Function validateFilePath

apps/sim/app/api/files/parse/route.ts:437–466

* Validate file path for security - prevents null byte injection and path traversal attacks. * * External URLs (`http`/`https`) are fetched over HTTP — with SSRF protection applied * downstream in `fetchExternalUrlToWorkspace` (DNS resolution + private/reserved IP blocking) * — and are never res

(filePath: string)

 * since that prefix is expected.
 */
function validateFilePath(filePath: string): { isValid: boolean; error?: string } {
  if (filePath.includes('\0')) {
    return { isValid: false, error: 'Invalid path: null byte detected' }
  }

  if (
    (filePath.startsWith('http://') || filePath.startsWith('https://')) &&
    !isInternalFileUrl(filePath)
  ) {
    return { isValid: true }
  }

  if (filePath.includes('..')) {
    return { isValid: false, error: 'Access denied: path traversal detected' }
  }

  if (filePath.includes('~')) {
    return { isValid: false, error: 'Invalid path: tilde character not allowed' }
  }

  if (filePath.startsWith('/') && !isInternalFileUrl(filePath)) {
    return { isValid: false, error: 'Path outside allowed directory' }
  }

  if (/^[A-Za-z]:\\/.test(filePath)) {
    return { isValid: false, error: 'Path outside allowed directory' }
  }

  return { isValid: true }
}

/**
 * Handle external URL.