Skip to content

Commit eb1e556

Browse files
waleedlatif1waleedlatif1
committed
fix(dataverse): strip the bearer token on the upload route's own redirect
`upload_file` posts to an internal route rather than calling Dataverse directly, so the tool-level `stripAuthOnRedirect` added in 903c94e only covers the same-origin hop into that route. The route's own outbound PATCH carries the caller's OAuth token and left redirect stripping at its default, so a redirect to a signed storage host — which is exactly how Dataverse serves file operations — would have handed that host a reusable credential. The other 17 tools build the Dataverse URL directly, so the tool-level flag already covers them.
1 parent 74cda71 commit eb1e556

1 file changed

Lines changed: 7 additions & 0 deletions

File tree

  • apps/sim/app/api/tools/microsoft-dataverse/upload-file

‎apps/sim/app/api/tools/microsoft-dataverse/upload-file/route.ts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,13 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
124124
'x-ms-file-name': validatedData.fileName,
125125
},
126126
body: fileBuffer,
127+
/**
128+
* The tool's own `stripAuthOnRedirect` only covers the hop to this
129+
* route. Dataverse redirects file operations to signed storage hosts,
130+
* so this outbound call has to drop the bearer token itself or the
131+
* redirect target receives a reusable OAuth credential.
132+
*/
133+
stripAuthOnRedirect: true,
127134
},
128135
'environmentUrl'
129136
)

0 commit comments

Comments
 (0)