Visit https://example.com for more info
"; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/"]); + }); + + test("should extract both href and bare URLs", () => { + const html = ` + Click +Also visit https://bare.com
+ `; + const result = extractUrlsFromHtml(html); + expect(result).toContain("https://link.com/"); + expect(result).toContain("https://bare.com/"); + }); + + test("should deduplicate URLs", () => { + const html = ` + Link 1 + Link 2 +https://example.com
+ `; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/"]); + }); + + test("should handle URLs with paths and query strings", () => { + const html = 'Link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/path?query=value&foo=bar"]); + }); + + test("should handle http URLs", () => { + const html = 'Link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["http://example.com/"]); + }); + + test("should handle single-quoted href attributes", () => { + const html = "Link"; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/"]); + }); + + test("should clean trailing punctuation from bare URLs", () => { + const html = "Visit https://example.com. More text here.
"; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/"]); + }); + + test("should handle URLs with ports", () => { + const html = 'Link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com:8080/path"]); + }); + + test("should handle URLs with fragments", () => { + const html = 'Link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/page#section"]); + }); + }); + + describe("unhappy paths", () => { + test("should return empty array for empty string", () => { + const result = extractUrlsFromHtml(""); + expect(result).toEqual([]); + }); + + test("should return empty array for HTML without URLs", () => { + const html = "No links here
"; + const result = extractUrlsFromHtml(html); + expect(result).toEqual([]); + }); + + test("should ignore mailto links", () => { + const html = 'Email us'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual([]); + }); + + test("should ignore tel links", () => { + const html = 'Call us'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual([]); + }); + + test("should ignore javascript links", () => { + const html = 'Click'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual([]); + }); + + test("should ignore relative URLs", () => { + const html = 'Link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual([]); + }); + + test("should ignore anchor-only links", () => { + const html = 'Jump to section'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual([]); + }); + + test("should handle malformed HTML gracefully", () => { + const html = 'Unclosed link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/"]); + }); + + test("should handle empty href attributes", () => { + const html = 'Empty link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual([]); + }); + }); + + describe("URL normalization", () => { + test("should normalize URLs with trailing slash", () => { + const html = ` + Link 1 + Link 2 + `; + const result = extractUrlsFromHtml(html); + // Both should normalize to the same URL + expect(result.length).toBe(1); + }); + + test("should preserve path when normalizing", () => { + const html = 'Link'; + const result = extractUrlsFromHtml(html); + expect(result).toEqual(["https://example.com/path/"]); + }); + }); + }); + + describe("isUrlScanningEnabled", () => { + test("should return true when URL_SCANNING_ENABLED is true", () => { + const result = isUrlScanningEnabled(); + expect(result).toBe(true); + }); + }); +}); diff --git a/packages/features/ee/workflows/lib/urlScanner.ts b/packages/features/ee/workflows/lib/urlScanner.ts new file mode 100644 index 0000000000..98208156b0 --- /dev/null +++ b/packages/features/ee/workflows/lib/urlScanner.ts @@ -0,0 +1,441 @@ +import { LockReason, lockUser } from "@calcom/features/ee/api-keys/lib/autoLock"; +import { URL_SCANNING_ENABLED } from "@calcom/lib/constants"; +import logger from "@calcom/lib/logger"; + +// biome-ignore lint/nursery/useExplicitType: Logger type is inferred from getSubLogger +const log = logger.getSubLogger({ prefix: ["[urlScanner]"] }); + +// Cloudflare URL Scanner API configuration +const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4"; +const MAX_POLL_ATTEMPTS = 10; +const POLL_INTERVAL_MS = 15000; // 15 seconds + +interface CloudflareScanSubmitResponse { + success: boolean; + errors: Array<{ code: number; message: string }>; + result?: { + uuid: string; + url: string; + visibility: string; + }; +} + +interface CloudflareBulkScanItem { + url: string; + uuid?: string; + api?: string; + result?: string; + visibility?: string; +} + +type CloudflareBulkScanResponse = CloudflareBulkScanItem[]; + +interface CloudflareScanResultResponse { + success: boolean; + errors: Array<{ code: number; message: string }>; + result?: { + scan: { + task: { + uuid: string; + url: string; + status: string; + success: boolean; + }; + verdicts: { + overall: { + malicious: boolean; + categories: string[]; + }; + }; + }; + }; +} + +interface UrlScanResult { + url: string; + scanId: string; + status: "pending" | "completed" | "error"; + malicious?: boolean; + categories?: string[]; + error?: string; +} + +/** + * Gets the error message from an unknown error. + */ +function getErrorMessage(error: unknown): string { + if (error instanceof Error) { + return error.message; + } + return "Unknown error"; +} + +/** + * Creates an error result for a scan. + */ +function createErrorResult(scanId: string, errorMessage: string): UrlScanResult { + return { + url: "", + scanId, + status: "error", + error: errorMessage, + }; +} + +/** + * Validates that a URL is a valid HTTP/HTTPS URL. + */ +function isValidHttpUrl(urlString: string): boolean { + try { + const url = new URL(urlString); + return url.protocol === "http:" || url.protocol === "https:"; + } catch { + return false; + } +} + +/** + * Normalizes a URL for deduplication. + */ +function normalizeUrl(urlString: string): string { + try { + const url = new URL(urlString); + // Remove trailing slash from pathname if it's just "/" + if (url.pathname === "/") { + url.pathname = ""; + } + return url.toString(); + } catch { + return urlString; + } +} + +/** + * Extracts URLs from HTML content. + * Extracts both href attributes from anchor tags and bare URLs from text. + */ +function extractUrlsFromHtml(html: string): string[] { + const urls = new SetHello click here
', + }, + }); + + const eventType = await prismock.eventType.create({ + data: { + id: 1, + title: "Test Event", + slug: "test-event", + length: 30, + userId: user.id, + }, + }); + + await prismock.workflowsOnEventTypes.create({ + data: { + workflowId: workflow.id, + eventTypeId: eventType.id, + }, + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 200, + }); + + await scanWorkflowBody(payload); + + // Should submit for URL scanning + expect(submitWorkflowStepForUrlScanning).toHaveBeenCalledWith( + 200, + 'Hello click here
', + 1, + false + ); + + // Should schedule workflow notifications + expect(scheduleWorkflowNotifications).toHaveBeenCalled(); + }); + + test("should mark workflow step as verified when no reminder body", async () => { + // Set IFFY_API_KEY to test the Iffy path + process.env.IFFY_API_KEY = "test-api-key"; + + const user = await prismock.user.create({ + data: { + id: 2, + email: "test2@example.com", + locale: "en", + timeFormat: 12, + whitelistWorkflows: false, + }, + }); + + const workflow = await prismock.workflow.create({ + data: { + id: 2, + name: "Test Workflow 2", + userId: user.id, + trigger: WorkflowTriggerEvents.BEFORE_EVENT, + time: 1, + timeUnit: TimeUnit.HOUR, + }, + }); + + await prismock.workflowStep.create({ + data: { + id: 201, + stepNumber: 1, + action: WorkflowActions.EMAIL_HOST, + template: WorkflowTemplates.REMINDER, + workflowId: workflow.id, + reminderBody: null, // No reminder body + }, + }); + + const eventType = await prismock.eventType.create({ + data: { + id: 2, + title: "Test Event 2", + slug: "test-event-2", + length: 30, + userId: user.id, + }, + }); + + await prismock.workflowsOnEventTypes.create({ + data: { + workflowId: workflow.id, + eventTypeId: eventType.id, + }, + }); + + const payload = JSON.stringify({ + userId: 2, + workflowStepId: 201, + }); + + await scanWorkflowBody(payload); + + // Should mark as verified + const updatedStep = await prismock.workflowStep.findUnique({ + where: { id: 201 }, + }); + expect(updatedStep?.verifiedAt).toBeTruthy(); + }); + + test("should mark workflow step as verified when body matches template", async () => { + process.env.IFFY_API_KEY = "test-api-key"; + vi.mocked(compareReminderBodyToTemplate).mockReturnValueOnce(true); + + const user = await prismock.user.create({ + data: { + id: 3, + email: "test3@example.com", + locale: "en", + timeFormat: 12, + whitelistWorkflows: false, + }, + }); + + const workflow = await prismock.workflow.create({ + data: { + id: 3, + name: "Test Workflow 3", + userId: user.id, + trigger: WorkflowTriggerEvents.BEFORE_EVENT, + time: 1, + timeUnit: TimeUnit.HOUR, + }, + }); + + await prismock.workflowStep.create({ + data: { + id: 202, + stepNumber: 1, + action: WorkflowActions.EMAIL_HOST, + template: WorkflowTemplates.REMINDER, + workflowId: workflow.id, + reminderBody: "Default template body", + }, + }); + + const eventType = await prismock.eventType.create({ + data: { + id: 3, + title: "Test Event 3", + slug: "test-event-3", + length: 30, + userId: user.id, + }, + }); + + await prismock.workflowsOnEventTypes.create({ + data: { + workflowId: workflow.id, + eventTypeId: eventType.id, + }, + }); + + const payload = JSON.stringify({ + userId: 3, + workflowStepId: 202, + }); + + await scanWorkflowBody(payload); + + // Should mark as verified since body matches template + const updatedStep = await prismock.workflowStep.findUnique({ + where: { id: 202 }, + }); + expect(updatedStep?.verifiedAt).toBeTruthy(); + }); + + test("should skip processing when newer task exists", async () => { + vi.mocked(Task.hasNewerScanTaskForStepId).mockResolvedValueOnce(true); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 999, + createdAt: new Date().toISOString(), + }); + + await scanWorkflowBody(payload); + + // Should not submit for URL scanning + expect(submitWorkflowStepForUrlScanning).not.toHaveBeenCalled(); + }); + + test("should handle deprecated workflowStepIds array", async () => { + const user = await prismock.user.create({ + data: { + id: 4, + email: "test4@example.com", + locale: "en", + timeFormat: 12, + whitelistWorkflows: false, + }, + }); + + const workflow = await prismock.workflow.create({ + data: { + id: 4, + name: "Test Workflow 4", + userId: user.id, + trigger: WorkflowTriggerEvents.BEFORE_EVENT, + time: 1, + timeUnit: TimeUnit.HOUR, + }, + }); + + await prismock.workflowStep.create({ + data: { + id: 203, + stepNumber: 1, + action: WorkflowActions.EMAIL_HOST, + template: WorkflowTemplates.REMINDER, + workflowId: workflow.id, + reminderBody: 'Hello link
', + }, + }); + + const eventType = await prismock.eventType.create({ + data: { + id: 4, + title: "Test Event 4", + slug: "test-event-4", + length: 30, + userId: user.id, + }, + }); + + await prismock.workflowsOnEventTypes.create({ + data: { + workflowId: workflow.id, + eventTypeId: eventType.id, + }, + }); + + const payload = JSON.stringify({ + userId: 4, + workflowStepIds: [203], // Using deprecated array format + }); + + await scanWorkflowBody(payload); + + // Should submit for URL scanning + expect(submitWorkflowStepForUrlScanning).toHaveBeenCalled(); + }); + }); + + describe("unhappy paths", () => { + test("should return early when no step IDs provided", async () => { + const payload = JSON.stringify({ + userId: 1, + }); + + await scanWorkflowBody(payload); + + // Should not submit for URL scanning + expect(submitWorkflowStepForUrlScanning).not.toHaveBeenCalled(); + expect(scheduleWorkflowNotifications).not.toHaveBeenCalled(); + }); + + test("should return early when workflow not found after processing steps", async () => { + // This test verifies that the function returns early when the workflow + // associated with the step IDs is not found (after the initial step processing) + // Note: In practice, this scenario is rare since workflow steps are always + // associated with a workflow, but the code handles it gracefully by logging + // a warning and returning early. + + const payload = JSON.stringify({ + userId: 5, + workflowStepIds: [999], // Non-existent step IDs + }); + + // Should not throw - the function returns early when no steps are found + await expect(scanWorkflowBody(payload)).resolves.not.toThrow(); + + // Should not schedule notifications since no workflow was found + expect(scheduleWorkflowNotifications).not.toHaveBeenCalled(); + }); + + test("should pass whitelistWorkflows flag when user is whitelisted", async () => { + const user = await prismock.user.create({ + data: { + id: 6, + email: "test6@example.com", + locale: "en", + timeFormat: 12, + whitelistWorkflows: true, // Whitelisted user + }, + }); + + const workflow = await prismock.workflow.create({ + data: { + id: 6, + name: "Test Workflow 6", + userId: user.id, + trigger: WorkflowTriggerEvents.BEFORE_EVENT, + time: 1, + timeUnit: TimeUnit.HOUR, + }, + }); + + await prismock.workflowStep.create({ + data: { + id: 205, + stepNumber: 1, + action: WorkflowActions.EMAIL_HOST, + template: WorkflowTemplates.REMINDER, + workflowId: workflow.id, + reminderBody: 'Hello link
', + }, + }); + + const eventType = await prismock.eventType.create({ + data: { + id: 6, + title: "Test Event 6", + slug: "test-event-6", + length: 30, + userId: user.id, + }, + }); + + await prismock.workflowsOnEventTypes.create({ + data: { + workflowId: workflow.id, + eventTypeId: eventType.id, + }, + }); + + const payload = JSON.stringify({ + userId: 6, + workflowStepId: 205, + }); + + await scanWorkflowBody(payload); + + // Should pass whitelistWorkflows=true + expect(submitWorkflowStepForUrlScanning).toHaveBeenCalledWith( + 205, + expect.any(String), + 6, + true + ); + }); + }); + + describe("iffyScanBody", () => { + afterEach(() => { + vi.unstubAllGlobals(); + }); + + test("should return flagged status from Iffy API", async () => { + const mockFetch = vi.fn().mockResolvedValue({ + json: () => Promise.resolve({ flagged: true }), + }); + vi.stubGlobal("fetch", mockFetch); + + process.env.IFFY_API_KEY = "test-api-key"; + + const result = await iffyScanBody("spam content", 100); + + expect(result).toBe(true); + expect(mockFetch).toHaveBeenCalledWith( + "https://api.iffy.com/api/v1/moderate", + expect.objectContaining({ + method: "POST", + headers: expect.objectContaining({ + "Content-Type": "application/json", + Authorization: "Bearer test-api-key", + }), + body: expect.stringContaining("spam content"), + }) + ); + }); + + test("should return false when content is not flagged", async () => { + const mockFetch = vi.fn().mockResolvedValue({ + json: () => Promise.resolve({ flagged: false }), + }); + vi.stubGlobal("fetch", mockFetch); + + process.env.IFFY_API_KEY = "test-api-key"; + + const result = await iffyScanBody("normal content", 100); + + expect(result).toBe(false); + }); + + test("should handle API errors gracefully", async () => { + const mockFetch = vi.fn().mockRejectedValue(new Error("API error")); + vi.stubGlobal("fetch", mockFetch); + + process.env.IFFY_API_KEY = "test-api-key"; + + const result = await iffyScanBody("content", 100); + + // Should return undefined on error (fail-open) + expect(result).toBeUndefined(); + }); + }); +}); diff --git a/packages/features/tasker/tasks/test/scanWorkflowUrls.test.ts b/packages/features/tasker/tasks/test/scanWorkflowUrls.test.ts new file mode 100644 index 0000000000..2bdf6d3d31 --- /dev/null +++ b/packages/features/tasker/tasks/test/scanWorkflowUrls.test.ts @@ -0,0 +1,478 @@ +import prismock from "@calcom/testing/lib/__mocks__/prisma"; + +import { describe, expect, test, vi, beforeEach } from "vitest"; + +import tasker from "@calcom/features/tasker"; + +import { + scanWorkflowUrls, + submitWorkflowStepForUrlScanning, + submitUrlForUrlScanning, +} from "../scanWorkflowUrls"; + +// Mock the urlScanner module +vi.mock("@calcom/features/ee/workflows/lib/urlScanner", () => ({ + extractUrlsFromHtml: vi.fn((html: string) => { + // Simple mock implementation + const urls: string[] = []; + const hrefRegex = /href=["']([^"']+)["']/gi; + for (const match of Array.from(html.matchAll(hrefRegex))) { + const url = match[1]; + if (url.startsWith("http://") || url.startsWith("https://")) { + urls.push(url); + } + } + return urls; + }), + submitUrlForScanning: vi.fn().mockResolvedValue({ scanId: "mock-scan-id" }), + getScanResult: vi.fn().mockResolvedValue({ + url: "https://example.com", + scanId: "mock-scan-id", + status: "completed", + malicious: false, + categories: [], + }), + isUrlScanningEnabled: vi.fn().mockReturnValue(true), +})); + +// Mock the tasker +vi.mock("@calcom/features/tasker", () => ({ + default: { + create: vi.fn().mockResolvedValue(undefined), + }, +})); + +// Mock the autoLock module +vi.mock("@calcom/features/ee/api-keys/lib/autoLock", () => ({ + LockReason: { + MALICIOUS_URL_IN_WORKFLOW: "MALICIOUS_URL_IN_WORKFLOW", + }, + lockUser: vi.fn().mockResolvedValue(undefined), +})); + +// Import mocked modules for assertions +import * as urlScanner from "@calcom/features/ee/workflows/lib/urlScanner"; +import { lockUser } from "@calcom/features/ee/api-keys/lib/autoLock"; + +describe("scanWorkflowUrls", () => { + beforeEach(() => { + vi.clearAllMocks(); + }); + + describe("scanWorkflowUrls task handler", () => { + describe("happy paths", () => { + test("should skip scanning when URL scanning is disabled", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValueOnce(false); + + // Create a workflow step in prismock first + await prismock.workflowStep.create({ + data: { + id: 100, + stepNumber: 1, + action: "EMAIL_HOST", + template: "REMINDER", + workflowId: 1, + }, + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 100, + urls: ["https://example.com"], + }); + + await scanWorkflowUrls(payload); + + // Should mark workflow step as verified + const workflowStep = await prismock.workflowStep.findUnique({ + where: { id: 100 }, + }); + expect(workflowStep?.verifiedAt).toBeTruthy(); + expect(urlScanner.submitUrlForScanning).not.toHaveBeenCalled(); + }); + + test("should submit URLs for scanning in phase 1", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.submitUrlForScanning).mockResolvedValue({ scanId: "scan-123" }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 100, + urls: ["https://example.com", "https://another.com"], + }); + + await scanWorkflowUrls(payload); + + expect(urlScanner.submitUrlForScanning).toHaveBeenCalledTimes(2); + expect(urlScanner.submitUrlForScanning).toHaveBeenCalledWith("https://example.com"); + expect(urlScanner.submitUrlForScanning).toHaveBeenCalledWith("https://another.com"); + + // Should schedule follow-up task + expect(tasker.create).toHaveBeenCalledWith( + "scanWorkflowUrls", + expect.objectContaining({ + userId: 1, + workflowStepId: 100, + pendingScans: expect.arrayContaining([ + expect.objectContaining({ url: "https://example.com", scanId: "scan-123" }), + ]), + pollAttempts: 0, + }), + expect.objectContaining({ scheduledAt: expect.any(Date) }) + ); + }); + + test("should poll for scan results in phase 2 and mark as verified when clean", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.getScanResult).mockResolvedValue({ + url: "https://example.com", + scanId: "scan-123", + status: "completed", + malicious: false, + categories: [], + }); + + // Create a workflow step in prismock + await prismock.workflowStep.create({ + data: { + id: 100, + stepNumber: 1, + action: "EMAIL_HOST", + template: "REMINDER", + workflowId: 1, + }, + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 100, + pendingScans: [{ url: "https://example.com", scanId: "scan-123" }], + pollAttempts: 0, + }); + + await scanWorkflowUrls(payload); + + expect(urlScanner.getScanResult).toHaveBeenCalledWith("scan-123"); + + // Should mark workflow step as verified + const workflowStep = await prismock.workflowStep.findUnique({ + where: { id: 100 }, + }); + expect(workflowStep?.verifiedAt).toBeTruthy(); + }); + }); + + describe("unhappy paths", () => { + test("should lock user when malicious URL is detected", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.getScanResult).mockResolvedValue({ + url: "https://malicious.com", + scanId: "scan-123", + status: "completed", + malicious: true, + categories: ["phishing"], + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 100, + pendingScans: [{ url: "https://malicious.com", scanId: "scan-123" }], + pollAttempts: 0, + }); + + await scanWorkflowUrls(payload); + + expect(lockUser).toHaveBeenCalledWith("userId", "1", "MALICIOUS_URL_IN_WORKFLOW"); + }); + + test("should not lock whitelisted user when malicious URL is detected", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.getScanResult).mockResolvedValue({ + url: "https://malicious.com", + scanId: "scan-123", + status: "completed", + malicious: true, + categories: ["phishing"], + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 100, + pendingScans: [{ url: "https://malicious.com", scanId: "scan-123" }], + pollAttempts: 0, + whitelistWorkflows: true, + }); + + await scanWorkflowUrls(payload); + + expect(lockUser).not.toHaveBeenCalled(); + }); + + test("should mark as verified when max poll attempts reached (fail-open)", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + + // Create a workflow step in prismock + await prismock.workflowStep.create({ + data: { + id: 101, + stepNumber: 1, + action: "EMAIL_HOST", + template: "REMINDER", + workflowId: 1, + }, + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 101, + pendingScans: [{ url: "https://example.com", scanId: "scan-123" }], + pollAttempts: 10, // MAX_POLL_ATTEMPTS + }); + + await scanWorkflowUrls(payload); + + // Should mark workflow step as verified (fail-open) + const workflowStep = await prismock.workflowStep.findUnique({ + where: { id: 101 }, + }); + expect(workflowStep?.verifiedAt).toBeTruthy(); + }); + + test("should mark as verified when all URL submissions fail (fail-open)", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.submitUrlForScanning).mockResolvedValue({ error: "API error" }); + + // Create a workflow step in prismock + await prismock.workflowStep.create({ + data: { + id: 102, + stepNumber: 1, + action: "EMAIL_HOST", + template: "REMINDER", + workflowId: 1, + }, + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 102, + urls: ["https://example.com"], + }); + + await scanWorkflowUrls(payload); + + // Should mark workflow step as verified (fail-open) + const workflowStep = await prismock.workflowStep.findUnique({ + where: { id: 102 }, + }); + expect(workflowStep?.verifiedAt).toBeTruthy(); + }); + + test("should schedule another poll when scan is still pending", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.getScanResult).mockResolvedValue(null); // Still pending + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 100, + pendingScans: [{ url: "https://example.com", scanId: "scan-123" }], + pollAttempts: 0, + }); + + await scanWorkflowUrls(payload); + + // Should schedule another poll + expect(tasker.create).toHaveBeenCalledWith( + "scanWorkflowUrls", + expect.objectContaining({ + userId: 1, + workflowStepId: 100, + pendingScans: [{ url: "https://example.com", scanId: "scan-123" }], + pollAttempts: 1, + }), + expect.objectContaining({ scheduledAt: expect.any(Date) }) + ); + }); + + test("should treat scan errors as non-malicious (fail-open)", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.getScanResult).mockResolvedValue({ + url: "https://example.com", + scanId: "scan-123", + status: "error", + error: "Scan failed", + }); + + // Create a workflow step in prismock + await prismock.workflowStep.create({ + data: { + id: 103, + stepNumber: 1, + action: "EMAIL_HOST", + template: "REMINDER", + workflowId: 1, + }, + }); + + const payload = JSON.stringify({ + userId: 1, + workflowStepId: 103, + pendingScans: [{ url: "https://example.com", scanId: "scan-123" }], + pollAttempts: 0, + }); + + await scanWorkflowUrls(payload); + + // Should mark workflow step as verified (fail-open for errors) + const workflowStep = await prismock.workflowStep.findUnique({ + where: { id: 103 }, + }); + expect(workflowStep?.verifiedAt).toBeTruthy(); + }); + }); + }); + + describe("submitWorkflowStepForUrlScanning", () => { + describe("happy paths", () => { + test("should create task when URLs are found in reminder body", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.extractUrlsFromHtml).mockReturnValue(["https://example.com"]); + + await submitWorkflowStepForUrlScanning( + 100, + 'Link', + 1, + false + ); + + expect(tasker.create).toHaveBeenCalledWith( + "scanWorkflowUrls", + expect.objectContaining({ + userId: 1, + workflowStepId: 100, + urls: ["https://example.com"], + whitelistWorkflows: false, + }) + ); + }); + + test("should pass whitelistWorkflows parameter", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.extractUrlsFromHtml).mockReturnValue(["https://example.com"]); + + await submitWorkflowStepForUrlScanning( + 100, + 'Link', + 1, + true + ); + + expect(tasker.create).toHaveBeenCalledWith( + "scanWorkflowUrls", + expect.objectContaining({ + whitelistWorkflows: true, + }) + ); + }); + }); + + describe("unhappy paths", () => { + test("should mark as verified when URL scanning is disabled", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(false); + + // Create a workflow step in prismock + await prismock.workflowStep.create({ + data: { + id: 104, + stepNumber: 1, + action: "EMAIL_HOST", + template: "REMINDER", + workflowId: 1, + }, + }); + + await submitWorkflowStepForUrlScanning( + 104, + 'Link', + 1, + false + ); + + // Should mark workflow step as verified + const workflowStep = await prismock.workflowStep.findUnique({ + where: { id: 104 }, + }); + expect(workflowStep?.verifiedAt).toBeTruthy(); + expect(tasker.create).not.toHaveBeenCalled(); + }); + + test("should mark as verified when no URLs are found", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + vi.mocked(urlScanner.extractUrlsFromHtml).mockReturnValue([]); + + // Create a workflow step in prismock + await prismock.workflowStep.create({ + data: { + id: 105, + stepNumber: 1, + action: "EMAIL_HOST", + template: "REMINDER", + workflowId: 1, + }, + }); + + await submitWorkflowStepForUrlScanning(105, "No links here
", 1, false); + + // Should mark workflow step as verified + const workflowStep = await prismock.workflowStep.findUnique({ + where: { id: 105 }, + }); + expect(workflowStep?.verifiedAt).toBeTruthy(); + expect(tasker.create).not.toHaveBeenCalled(); + }); + }); + }); + + describe("submitUrlForUrlScanning", () => { + describe("happy paths", () => { + test("should create task for event type redirect URL", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + + await submitUrlForUrlScanning("https://redirect.com", 1, 50, false); + + expect(tasker.create).toHaveBeenCalledWith( + "scanWorkflowUrls", + expect.objectContaining({ + userId: 1, + eventTypeId: 50, + urls: ["https://redirect.com"], + whitelistWorkflows: false, + }) + ); + }); + + test("should pass whitelistWorkflows parameter", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(true); + + await submitUrlForUrlScanning("https://redirect.com", 1, 50, true); + + expect(tasker.create).toHaveBeenCalledWith( + "scanWorkflowUrls", + expect.objectContaining({ + whitelistWorkflows: true, + }) + ); + }); + }); + + describe("unhappy paths", () => { + test("should skip when URL scanning is disabled", async () => { + vi.mocked(urlScanner.isUrlScanningEnabled).mockReturnValue(false); + + await submitUrlForUrlScanning("https://redirect.com", 1, 50, false); + + expect(tasker.create).not.toHaveBeenCalled(); + }); + }); + }); +}); diff --git a/packages/lib/constants.ts b/packages/lib/constants.ts index 20bf534c81..f4c9b56e68 100644 --- a/packages/lib/constants.ts +++ b/packages/lib/constants.ts @@ -176,7 +176,7 @@ export const IS_VISUAL_REGRESSION_TESTING = Boolean(globalThis.window?.Meticulou export const BOOKER_NUMBER_OF_DAYS_TO_LOAD = parseInt( process.env.NEXT_PUBLIC_BOOKER_NUMBER_OF_DAYS_TO_LOAD ?? "0", - 0 + 10 ); export const CLOUDFLARE_SITE_ID = process.env.NEXT_PUBLIC_CLOUDFLARE_SITEKEY; @@ -223,6 +223,10 @@ export const GOOGLE_CALENDAR_SCOPES = [ export const DIRECTORY_IDS_TO_LOG = process.env.DIRECTORY_IDS_TO_LOG?.split(",") || []; export const SCANNING_WORKFLOW_STEPS = !!(!IS_SELF_HOSTED && process.env.IFFY_API_KEY); +// Cloudflare URL Scanner - checks URLs for malicious content in workflows and event types +export const URL_SCANNING_ENABLED = + !!process.env.CLOUDFLARE_URL_SCANNER_API_TOKEN && !!process.env.CLOUDFLARE_ACCOUNT_ID; + export const IS_DUB_REFERRALS_ENABLED = !!process.env.NEXT_PUBLIC_DUB_PROGRAM_ID && process.env.NEXT_PUBLIC_DUB_PROGRAM_ID !== ""; diff --git a/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts b/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts index 4fbaf38a8e..4c07039985 100644 --- a/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts +++ b/packages/trpc/server/routers/viewer/eventTypes/heavy/update.handler.ts @@ -9,11 +9,13 @@ import { allowDisablingAttendeeConfirmationEmails, allowDisablingHostConfirmationEmails, } from "@calcom/features/ee/workflows/lib/allowDisablingStandardEmails"; +import { isUrlScanningEnabled } from "@calcom/features/ee/workflows/lib/urlScanner"; import { HashedLinkRepository } from "@calcom/features/hashedLink/lib/repository/HashedLinkRepository"; import { HashedLinkService } from "@calcom/features/hashedLink/lib/service/HashedLinkService"; import { MembershipRepository } from "@calcom/features/membership/repositories/MembershipRepository"; import { ScheduleRepository } from "@calcom/features/schedules/repositories/ScheduleRepository"; import tasker from "@calcom/features/tasker"; +import { submitUrlForUrlScanning } from "@calcom/features/tasker/tasks/scanWorkflowUrls"; import { validateIntervalLimitOrder } from "@calcom/lib/intervalLimits/validateIntervalLimitOrder"; import logger from "@calcom/lib/logger"; import { getTranslation } from "@calcom/lib/server/i18n"; @@ -601,7 +603,7 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => { }, }); // Make sure the secondary email id belongs to the current user and its a verified one - if (secondaryEmail && secondaryEmail.emailVerified) { + if (secondaryEmail?.emailVerified) { data.secondaryEmail = { connect: { id: secondaryEmailId, @@ -752,6 +754,11 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => { }); } + // Scan redirect URL for malicious content if URL scanning is enabled + if (isUrlScanningEnabled() && rest.successRedirectUrl) { + await submitUrlForUrlScanning(rest.successRedirectUrl, ctx.user.id, id); + } + const res = ctx.res as NextApiResponse; if (typeof res?.revalidate !== "undefined") { try {