Harden Project dependency graph and packages

Author: andz-bb

packages/server/src/ai/tools/budibase/rows.ts

@@ -378,6 +378,28 @@ const buildCollisionSafeToolName = (tableId: string, action: string) => {
   return `${sanitizedTableId.substring(0, tableIdLength)}${suffix}`
 }
 
+export const getRowToolNames = (tableId: string): Record<string, string> => {
+  const sanitizedTableId = tableId.replace(/[^A-Za-z0-9_-]/g, "_")
+  const truncatedToolNames = Object.fromEntries(
+    Object.keys(ROW_TOOL).map(action => [
+      action,
+      `${sanitizedTableId}_${action}`.substring(0, MAX_TOOL_NAME_LENGTH),
+    ])
+  )
+  const hasToolNameCollision =
+    new Set(Object.values(truncatedToolNames)).size !==
+    Object.keys(truncatedToolNames).length
+  if (!hasToolNameCollision) {
+    return truncatedToolNames
+  }
+  return Object.fromEntries(
+    Object.keys(ROW_TOOL).map(action => [
+      action,
+      buildCollisionSafeToolName(tableId, action),
+    ])
+  )
+}
+
 export const createRowTools = ({
   tableId,
   tableName,
@@ -404,23 +426,12 @@ export const createRowTools = ({
   const schemaSummary = buildSchemaSummary(writableFields)
   const dataSchema = buildRowDataSchema(writableFields, schemaSummary)
   const searchInputSchema = buildSearchInputSchema(schemaSummary)
+  const toolNames = getRowToolNames(tableId)
   const fields = getAgentTableFields(tableSchema)
-  const sanitizedTableId = tableId.replace(/[^A-Za-z0-9_-]/g, "_")
-  const truncatedToolNames = Object.fromEntries(
-    Object.keys(ROW_TOOL).map(action => [
-      action,
-      `${sanitizedTableId}_${action}`.substring(0, MAX_TOOL_NAME_LENGTH),
-    ])
-  )
-  const hasToolNameCollision =
-    new Set(Object.values(truncatedToolNames)).size !==
-    Object.keys(truncatedToolNames).length
 
   return Object.entries(ROW_TOOL).map(([action, def]) => {
     const description = `${formatActionLabel(action)} in "${tableName}". ${def.description}`
-    const toolName = hasToolNameCollision
-      ? buildCollisionSafeToolName(tableId, action)
-      : truncatedToolNames[action]
+    const toolName = toolNames[action]
     let inputSchema = def.inputSchema
     if (action === "create_row") {
       inputSchema = z.object({ data: dataSchema })

packages/server/src/api/routes/tests/datasource.spec.ts

@@ -515,6 +515,94 @@ describe("/datasources", () => {
       )
     })
 
+    it("detects embedded env var references", async () => {
+      const ds = await config.api.datasource.create({
+        type: "datasource",
+        name: "REST embedded env var",
+        source: SourceName.REST,
+        config: {
+          url: "https://{{ env.HOST }}/api",
+        },
+      })
+
+      expect(ds.usesEnvironmentVariables).toBe(true)
+    })
+
+    it("scrubs secrets containing mixed literals and env var references", async () => {
+      const ds = await config.api.datasource.create({
+        type: "datasource",
+        name: "REST mixed env secret",
+        source: SourceName.REST,
+        config: {
+          authConfigs: [
+            {
+              _id: generator.guid(),
+              name: "Mixed Env Auth",
+              type: RestAuthType.BASIC,
+              config: {
+                username: "{{ env.USERNAME }}",
+                password: "prefix {{ env.PASSWORD }}",
+              },
+            },
+          ],
+        },
+      })
+
+      expect(ds.usesEnvironmentVariables).toBe(true)
+      expect(ds.config!.authConfigs[0].config.password).toBe(
+        PASSWORD_REPLACEMENT
+      )
+    })
+
+    it("preserves secrets composed of adjacent env var references", async () => {
+      const password = "{{ env.PASSWORD_PREFIX }}{{ env.PASSWORD_SUFFIX }}"
+      const ds = await config.api.datasource.create({
+        type: "datasource",
+        name: "REST adjacent env secrets",
+        source: SourceName.REST,
+        config: {
+          authConfigs: [
+            {
+              _id: generator.guid(),
+              name: "Adjacent Env Auth",
+              type: RestAuthType.BASIC,
+              config: {
+                username: "{{ env.USERNAME }}",
+                password,
+              },
+            },
+          ],
+        },
+      })
+
+      expect(ds.config!.authConfigs[0].config.password).toBe(password)
+    })
+
+    it("scrubs secrets combining env and non-env bindings", async () => {
+      const ds = await config.api.datasource.create({
+        type: "datasource",
+        name: "REST mixed binding secret",
+        source: SourceName.REST,
+        config: {
+          authConfigs: [
+            {
+              _id: generator.guid(),
+              name: "Mixed Binding Auth",
+              type: RestAuthType.BASIC,
+              config: {
+                username: "{{ env.USERNAME }}",
+                password: "{{ env.PASSWORD }}{{ user.password }}",
+              },
+            },
+          ],
+        },
+      })
+
+      expect(ds.config!.authConfigs[0].config.password).toBe(
+        PASSWORD_REPLACEMENT
+      )
+    })
+
     it("scrubs sensitive longform fields in get response", async () => {
       const privateKey = [
         "-----BEGIN PRIVATE KEY-----",