fix(TimeOff): validate waiting period as integer in policy settings

[krisxcrash]

Summary

The API requires `accrualWaitingPeriodDays` to be an integer, but the form allowed decimal input, causing an unhandled Zod validation error. This change:

• Sets `maximumFractionDigits={0}` on the waiting-period `NumberInputField` to prevent decimal entry at the input level.
• Adds a form-level `validate` rule as a safety net that surfaces a clear error message when a decimal sneaks through.
• Adds the i18n key `policySettings.errors.waitingPeriodMustBeWholeNumber`.

Test plan

• `npm run test -- --run src/components/TimeOff/PolicySettings` — 34 tests pass (2 new under `describe('waiting period integer validation')`)
• `npm run i18n:generate` updates `src/types/i18next.d.ts`

History

This PR was originally a larger bundle that also contained ~73 e2e tests. After triage:

• The e2e tests that catch real regressions (12 of them) were extracted, rewritten on top of the scenario-driven infrastructure used by the rest of the time-off domain, and merged into the `e2e/timeoff-domain` PR (feat(e2e): time-off domain — scenario + spec rewrite #1834). Kristine credited as `Co-authored-by` on each of those commits.
• Brittle CSS/pixel/DOM-depth assertions and tests that duplicate the existing lifecycle suite were dropped.
• This PR was reduced to just the standalone product fix it always was.

[boostsecurity-io-ai]

⚠️  2 New Security Findings

The latest commit contains 2 new security findings.

Findings Note: 2 findings are displayed as inline comments.

Not a finding? Ignore it by adding a comment on the line with just the word noboost.

Scanner: boostsecurity - Semgrep

[boostsecurity-io-ai]

CWE-918: Server-Side Request Forgery (SSRF)
Original Rule ID: rules_lgpl_javascript_ssrf_rule-node-ssrf

Details

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

This rule detected user-controlled URLs being passed to Node.js HTTP client
libraries including axios.get(), axios.post(), fetch(), http.get(),
http.request(), needle(), request(), urllib.request(),
superagent.get(), bent(), got.get(), net.connect(), and
socket.io-client.io(). When user input controls the destination URL of HTTP
requests without validation, Server-Side Request Forgery (SSRF) vulnerabilities
arise. SSRF allows attackers to force the server to make requests to internal
systems, cloud metadata endpoints (such as 169.254.169.254), or other
unauthorized destinations. This can expose internal APIs, databases,
administrative panels, or enable network scanning and pivoting attacks that
bypass firewall rules and network segmentation.
 📘 Learn More

AI Remediation

Strict validation (using a regex allowlist) is added for both flowToken and policyId before constructing user-controlled URLs in the fetch call, preventing unsafe or malicious input and thus mitigating the potential for Server-Side Request Forgery (SSRF). This ensures only safe token and ID values are used in HTTP requests to internal endpoints.

At line 96, do the following changes:

 }
 
 export async function deactivateTimeOffPolicy(flowToken: string, policyId: string): Promise<void> {
+  // Validate flowToken and policyId against allowlist/regex before making the request
+  if (!/^[-\w]+$/.test(flowToken) || !/^[-\w]+$/.test(policyId)) {
+    throw new Error('Invalid input for flowToken or policyId')
+  }
   const response = await fetch(
     `${getGWSFlowsBase()}/fe_sdk/${flowToken}/v1/time_off_policies/${policyId}/deactivate`,
     { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: '{}' },

[boostsecurity-io-ai]

CWE-918: Server-Side Request Forgery (SSRF)
Original Rule ID: rules_lgpl_javascript_ssrf_rule-node-ssrf

Details

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

This rule detected user-controlled URLs being passed to Node.js HTTP client
libraries including axios.get(), axios.post(), fetch(), http.get(),
http.request(), needle(), request(), urllib.request(),
superagent.get(), bent(), got.get(), net.connect(), and
socket.io-client.io(). When user input controls the destination URL of HTTP
requests without validation, Server-Side Request Forgery (SSRF) vulnerabilities
arise. SSRF allows attackers to force the server to make requests to internal
systems, cloud metadata endpoints (such as 169.254.169.254), or other
unauthorized destinations. This can expose internal APIs, databases,
administrative panels, or enable network scanning and pivoting attacks that
bypass firewall rules and network segmentation.
 📘 Learn More

AI Remediation

A URL validation function was added to ensure that the endpoint being fetched is within an allowed base, uses http(s), and isn't directed toward private or metadata IP ranges. This protects against Server-Side Request Forgery (SSRF) by verifying that user-controlled components of the URL cannot target internal or unsafe addresses. The fix therefore mitigates the SSRF risk highlighted in the original security finding.

At line 95, do the following changes:

   return fetchApi<TimeOffPolicy>(endpoint)
 }
 
+function isSafeUrl(url: string): boolean {
+  try {
+    const allowedBase = getGWSFlowsBase();
+    const u = new URL(url);
+    if (!u.href.startsWith(allowedBase)) return false;
+    if (!(u.protocol === 'http:' || u.protocol === 'https:')) return false;
+    // Very basic private IP range check (improve as needed)
+    const host = u.hostname;
+    if (/^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/.test(host)) return false;
+    if (host === 'localhost' || host === '169.254.169.254') return false;
+    return true;
+  } catch { return false; }
+}
+
 export async function deactivateTimeOffPolicy(flowToken: string, policyId: string): Promise<void> {
+  const endpoint = `${getGWSFlowsBase()}/fe_sdk/${flowToken}/v1/time_off_policies/${policyId}/deactivate`;
+  if (!isSafeUrl(endpoint)) {
+    throw new Error('Unsafe URL detected in deactivateTimeOffPolicy');
+  }
   const response = await fetch(
-    `${getGWSFlowsBase()}/fe_sdk/${flowToken}/v1/time_off_policies/${policyId}/deactivate`,
+    endpoint,
     { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: '{}' },
-  )
+  );
   if (!response.ok) {
-    const errorText = await response.text()
-    throw new Error(`Deactivate policy failed (${response.status}): ${errorText}`)
+    const errorText = await response.text();
+    throw new Error(`Deactivate policy failed (${response.status}): ${errorText}`);
   }
 }
 

[jeffredodd]

Yay this is great that you did this for validating changes. Throwing a request changes on here so I can merge it into the e2e effort after I get the foundation merged.

[boostsecurity-io-ai]

🚀 2 New Security Fixes

You just committed 2 security fixes. 😎 Keep up the great work!

🎯 Take a look at what findings you fixed.

Findings
CWE-918: Server-Side Request Forgery (SSRF) Original Rule ID: rules_lgpl_javascript_ssrf_rule-node-ssrf The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This rule detected user-controlled URLs being passed to Node.js HTTP client libraries including axios.get(), axios.post(), fetch(), http.get(), http.request(), needle(), request(), urllib.request(), superagent.get(), bent(),...
📘 Learn More embedded-react-sdk/e2e/utils/timeOffHelpers.ts Line 144 in e1920e3 `${getGWSFlowsBase()}/fe_sdk/${flowToken}/v1/companies/${companyId}/holiday_pay_policy`,
CWE-918: Server-Side Request Forgery (SSRF) Original Rule ID: rules_lgpl_javascript_ssrf_rule-node-ssrf The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This rule detected user-controlled URLs being passed to Node.js HTTP client libraries including axios.get(), axios.post(), fetch(), http.get(), http.request(), needle(), request(), urllib.request(), superagent.get(), bent(),...
📘 Learn More embedded-react-sdk/e2e/utils/timeOffHelpers.ts Line 100 in e1920e3 `${getGWSFlowsBase()}/fe_sdk/${flowToken}/v1/time_off_policies/${policyId}/deactivate`,

Scanner: boostsecurity - Semgrep