improvement(executor): make the internal API URL builder explicit

buildAPIUrl picked its base from the path string, the same shape-derived trust the
tool transport just dropped. It is now buildInternalApiUrl: always the internal base,
and a non-/api/ path throws instead of quietly resolving elsewhere. Ids interpolated
into those paths are encoded.

Author: waleedlatif1

apps/sim/executor/handlers/agent/agent-handler.test.ts

@@ -91,7 +91,7 @@ vi.mock('@/providers', () => ({
 
 vi.mock('@/executor/utils/http', () => ({
   buildAuthHeaders: vi.fn().mockResolvedValue({ 'Content-Type': 'application/json' }),
-  buildAPIUrl: vi.fn((path: string, params?: Record<string, string>) => {
+  buildInternalApiUrl: vi.fn((path: string, params?: Record<string, string>) => {
     const url = new URL(path, 'http://localhost:3000')
     if (params) {
       for (const [key, value] of Object.entries(params)) {

apps/sim/executor/handlers/agent/agent-handler.ts

@@ -59,7 +59,7 @@ import type {
 import { parseResponseFormat } from '@/executor/handlers/shared/response-format'
 import type { BlockHandler, ExecutionContext, StreamingExecution } from '@/executor/types'
 import { collectBlockData } from '@/executor/utils/block-data'
-import { buildAPIUrl, buildAuthHeaders } from '@/executor/utils/http'
+import { buildAuthHeaders, buildInternalApiUrl } from '@/executor/utils/http'
 import { stringifyJSON } from '@/executor/utils/json'
 import { projectResolvedSecretDiagnosticContent } from '@/executor/utils/resolved-secret-content-projection'
 import { prepareResolvedSecretProjectedInputs } from '@/executor/utils/resolved-secret-input-projection'
@@ -1212,7 +1212,7 @@ export class AgentBlockHandler implements BlockHandler {
     }
 
     const headers = await buildAuthHeaders(ctx.userId)
-    const url = buildAPIUrl('/api/mcp/tools/discover', {
+    const url = buildInternalApiUrl('/api/mcp/tools/discover', {
       serverId,
       workspaceId: ctx.workspaceId,
       workflowId: ctx.workflowId,

apps/sim/executor/handlers/evaluator/evaluator-handler.ts

@@ -15,7 +15,11 @@ import type { BlockOutput } from '@/blocks/types'
 import { validateModelProvider } from '@/ee/access-control/utils/permission-check'
 import { BlockType, DEFAULTS, EVALUATOR } from '@/executor/constants'
 import type { BlockHandler, ExecutionContext } from '@/executor/types'
-import { buildAPIUrl, buildAuthHeaders, extractAPIErrorMessage } from '@/executor/utils/http'
+import {
+  buildAuthHeaders,
+  buildInternalApiUrl,
+  extractAPIErrorMessage,
+} from '@/executor/utils/http'
 import { isJSONString, parseJSON, stringifyJSON } from '@/executor/utils/json'
 import { projectResolvedSecretDiagnosticError } from '@/executor/utils/resolved-secret-content-projection'
 import type {
@@ -186,7 +190,7 @@ export class EvaluatorBlockHandler implements BlockHandler {
     }
 
     try {
-      const url = buildAPIUrl('/api/providers', ctx.userId ? { userId: ctx.userId } : {})
+      const url = buildInternalApiUrl('/api/providers', ctx.userId ? { userId: ctx.userId } : {})
 
       const providerRequest: ProviderRequest = {
         model,

apps/sim/executor/handlers/mothership/mothership-handler.test.ts

@@ -32,7 +32,7 @@ const PRIVATE_PROVENANCE = {
 const {
   mockAreModelSafeWorkspaceFileKeys,
   mockBuildAuthHeaders,
-  mockBuildAPIUrl,
+  mockBuildInternalApiUrl,
   mockExtractAPIErrorMessage,
   mockGenerateId,
   mockIsExecutionCancelled,
@@ -41,7 +41,7 @@ const {
 } = vi.hoisted(() => ({
   mockAreModelSafeWorkspaceFileKeys: vi.fn(),
   mockBuildAuthHeaders: vi.fn(),
-  mockBuildAPIUrl: vi.fn(),
+  mockBuildInternalApiUrl: vi.fn(),
   mockExtractAPIErrorMessage: vi.fn(),
   mockGenerateId: vi.fn(),
   mockIsExecutionCancelled: vi.fn(),
@@ -57,7 +57,7 @@ vi.mock('@/lib/uploads/contexts/workspace/workspace-file-secret-provenance', ()
 
 vi.mock('@/executor/utils/http', () => ({
   buildAuthHeaders: mockBuildAuthHeaders,
-  buildAPIUrl: mockBuildAPIUrl,
+  buildInternalApiUrl: mockBuildInternalApiUrl,
   extractAPIErrorMessage: mockExtractAPIErrorMessage,
 }))
 
@@ -155,7 +155,9 @@ describe('MothershipBlockHandler', () => {
     vi.stubGlobal('fetch', fetchMock)
 
     mockBuildAuthHeaders.mockResolvedValue({ Authorization: 'Bearer internal' })
-    mockBuildAPIUrl.mockReturnValue(new URL('/api/mothership/execute', 'http://localhost:3000'))
+    mockBuildInternalApiUrl.mockReturnValue(
+      new URL('/api/mothership/execute', 'http://localhost:3000')
+    )
     mockExtractAPIErrorMessage.mockResolvedValue('boom')
     mockGenerateId.mockReset()
     mockIsExecutionCancelled.mockReset()

apps/sim/executor/handlers/mothership/mothership-handler.ts

@@ -42,7 +42,11 @@ import type {
   NormalizedBlockOutput,
   StreamingExecution,
 } from '@/executor/types'
-import { buildAPIUrl, buildAuthHeaders, extractAPIErrorMessage } from '@/executor/utils/http'
+import {
+  buildAuthHeaders,
+  buildInternalApiUrl,
+  extractAPIErrorMessage,
+} from '@/executor/utils/http'
 import type {
   ResolvedSecretInputPath,
   ResolvedSecretTraceRegistry,
@@ -796,7 +800,7 @@ export class MothershipBlockHandler implements BlockHandler {
       requestId
     )
 
-    const url = buildAPIUrl('/api/mothership/execute')
+    const url = buildInternalApiUrl('/api/mothership/execute')
     const headers = await buildAuthHeaders(ctx.userId)
     headers.Accept = 'application/x-ndjson'
     headers[MOTHERSHIP_EXECUTE_STREAM_HEADER] = MOTHERSHIP_EXECUTE_STREAM_VALUE

apps/sim/executor/handlers/workflow/workflow-handler.test.ts

@@ -183,7 +183,7 @@ vi.mock('@/lib/auth/internal', () => ({
 
 vi.mock('@/executor/utils/http', () => ({
   buildAuthHeaders: vi.fn().mockResolvedValue({ 'Content-Type': 'application/json' }),
-  buildAPIUrl: vi.fn((path: string) => new URL(path, 'http://localhost:3000')),
+  buildInternalApiUrl: vi.fn((path: string) => new URL(path, 'http://localhost:3000')),
   extractAPIErrorMessage: vi.fn(async (response: Response) => {
     const defaultMessage = `API request failed with status ${response.status}`
     try {

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -42,7 +42,7 @@ import {
   type StreamingExecution,
 } from '@/executor/types'
 import { hasExecutionResult } from '@/executor/utils/errors'
-import { buildAPIUrl, buildAuthHeaders } from '@/executor/utils/http'
+import { buildAuthHeaders, buildInternalApiUrl } from '@/executor/utils/http'
 import { getIterationContext } from '@/executor/utils/iteration-context'
 import { parseJSON } from '@/executor/utils/json'
 import { lazyCleanupInputMapping } from '@/executor/utils/lazy-cleanup'
@@ -952,7 +952,7 @@ export class WorkflowBlockHandler implements BlockHandler {
 
   private async loadChildWorkflow(workflowId: string, userId?: string) {
     const headers = await buildAuthHeaders(userId)
-    const url = buildAPIUrl(`/api/workflows/${workflowId}`)
+    const url = buildInternalApiUrl(`/api/workflows/${encodeURIComponent(workflowId)}`)
 
     const response = await fetch(url.toString(), { headers })
 
@@ -1015,7 +1015,7 @@ export class WorkflowBlockHandler implements BlockHandler {
   private async checkChildDeployment(workflowId: string, userId?: string): Promise<boolean> {
     try {
       const headers = await buildAuthHeaders(userId)
-      const url = buildAPIUrl(`/api/workflows/${workflowId}/deployed`)
+      const url = buildInternalApiUrl(`/api/workflows/${encodeURIComponent(workflowId)}/deployed`)
 
       const response = await fetch(url.toString(), {
         headers,
@@ -1037,7 +1037,9 @@ export class WorkflowBlockHandler implements BlockHandler {
 
   private async loadChildWorkflowDeployed(workflowId: string, userId?: string) {
     const headers = await buildAuthHeaders(userId)
-    const deployedUrl = buildAPIUrl(`/api/workflows/${workflowId}/deployed`)
+    const deployedUrl = buildInternalApiUrl(
+      `/api/workflows/${encodeURIComponent(workflowId)}/deployed`
+    )
 
     const deployedRes = await fetch(deployedUrl.toString(), {
       headers,
@@ -1058,7 +1060,7 @@ export class WorkflowBlockHandler implements BlockHandler {
       throw new Error(`Deployed state missing or invalid for child workflow ${workflowId}`)
     }
 
-    const metaUrl = buildAPIUrl(`/api/workflows/${workflowId}`)
+    const metaUrl = buildInternalApiUrl(`/api/workflows/${encodeURIComponent(workflowId)}`)
     const metaRes = await fetch(metaUrl.toString(), {
       headers,
       cache: 'no-store',

apps/sim/executor/utils/http.test.ts

@@ -0,0 +1,54 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockGetInternalApiBaseUrl } = vi.hoisted(() => ({
+  mockGetInternalApiBaseUrl: vi.fn(),
+}))
+
+vi.mock('@/lib/core/utils/urls', () => ({
+  getInternalApiBaseUrl: mockGetInternalApiBaseUrl,
+}))
+
+vi.mock('@/lib/auth/internal', () => ({
+  generateInternalToken: vi.fn().mockResolvedValue('token'),
+}))
+
+import { buildInternalApiUrl } from '@/executor/utils/http'
+
+describe('buildInternalApiUrl', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetInternalApiBaseUrl.mockReturnValue('http://internal.sim.local')
+  })
+
+  it('resolves an internal path against the internal base URL', () => {
+    const url = buildInternalApiUrl('/api/workflows/wf-1')
+
+    expect(url.toString()).toBe('http://internal.sim.local/api/workflows/wf-1')
+  })
+
+  it('appends query params', () => {
+    const url = buildInternalApiUrl('/api/table/t-1', { workspaceId: 'ws-1' })
+
+    expect(url.searchParams.get('workspaceId')).toBe('ws-1')
+  })
+
+  it('rejects a path that is not an internal API route', () => {
+    expect(() => buildInternalApiUrl('/health')).toThrow(/must start with \/api\//)
+  })
+
+  it('rejects an absolute URL, which would escape the internal base', () => {
+    expect(() => buildInternalApiUrl('https://attacker.example/api/x')).toThrow(
+      /must start with \/api\//
+    )
+  })
+
+  it('keeps a traversal-shaped id inside its own path segment when encoded by the caller', () => {
+    const id = '../../admin/secrets'
+    const url = buildInternalApiUrl(`/api/table/${encodeURIComponent(id)}`)
+
+    expect(url.pathname).toBe('/api/table/..%2F..%2Fadmin%2Fsecrets')
+  })
+})

apps/sim/executor/utils/http.ts

@@ -1,5 +1,5 @@
 import { generateInternalToken } from '@/lib/auth/internal'
-import { getBaseUrl, getInternalApiBaseUrl } from '@/lib/core/utils/urls'
+import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
 import { HTTP } from '@/executor/constants'
 
 export async function buildAuthHeaders(userId?: string): Promise<Record<string, string>> {
@@ -15,9 +15,20 @@ export async function buildAuthHeaders(userId?: string): Promise<Record<string,
   return headers
 }
 
-export function buildAPIUrl(path: string, params?: Record<string, string>): URL {
-  const baseUrl = path.startsWith('/api/') ? getInternalApiBaseUrl() : getBaseUrl()
-  const url = new URL(path, baseUrl)
+/**
+ * Resolves a Sim-internal API path against the internal base URL. Callers pair this with
+ * {@link buildAuthHeaders}, so the path must be a fixed internal route the caller chose — never a
+ * caller- or model-supplied URL, and never a value interpolated into the path unencoded.
+ *
+ * @throws when `path` is not a relative `/api/` path, which would otherwise send an
+ * internally-signed request somewhere the caller did not intend.
+ */
+export function buildInternalApiUrl(path: string, params?: Record<string, string>): URL {
+  if (!path.startsWith('/api/')) {
+    throw new Error(`Internal API path must start with /api/: ${path}`)
+  }
+
+  const url = new URL(path, getInternalApiBaseUrl())
 
   if (params) {
     for (const [key, value] of Object.entries(params)) {

apps/sim/providers/utils.ts

@@ -84,10 +84,10 @@ async function fetchWorkflowMetadata(
   workflowId: string
 ): Promise<{ name: string; description: string | null } | null> {
   try {
-    const { buildAuthHeaders, buildAPIUrl } = await import('@/executor/utils/http')
+    const { buildAuthHeaders, buildInternalApiUrl } = await import('@/executor/utils/http')
 
     const headers = await buildAuthHeaders()
-    const url = buildAPIUrl(`/api/workflows/${workflowId}`)
+    const url = buildInternalApiUrl(`/api/workflows/${encodeURIComponent(workflowId)}`)
 
     const response = await fetch(url.toString(), { headers })
     if (!response.ok) {