fix: add URL validation to calendar integration endpoints by pedroccastro · Pull Request #28768 · calcom/cal.diy

pedroccastro · 2026-04-06T21:26:20Z

What does this PR do?

Adds URL validation to calendar integration setup endpoints, consistent with how webhook endpoints already validate URLs.

Changes

Added URL validation to CalDAV, Exchange 2013/2016, Exchange, and ICS Feed add endpoints
Added Zod schemas for CalDAV and ICS Feed input validation
Added tests covering URL validation

How should this be tested?

Automated

TZ=UTC yarn vitest run packages/app-store/tests/calendar-ssrf-validation.test.ts

Manual

Add a CalDAV calendar with a valid URL → should succeed
Add an ICS feed with a valid URL → should succeed
Verify Exchange integrations work normally

Mandatory Tasks

I have self-reviewed the code (A decent size PR without self-review might be rejected).
I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
I confirm automated tests are in place that prove my fix is effective or that my feature works.

coderabbitai · 2026-04-07T20:41:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 615fca54-9a4d-4081-9680-3b0e03f07f06

📥 Commits

Reviewing files that changed from the base of the PR and between cf251e0 and c3956be.

📒 Files selected for processing (2)

packages/app-store/ics-feedcalendar/api/add.schema.ts
packages/app-store/tests/calendar-ssrf-validation.test.ts

✅ Files skipped from review due to trivial changes (1)

packages/app-store/ics-feedcalendar/api/add.schema.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/app-store/tests/calendar-ssrf-validation.test.ts

📝 Walkthrough

Walkthrough

This PR adds SSRF URL validation to multiple calendar integration API endpoints and introduces Zod request-body schemas for CalDAV and ICS Feed. Handlers for CalDAV, Exchange 2013, Exchange 2016, and the Exchange classic path call validateUrlForSSRF() and return HTTP 400 when validation fails. A new Vitest suite exercises blocked and allowed URL scenarios across these handlers.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: add URL validation to calendar integration endpoints' directly and clearly summarizes the main change: adding URL validation across calendar integration endpoints.
Description check	✅ Passed	The description is well-related to the changeset, explaining what is being added (URL validation and Zod schemas), which endpoints are affected, testing instructions, and confirming mandatory tasks are completed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/calendar-integration-url-validation

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

packages/app-store/caldavcalendar/api/add.schema.ts (1)

3-7: Tighten credential fields to reject empty input early.

z.string() permits empty strings for username/password. Consider enforcing non-empty values at schema level to fail earlier and avoid unnecessary downstream calls.

Suggested change

 export const caldavAddBodySchema = z.object({
-  username: z.string(),
-  password: z.string(),
+  username: z.string().min(1),
+  password: z.string().min(1),
   url: z.string().url(),
 });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/app-store/caldavcalendar/api/add.schema.ts` around lines 3 - 7, The
caldavAddBodySchema currently allows empty strings for username and password;
update caldavAddBodySchema to enforce non-empty values for those fields (e.g.,
change username: z.string() and password: z.string() to use
z.string().nonempty() or z.string().min(1) so validation fails early). Keep url
as z.string().url() and run unit/validation tests for any callers that construct
request bodies.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/app-store/ics-feedcalendar/api/add.schema.ts`:
- Around line 3-5: The icsFeedAddBodySchema currently allows an empty urls
array; update the schema for icsFeedAddBodySchema so the urls array requires at
least one element (use z.array(...).min(1)) and include a clear validation
message if desired; target the urls definition in icsFeedAddBodySchema to
enforce .min(1) on the array of z.string().url().

In `@packages/app-store/tests/calendar-ssrf-validation.test.ts`:
- Around line 84-180: Add SSRF unit tests for the two modified handlers to
mirror the existing Exchange 2013 cases: import the handler from
"exchange2016calendar/api/add" and the POST handler from
"exchangecalendar/api/_postAdd" (similar to how postHandler is derived in the
Exchange 2013 describe block), then write tests that (1) mockBlockedUrl/error
and assert a 400 response when a blocked URL is supplied, and (2) mockValidUrl
and assert a non-400 (allowed) response for a valid Exchange URL; also verify
that validateUrlForSSRF is called as expected when applicable. Ensure you reuse
the same helper patterns shown (createReqRes, CREDENTIAL_BODY, mockBlockedUrl,
mockValidUrl, validateUrlForSSRF) and assert status codes consistently with the
Exchange 2013 tests.

---

Nitpick comments:
In `@packages/app-store/caldavcalendar/api/add.schema.ts`:
- Around line 3-7: The caldavAddBodySchema currently allows empty strings for
username and password; update caldavAddBodySchema to enforce non-empty values
for those fields (e.g., change username: z.string() and password: z.string() to
use z.string().nonempty() or z.string().min(1) so validation fails early). Keep
url as z.string().url() and run unit/validation tests for any callers that
construct request bodies.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6881a801-6c7b-4711-b762-0e119409b6e6

📥 Commits

Reviewing files that changed from the base of the PR and between facc074 and cf251e0.

📒 Files selected for processing (8)

packages/app-store/caldavcalendar/api/add.schema.ts
packages/app-store/caldavcalendar/api/add.ts
packages/app-store/exchange2013calendar/api/add.ts
packages/app-store/exchange2016calendar/api/add.ts
packages/app-store/exchangecalendar/api/_postAdd.ts
packages/app-store/ics-feedcalendar/api/add.schema.ts
packages/app-store/ics-feedcalendar/api/add.ts
packages/app-store/tests/calendar-ssrf-validation.test.ts

… for Exchange 2016 and Classic

github-actions · 2026-04-07T21:26:55Z

E2E results are ready!

Workflow #107252.1 latest results

github-actions · 2026-04-15T00:43:59Z

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

pedroccastro added 2 commits April 6, 2026 16:15

fix: add URL validation to calendar integration endpoints

488e76b

chore: remove unrelated changes from branch

cf251e0

pull-request-size Bot added the size/L label Apr 6, 2026

pedroccastro marked this pull request as ready for review April 7, 2026 20:36

pedroccastro requested a review from a team as a code owner April 7, 2026 20:36

pedroccastro added the ready-for-e2e label Apr 7, 2026

coderabbitai Bot reviewed Apr 7, 2026

View reviewed changes

Comment thread packages/app-store/ics-feedcalendar/api/add.schema.ts

Comment thread packages/app-store/tests/calendar-ssrf-validation.test.ts

fix: enforce non-empty urls array in ICS Feed schema + add SSRF tests…

c3956be

… for Exchange 2016 and Classic

Merge branch 'main' into fix/calendar-integration-url-validation

b4d4f73

github-actions Bot added the Stale label Apr 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: add URL validation to calendar integration endpoints#28768

fix: add URL validation to calendar integration endpoints#28768
pedroccastro wants to merge 4 commits intomainfrom
fix/calendar-integration-url-validation

pedroccastro commented Apr 6, 2026

Uh oh!

coderabbitai Bot commented Apr 7, 2026 •

edited

Loading

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

pedroccastro commented Apr 6, 2026

What does this PR do?

Changes

How should this be tested?

Automated

Manual

Mandatory Tasks

Uh oh!

coderabbitai Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E results are ready!

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Apr 7, 2026 •

edited

Loading

github-actions Bot commented Apr 7, 2026 •

edited

Loading