. These URLs come out of
+ * provider response bodies, so they are untrusted input: DNS is resolved and validated
+ * against the private/reserved policy, the socket is pinned to the validated IP (no DNS
+ * rebinding), and every redirect hop is revalidated before it is followed.
+ */
+async function secureGetFromUntrustedUrl(
+  url: string,
+  paramName: string,
+  options: { headers?: Record<string, string>; maxResponseBytes: number }
+) {
+  const validation = await validateUrlWithDNS(url, paramName)
+  if (!validation.isValid || !validation.resolvedIP) {
+    throw new Error(validation.error || `${paramName} failed validation`)
+  }
+  return secureFetchWithPinnedIP(url, validation.resolvedIP, {
+    method: 'GET',
+    headers: options.headers,
+    maxResponseBytes: options.maxResponseBytes,
+  })
+}
+
+/** Downloads a provider-supplied video URL through the SSRF-guarded client. */
+async function downloadVideoFromUrl(
+  url: string,
+  label: string,
+  headers?: Record<string, string>
+): Promise<Buffer> {
+  const response = await secureGetFromUntrustedUrl(url, 'videoUrl', {
+    headers,
+    maxResponseBytes: MAX_VIDEO_OUTPUT_BYTES,
+  })
+
+  if (!response.ok) {
+    await readVideoErrorText(response, `${label} error response`)
+    throw new Error(`Failed to download video: ${response.status}`)
+  }
+
+  return readVideoResponseBuffer(response, `${label} response`)
+}
+
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const requestId = generateId()
   logger.info(`[${requestId}] Video generation request started`)
@@ -461,14 +522,8 @@ async function generateWithRunway(
         throw new Error('No video URL in response')
       }
 
-      const videoResponse = await fetch(videoUrl)
-      if (!videoResponse.ok) {
-        await readVideoErrorText(videoResponse, 'Runway video error response')
-        throw new Error(`Failed to download video: ${videoResponse.status}`)
-      }
-
       return {
-        buffer: await readVideoResponseBuffer(videoResponse, 'Runway video response'),
+        buffer: await downloadVideoFromUrl(videoUrl, 'Runway video'),
         width: dimensions.width,
         height: dimensions.height,
         jobId: taskId,
@@ -486,6 +541,21 @@ async function generateWithRunway(
   throw new Error('Runway generation timed out')
 }
 
+/**
+ * True when a provider-supplied URI is served by Google. The Veo download URI comes out of
+ * the operation status body, so the `x-goog-api-key` credential is only attached when the
+ * target really is a Google host — a hostile or spoofed URI never receives the key.
+ */
+function isGoogleApiHost(url: string): boolean {
+  try {
+    const { protocol, hostname } = new URL(url)
+    if (protocol !== 'https:') return false
+    return hostname === 'googleapis.com' || hostname.endsWith('.googleapis.com')
+  } catch {
+    return false
+  }
+}
+
 async function generateWithVeo(
   apiKey: string,
   model: string,
@@ -583,19 +653,12 @@ async function generateWithVeo(
         throw new Error('No video URI in response')
       }
 
-      const videoResponse = await fetch(videoUri, {
-        headers: {
-          'x-goog-api-key': apiKey,
-        },
-      })
-
-      if (!videoResponse.ok) {
-        await readVideoErrorText(videoResponse, 'Veo video error response')
-        throw new Error(`Failed to download video: ${videoResponse.status}`)
-      }
-
       return {
-        buffer: await readVideoResponseBuffer(videoResponse, 'Veo video response'),
+        buffer: await downloadVideoFromUrl(
+          videoUri,
+          'Veo video',
+          isGoogleApiHost(videoUri) ? { 'x-goog-api-key': apiKey } : undefined
+        ),
         width: dimensions.width,
         height: dimensions.height,
         jobId: operationName,
@@ -697,14 +760,8 @@ async function generateWithLuma(
         throw new Error('No video URL in response')
       }
 
-      const videoResponse = await fetch(videoUrl)
-      if (!videoResponse.ok) {
-        await readVideoErrorText(videoResponse, 'Luma video error response')
-        throw new Error(`Failed to download video: ${videoResponse.status}`)
-      }
-
       return {
-        buffer: await readVideoResponseBuffer(videoResponse, 'Luma video response'),
+        buffer: await downloadVideoFromUrl(videoUrl, 'Luma video'),
         width: dimensions.width,
         height: dimensions.height,
         jobId: generationId,
@@ -859,15 +916,8 @@ async function generateWithMiniMax(
         throw new Error('No download URL in file response')
       }
 
-      // Download the actual video file
-      const videoResponse = await fetch(videoUrl)
-      if (!videoResponse.ok) {
-        await readVideoErrorText(videoResponse, 'MiniMax video error response')
-        throw new Error(`Failed to download video from URL: ${videoResponse.status}`)
-      }
-
       return {
-        buffer: await readVideoResponseBuffer(videoResponse, 'MiniMax video response'),
+        buffer: await downloadVideoFromUrl(videoUrl, 'MiniMax video'),
         width: dimensions.width,
         height: dimensions.height,
         jobId: taskId,
@@ -1160,12 +1210,40 @@ function getFalAIErrorMessage(error: unknown): string {
   return 'Unknown error'
 }
 
+const FALAI_QUEUE_ORIGIN = 'https://queue.fal.run'
+
 function buildFalAIQueueUrl(
   endpoint: string,
   requestId: string,
   path: 'response' | 'status'
 ): string {
-  return `https://queue.fal.run/${endpoint}/requests/${requestId}/${path}`
+  return `${FALAI_QUEUE_ORIGIN}/${endpoint}/requests/${requestId}/${path}`
+}
+
+/**
+ * Accepts a queue URL echoed back by Fal.ai only while it stays on the queue origin we
+ * submitted to, otherwise falls back to the URL we construct ourselves. Queue polling
+ * carries `Authorization: Key <apiKey>`, so an attacker-influenced `status_url` /
+ * `response_url` would otherwise hand the Fal.ai key to an arbitrary host.
+ */
+function resolveFalAIQueueUrl(candidate: string | undefined, fallback: string): string {
+  if (!candidate) return fallback
+  try {
+    return new URL(candidate).origin === FALAI_QUEUE_ORIGIN ? candidate : fallback
+  } catch {
+    return fallback
+  }
+}
+
+/**
+ * Requests a Fal.ai queue URL through the SSRF-guarded client. Invoked on every poll so
+ * the provider-supplied URL is revalidated each time rather than trusted once.
+ */
+async function fetchFalAIQueue(url: string, apiKey: string) {
+  return secureGetFromUntrustedUrl(url, 'falQueueUrl', {
+    headers: { Authorization: `Key ${apiKey}` },
+    maxResponseBytes: MAX_VIDEO_JSON_BYTES,
+  })
 }
 
 async function generateWithFalAI(
@@ -1218,7 +1296,7 @@ async function generateWithFalAI(
     requestBody.generate_audio = generateAudio
   }
 
-  const createResponse = await fetch(`https://queue.fal.run/${modelConfig.endpoint}`, {
+  const createResponse = await fetch(`${FALAI_QUEUE_ORIGIN}/${modelConfig.endpoint}`, {
     method: 'POST',
     headers: {
       Authorization: `Key ${apiKey}`,
@@ -1242,12 +1320,14 @@ async function generateWithFalAI(
     throw new Error('Fal.ai queue response missing request_id')
   }
 
-  const statusUrl =
-    getStringProperty(createData, 'status_url') ||
+  const statusUrl = resolveFalAIQueueUrl(
+    getStringProperty(createData, 'status_url'),
     buildFalAIQueueUrl(modelConfig.endpoint, requestIdFal, 'status')
-  const responseUrl =
-    getStringProperty(createData, 'response_url') ||
+  )
+  const responseUrl = resolveFalAIQueueUrl(
+    getStringProperty(createData, 'response_url'),
     buildFalAIQueueUrl(modelConfig.endpoint, requestIdFal, 'response')
+  )
 
   logger.info(`[${requestId}] Fal.ai request created: ${requestIdFal}`)
 
@@ -1258,11 +1338,7 @@ async function generateWithFalAI(
   while (attempts < maxAttempts) {
     await sleep(pollIntervalMs)
 
-    const statusResponse = await fetch(statusUrl, {
-      headers: {
-        Authorization: `Key ${apiKey}`,
-      },
-    })
+    const statusResponse = await fetchFalAIQueue(statusUrl, apiKey)
 
     if (!statusResponse.ok) {
       await readVideoErrorText(statusResponse, 'Fal.ai status error response')
@@ -1282,13 +1358,9 @@ async function generateWithFalAI(
 
       logger.info(`[${requestId}] Fal.ai generation completed after ${attempts * 5}s`)
 
-      const resultResponse = await fetch(
-        getStringProperty(statusData, 'response_url') || responseUrl,
-        {
-          headers: {
-            Authorization: `Key ${apiKey}`,
-          },
-        }
+      const resultResponse = await fetchFalAIQueue(
+        resolveFalAIQueueUrl(getStringProperty(statusData, 'response_url'), responseUrl),
+        apiKey
       )
 
       if (!resultResponse.ok) {
@@ -1309,11 +1381,7 @@ async function generateWithFalAI(
         throw new Error('No video URL in response')
       }
 
-      const videoResponse = await fetch(videoUrl)
-      if (!videoResponse.ok) {
-        await readVideoErrorText(videoResponse, 'Fal.ai video error response')
-        throw new Error(`Failed to download video: ${videoResponse.status}`)
-      }
+      const videoBuffer = await downloadVideoFromUrl(videoUrl, 'Fal.ai video')
 
       let width = getNumberProperty(videoOutput, 'width') || 1920
       let height = getNumberProperty(videoOutput, 'height') || 1080
@@ -1325,7 +1393,7 @@ async function generateWithFalAI(
       }
 
       return {
-        buffer: await readVideoResponseBuffer(videoResponse, 'Fal.ai video response'),
+        buffer: videoBuffer,
         width,
         height,
         jobId: requestIdFal,

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx

@@ -16,7 +16,6 @@ import { DocxPreview } from './docx-preview'
 import { resolveFileCategory } from './file-category'
 import { ImagePreview } from './image-preview'
 import type { PdfDocumentSource } from './pdf-viewer'
-import { PptxPreview } from './pptx-preview'
 import { PreviewPanel, resolvePreviewType } from './preview-panel'
 import {
   PREVIEW_LOADING_OVERLAY,
@@ -33,6 +32,19 @@ const PdfViewerCore = dynamic(() => import('./pdf-viewer').then((m) => m.PdfView
   ssr: false,
 })
 
+/**
+ * Lazy so `echarts` (~330 KB gzip, reached via `pptx-sandbox-host` →
+ * `lib/pptx-renderer/renderer/chart-renderer`) stays out of every bundle that
+ * statically imports this viewer - the Files page, the Home view and the public
+ * share page - instead of only the visitors who open a PowerPoint file. The
+ * fallback matches {@link PptxPreview}'s own pre-fetch frame, so the chunk load
+ * and the binary fetch look like one continuous loading state.
+ */
+const PptxPreview = dynamic(() => import('./pptx-preview').then((m) => m.PptxPreview), {
+  ssr: false,
+  loading: () => <PreviewLoadingFrame className='h-full flex-1' tone='surface' />,
+})
+
 const RichMarkdownEditor = dynamic(
   () => import('./rich-markdown-editor/rich-markdown-editor').then((m) => m.RichMarkdownEditor),
   { ssr: false, loading: () => <PreviewLoadingFrame className='flex flex-1 flex-col' /> }