fix(aws): restrict string consistentRead to true/false and validate SES tag parts

Author: waleedlatif1

apps/sim/lib/api/contracts/tools/aws/dynamodb-query.ts

@@ -34,7 +34,7 @@ const QuerySchema = z.object({
     }),
   projectionExpression: z.string().optional(),
   consistentRead: z
-    .union([z.boolean(), z.string()])
+    .union([z.boolean(), z.enum(['true', 'false'])])
     .optional()
     .transform((val) => {
       if (val === true || val === 'true') return true

apps/sim/lib/api/contracts/tools/aws/dynamodb-scan.ts

@@ -26,7 +26,7 @@ const ScanSchema = z
     exclusiveStartKey: z.record(z.string(), z.unknown()).optional(),
     indexName: z.string().optional(),
     consistentRead: z
-      .union([z.boolean(), z.string()])
+      .union([z.boolean(), z.enum(['true', 'false'])])
       .optional()
       .transform((val) => {
         if (val === true || val === 'true') return true

apps/sim/lib/api/contracts/tools/aws/ses-send-bulk-email.ts

@@ -7,6 +7,11 @@ import type {
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { validateAwsRegion } from '@/lib/core/security/input-validation'
 
+/** SES `MessageTag` name or value: 1-256 letters, digits, underscores, or hyphens. */
+const sesMessageTagPartSchema = z
+  .string()
+  .regex(/^[A-Za-z0-9_-]{1,256}$/, 'Tag names and values may contain only letters, digits, _ and -')
+
 const SendBulkEmailSchema = z.object({
   region: z
     .string()
@@ -23,7 +28,9 @@ const SendBulkEmailSchema = z.object({
   configurationSetName: z.string().nullish(),
   replyToAddresses: z.string().nullish(),
   fromName: z.string().nullish(),
-  emailTags: z.array(z.object({ name: z.string().min(1), value: z.string() })).nullish(),
+  emailTags: z
+    .array(z.object({ name: sesMessageTagPartSchema, value: sesMessageTagPartSchema }))
+    .nullish(),
 })
 
 const SendBulkEmailResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/ses-send-email.ts

@@ -8,6 +8,11 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 import { validateAwsRegion } from '@/lib/core/security/input-validation'
 import { RawFileInputArraySchema } from '@/lib/uploads/utils/file-schemas'
 
+/** SES `MessageTag` name or value: 1-256 letters, digits, underscores, or hyphens. */
+const sesMessageTagPartSchema = z
+  .string()
+  .regex(/^[A-Za-z0-9_-]{1,256}$/, 'Tag names and values may contain only letters, digits, _ and -')
+
 const SendEmailSchema = z
   .object({
     region: z
@@ -28,7 +33,9 @@ const SendEmailSchema = z
     replyToAddresses: z.string().nullish(),
     configurationSetName: z.string().nullish(),
     fromName: z.string().nullish(),
-    emailTags: z.array(z.object({ name: z.string().min(1), value: z.string() })).nullish(),
+    emailTags: z
+      .array(z.object({ name: sesMessageTagPartSchema, value: sesMessageTagPartSchema }))
+      .nullish(),
     attachments: RawFileInputArraySchema.nullish(),
   })
   .refine((data) => data.bodyText || data.bodyHtml, {

apps/sim/lib/api/contracts/tools/aws/ses-send-templated-email.ts

@@ -8,6 +8,11 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 import { validateAwsRegion } from '@/lib/core/security/input-validation'
 import { RawFileInputArraySchema } from '@/lib/uploads/utils/file-schemas'
 
+/** SES `MessageTag` name or value: 1-256 letters, digits, underscores, or hyphens. */
+const sesMessageTagPartSchema = z
+  .string()
+  .regex(/^[A-Za-z0-9_-]{1,256}$/, 'Tag names and values may contain only letters, digits, _ and -')
+
 const SendTemplatedEmailSchema = z.object({
   region: z
     .string()
@@ -26,7 +31,9 @@ const SendTemplatedEmailSchema = z.object({
   configurationSetName: z.string().nullish(),
   replyToAddresses: z.string().nullish(),
   fromName: z.string().nullish(),
-  emailTags: z.array(z.object({ name: z.string().min(1), value: z.string() })).nullish(),
+  emailTags: z
+    .array(z.object({ name: sesMessageTagPartSchema, value: sesMessageTagPartSchema }))
+    .nullish(),
   attachments: RawFileInputArraySchema.nullish(),
 })