🛂 Make sure customDomain can't be spoofed

Closes #569
baptisteArno · Mar 15, 2024 · a8a9259 · a8a9259
1 parent 663653e
commit a8a9259
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/apps/builder/src/features/typebot/api/updateTypebot.ts b/apps/builder/src/features/typebot/api/updateTypebot.ts
@@ -10,6 +10,7 @@ import { z } from 'zod'
 import {
   isCustomDomainNotAvailable,
   isPublicIdNotAvailable,
+  sanitizeCustomDomain,
   sanitizeGroups,
   sanitizeSettings,
 } from '../helpers/sanitizers'
@@ -201,8 +202,10 @@ export const updateTypebot = authenticatedProcedure
             : typebot.publicId && isPublicIdValid(typebot.publicId)
             ? typebot.publicId
             : undefined,
-        customDomain:
-          typebot.customDomain === null ? null : typebot.customDomain,
+        customDomain: await sanitizeCustomDomain({
+          customDomain: typebot.customDomain,
+          workspaceId: existingTypebot.workspace.id,
+        }),
         isClosed: typebot.isClosed,
         whatsAppCredentialsId: typebot.whatsAppCredentialsId ?? undefined,
         updatedAt: typebot.updatedAt,

diff --git a/apps/builder/src/features/typebot/helpers/sanitizers.ts b/apps/builder/src/features/typebot/helpers/sanitizers.ts
@@ -163,3 +163,20 @@ export const sanitizeFolderId = async ({
   })
   return folderCount !== 0 ? folderId : undefined
 }
+
+export const sanitizeCustomDomain = async ({
+  customDomain,
+  workspaceId,
+}: {
+  customDomain?: string | null
+  workspaceId: string
+}) => {
+  if (!customDomain) return customDomain
+  const domainCount = await prisma.customDomain.count({
+    where: {
+      name: customDomain?.split('/')[0],
+      workspaceId,
+    },
+  })
+  return domainCount === 0 ? null : customDomain
+}