Function downloadFileFromUrl

apps/sim/lib/uploads/utils/file-utils.server.ts:175–224

(
  fileUrl: string,
  options: DownloadFileFromUrlOptions = {}
)

 * For external URLs, validates DNS/SSRF and uses secure fetch with IP pinning.
 */
export async function downloadFileFromUrl(
  fileUrl: string,
  options: DownloadFileFromUrlOptions = {}
): Promise<Buffer> {
  const { timeoutMs = getMaxExecutionTimeout(), maxBytes, userId } = options

  if (isInternalFileUrl(fileUrl)) {
    if (!userId) {
      logger.warn('Internal file download denied: no userId provided', { fileUrl })
      throw new Error('Access denied: internal file URL requires an authenticated user')
    }

    const key = extractStorageKey(fileUrl)
    if (!key) {
      logger.warn('Internal file download denied: could not resolve storage key', { fileUrl })
      throw new Error('Access denied: could not resolve internal file key')
    }

    const context = inferContextFromKey(key)

    const hasAccess = await verifyFileAccess(key, userId, undefined, context, false)
    if (!hasAccess) {
      logger.warn('Internal file download denied: access check failed', { key, context, userId })
      throw new Error('Access denied: file not found or insufficient permissions')
    }

    const { downloadFile } = await import('@/lib/uploads/core/storage-service')
    return downloadFile({ key, context, maxBytes })
  }

  const urlValidation = await validateUrlWithDNS(fileUrl, 'fileUrl')
  if (!urlValidation.isValid) {
    throw new Error(`Invalid file URL: ${urlValidation.error}`)
  }

  const response = await secureFetchWithPinnedIP(fileUrl, urlValidation.resolvedIP!, {
    timeout: timeoutMs,
    maxResponseBytes: maxBytes,
  })

  if (!response.ok) {
    await consumeOrCancelBody(response)
    throw new Error(`Failed to download file: ${response.statusText}`)
  }

  return readResponseToBufferWithLimit(response, {
    maxBytes: maxBytes ?? Number.MAX_SAFE_INTEGER,
    label: 'file download',
  })
}

export async function resolveInternalFileUrl(
  filePath: string,