fix(oracle-fusion): harden numeric and origin parsing

Author: BillLeoutsakosvl346

apps/sim/lib/credentials/client-credential-accounts/descriptors.test.ts

@@ -140,6 +140,9 @@ describe('normalizeOracleFusionApplicationOrigin', () => {
   it.each([
     'http://vision.fa.us2.oraclecloud.com',
     'https://vision.fa.us2.oraclecloud.com/path',
+    'https://vision.fa.us2.oraclecloud.com/path/..',
+    'https://vision.fa.us2.oraclecloud.com/./',
+    'https://vision.fa.us2.oraclecloud.com/%2e%2e/',
     'https://vision.fa.us2.oraclecloud.com:443',
     'https://vision.fa.us2.oraclecloud.com:8443',
     'https://user@vision.fa.us2.oraclecloud.com',

apps/sim/lib/credentials/client-credential-accounts/descriptors.ts

@@ -159,6 +159,8 @@ export function normalizeNetSuiteSuiteTalkOrigin(rawUrl: string): string | undef
 /** Canonical Oracle-assigned Fusion Applications origin used by product REST APIs. */
 export const ORACLE_FUSION_APPLICATION_ORIGIN_REGEX =
   /^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.fa\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.oraclecloud\.com$/
+const ORACLE_FUSION_APPLICATION_INPUT_REGEX =
+  /^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.fa\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.oraclecloud\.com\/?$/i
 
 /**
  * Normalizes a Fusion Applications URL to its authoritative HTTPS origin.
@@ -168,8 +170,7 @@ export const ORACLE_FUSION_APPLICATION_ORIGIN_REGEX =
 export function normalizeOracleFusionApplicationOrigin(rawUrl: string): string | undefined {
   try {
     const trimmed = rawUrl.trim()
-    const authority = /^https:\/\/([^/?#]+)/i.exec(trimmed)?.[1]
-    if (!authority || authority.includes(':')) return undefined
+    if (!ORACLE_FUSION_APPLICATION_INPUT_REGEX.test(trimmed)) return undefined
     const parsed = new URL(trimmed)
     if (
       parsed.protocol !== 'https:' ||

apps/sim/lib/credentials/client-credential-accounts/minters/oracle-fusion.test.ts

@@ -49,6 +49,8 @@ describe('mintOracleFusionServiceAccountToken', () => {
   it.each([
     'http://vision.fa.us2.oraclecloud.com',
     'https://vision.fa.us2.oraclecloud.com/path',
+    'https://vision.fa.us2.oraclecloud.com/path/..',
+    'https://vision.fa.us2.oraclecloud.com/%2e%2e/',
     'https://vision.fa.us2.oraclecloud.com:443',
     'https://user:password@vision.fa.us2.oraclecloud.com',
     'https://vision.fa.us2.oraclecloud.com?tenant=other',

apps/sim/lib/internal/oracle-fusion/client.test.ts

@@ -170,14 +170,17 @@ describe('requestOracleFusionJson', () => {
     mockSecureFetch.mockResolvedValueOnce(
       response(
         200,
-        '{"id":9007199254740993,"negative":-9007199254740993,"safe":9007199254740991,"decimal":9007199254740993.5}'
+        '{"id":9007199254740993,"negative":-9007199254740993,"zeroFraction":9007199254740993.0,"exponent":9.007199254740993e15,"hugeExponent":1e999,"safe":9007199254740991,"decimal":9007199254740993.5}'
       )
     )
     await expect(
       requestOracleFusionJson(CREDENTIAL, { family: 'hcm', path: 'workers' })
     ).resolves.toEqual({
       id: '9007199254740993',
       negative: '-9007199254740993',
+      zeroFraction: '9007199254740993.0',
+      exponent: '9.007199254740993e15',
+      hugeExponent: '1e999',
       safe: 9007199254740991,
       decimal: 9007199254740994,
     })

apps/sim/lib/internal/oracle-fusion/client.ts

@@ -21,7 +21,7 @@ const API_ROOTS = {
 const UNSAFE_PATH_ENCODING = /%(?:2e|2f|5c|3f|23)/i
 const ABSOLUTE_PATH = /^[a-z][a-z0-9+.-]*:/i
 const CANONICAL_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/
-const DECIMAL_INTEGER_TOKEN = /^-?\d+$/
+const JSON_NUMBER_TOKEN = /^-?(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/
 
 interface JsonParseContext {
   source?: string
@@ -97,13 +97,31 @@ function buildRequestUrl(origin: string, request: OracleFusionRequest): string {
   return url.toString()
 }
 
+function isIntegralJsonNumberToken(source: string): boolean {
+  const match = JSON_NUMBER_TOKEN.exec(source)
+  if (!match) return false
+  const coefficient = `${match[1]}${match[2] ?? ''}`
+  if (/^0+$/.test(coefficient)) return true
+
+  const fractionDigits = match[2]?.length ?? 0
+  const exponentSource = match[3] ?? '0'
+  const exponentDigits = exponentSource.replace(/^[+-]/, '').replace(/^0+/, '') || '0'
+  if (exponentDigits.length > 6) return !exponentSource.startsWith('-')
+  const exponent = Number(exponentSource)
+  const remainingFractionDigits = fractionDigits - exponent
+  if (remainingFractionDigits <= 0) return true
+  if (remainingFractionDigits > coefficient.length) return false
+  return coefficient
+    .slice(-remainingFractionDigits)
+    .split('')
+    .every((digit) => digit === '0')
+}
+
 function parseOracleFusionJson(body: string): unknown {
   return jsonParseWithSource(body, (_key, value, context) => {
-    if (typeof value !== 'number' || !Number.isInteger(value) || Number.isSafeInteger(value)) {
-      return value
-    }
+    if (typeof value !== 'number' || Number.isSafeInteger(value)) return value
     const source = context?.source
-    return source && DECIMAL_INTEGER_TOKEN.test(source) ? source : value
+    return source && isIntegralJsonNumberToken(source) ? source : value
   })
 }