Fix Promise.allSettled error handling and path traversal vulnerability

cursoragent · cursoragent · commit d1fd2cb4f079 · 2026-04-10T06:53:11.000Z
- Add explicit check for rejected chatResult status in mothership chat API
  to prevent silent error swallowing and operations on invalid chats
- Add endpoint parameter validation in admin mothership proxy to prevent
  path traversal attacks (restrict to alphanumeric, underscore, hyphen)
diff --git a/apps/sim/app/api/admin/mothership/route.ts b/apps/sim/app/api/admin/mothership/route.ts
@@ -41,6 +41,10 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: 'endpoint query param required' }, { status: 400 })
   }
 
+  if (!/^[a-zA-Z0-9_-]+$/.test(endpoint)) {
+    return NextResponse.json({ error: 'Invalid endpoint parameter' }, { status: 400 })
+  }
+
   const baseUrl = getMothershipUrl(environment)
   if (!baseUrl) {
     return NextResponse.json(
@@ -93,6 +97,10 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ error: 'endpoint query param required' }, { status: 400 })
   }
 
+  if (!/^[a-zA-Z0-9_-]+$/.test(endpoint)) {
+    return NextResponse.json({ error: 'Invalid endpoint parameter' }, { status: 400 })
+  }
+
   const baseUrl = getMothershipUrl(environment)
   if (!baseUrl) {
     return NextResponse.json(
diff --git a/apps/sim/app/api/mothership/chat/route.ts b/apps/sim/app/api/mothership/chat/route.ts
@@ -142,6 +142,14 @@ export async function POST(req: NextRequest) {
       return NextResponse.json({ error: 'Workspace not found or access denied' }, { status: 403 })
     }
 
+    if (chatResult.status === 'rejected') {
+      logger.error(`[${tracker.requestId}] Failed to resolve chat`, {
+        chatId,
+        error: chatResult.reason instanceof Error ? chatResult.reason.message : 'Unknown error',
+      })
+      return NextResponse.json({ error: 'Failed to resolve chat' }, { status: 500 })
+    }
+
     let currentChat: any = null
     let conversationHistory: any[] = []
     let actualChatId = chatId
