Function secureFetch

apps/sim/lib/execution/isolated-vm.ts:291–328

(
  requestId: string,
  url: string,
  options?: IsolatedFetchOptions
)

}

async function secureFetch(
  requestId: string,
  url: string,
  options?: IsolatedFetchOptions
): Promise<string> {
  if (url.length > MAX_FETCH_URL_LENGTH) {
    return JSON.stringify({
      error: `Security Error: fetch URL exceeds maximum length (${MAX_FETCH_URL_LENGTH})`,
    })
  }

  try {
    const response = await secureFetchWithValidation(
      url,
      normalizeFetchOptions(options),
      'fetchUrl'
    )
    const bodyResult = truncateString(await response.text(), MAX_FETCH_RESPONSE_CHARS)
    const headers: Record<string, string> = {}
    for (const [key, value] of response.headers) {
      headers[key] = value
    }
    return JSON.stringify({
      ok: response.ok,
      status: response.status,
      statusText: response.statusText,
      body: bodyResult.value,
      bodyTruncated: bodyResult.truncated,
      headers,
    })
  } catch (error: unknown) {
    logger.warn(`[${requestId}] Isolated fetch failed`, {
      url: sanitizeUrlForLog(url),
      error: toError(error).message,
    })
    return JSON.stringify({ error: getErrorMessage(error, 'Unknown fetch error') })
  }
}

function normalizeOwnerKey(ownerKey?: string): string {
  if (!ownerKey) return 'anonymous'