fix(secrets): read visible values by own property so prototype-named secrets cannot poison the list

Author: icecrasher321

apps/sim/app/api/v2/secrets/route.test.ts

@@ -176,6 +176,37 @@ describe('GET /api/v2/secrets', () => {
     })
   })
 
+  it('never attaches an inherited prototype member as a missing value', async () => {
+    mocks.list.mockResolvedValue({
+      secrets: [
+        {
+          ...secret,
+          id: 'secret-proto',
+          displayName: 'constructor',
+          envKey: 'constructor',
+          unredacted: true,
+        },
+      ],
+      /** The name is legal but its value is absent — a bare index would read Object's constructor. */
+      values: {},
+      userId: 'user-1',
+      nextCursorKeys: null,
+      sortBy: 'name',
+      sortOrder: 'asc',
+    })
+
+    const response = await GET(
+      new NextRequest(`http://localhost:3000/api/v2/secrets?workspaceId=${WORKSPACE_ID}`, {
+        headers: { 'x-api-key': 'key' },
+      })
+    )
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(body.data[0]).toMatchObject({ name: 'constructor', unredacted: true })
+    expect(body.data[0]).not.toHaveProperty('value')
+  })
+
   /**
    * Pins the binding end-to-end — the mint in `present` and the read in
    * `mapInput` — because the contract-level sweep only checks a hand-maintained

apps/sim/app/api/v2/secrets/route.ts

@@ -42,7 +42,16 @@ export const GET = defineV2JsonRoute({
   useCase: listSecretsUseCase,
   present: ({ secrets, values, userId, nextCursorKeys }, { query }) => ({
     data: secrets.map((secret) =>
-      toV2Secret(secret, userId, secret.envKey ? values[secret.envKey] : undefined)
+      toV2Secret(
+        secret,
+        userId,
+        /**
+         * Own-property read: a secret may legally be named `constructor` or `toString`,
+         * and a bare index on a missing key would hand the inherited function to the
+         * serializer and fail response validation for the whole page.
+         */
+        secret.envKey && Object.hasOwn(values, secret.envKey) ? values[secret.envKey] : undefined
+      )
     ),
     nextCursor: writeSortedCursor(
       nextCursorKeys,

apps/sim/lib/credentials/secret-values.test.ts

@@ -269,4 +269,15 @@ describe('readWorkspaceSecretValues', () => {
     ).resolves.toEqual({})
     expect(mockDecryptSecret).not.toHaveBeenCalled()
   })
+
+  it('never reads an inherited prototype member for a missing key', async () => {
+    queueTableRows(schemaMock.workspaceEnvironment, [
+      { id: 'env-1', variables: { OTHER_KEY: 'encrypted-other' } },
+    ])
+
+    await expect(
+      readWorkspaceSecretValues({ workspaceId: 'workspace-1', names: ['constructor', 'toString'] })
+    ).resolves.toEqual({})
+    expect(mockDecryptSecret).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/credentials/secret-values.ts

@@ -51,7 +51,7 @@ export async function readWorkspaceSecretValues(params: {
   const values: Record<string, string> = {}
   await Promise.all(
     params.names.map(async (name) => {
-      const encrypted = variables[name]
+      const encrypted = Object.hasOwn(variables, name) ? variables[name] : undefined
       if (!encrypted) return
       try {
         const { decrypted } = await decryptSecret(encrypted)