From 761a8984846eb0104727cd4bc17b320ce45114a4 Mon Sep 17 00:00:00 2001 From: Victor Santos Date: Thu, 23 Oct 2025 16:40:54 -0300 Subject: [PATCH] feat(secret-sync): validate secret names using SecretNameSchema before processing --- backend/src/services/secret-sync/secret-sync-queue.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/backend/src/services/secret-sync/secret-sync-queue.ts b/backend/src/services/secret-sync/secret-sync-queue.ts index 63faf3b03..4b28564c0 100644 --- a/backend/src/services/secret-sync/secret-sync-queue.ts +++ b/backend/src/services/secret-sync/secret-sync-queue.ts @@ -63,6 +63,7 @@ import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal"; import { TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service"; import { TNotificationServiceFactory } from "../notification/notification-service"; import { NotificationType } from "../notification/notification-types"; +import { SecretNameSchema } from "@app/server/lib/schemas"; export type TSecretSyncQueueFactory = ReturnType; @@ -408,6 +409,14 @@ export const secretSyncQueueFactory = ({ if (!Object.keys(importedSecrets).length) return {}; + for (const [key] of Object.entries(importedSecrets)) { + const result = SecretNameSchema.safeParse(key); + if (!result.success) { + const errorMessage = result.error.issues[0]?.message || "Invalid secret name"; + throw new Error(`Invalid secret name "${key}": ${errorMessage}`); + } + } + const importedSecretMap: TSecretMap = {}; const secretMap = await $getInfisicalSecrets(secretSync, false);