chore: Add spam checking for workflow bodies #18822

joeauyeung · 2025-01-23T04:59:52Z

What does this PR do?

Adds a background task to scan workflow bodies for spam and auto locking the user is detected

Fixes #XXXX (GitHub issue number)
Fixes CAL-XXXX (Linear issue number - should be visible at the bottom of the GitHub issue description)

Mandatory Tasks (DO NOT REMOVE)

I have self-reviewed the code (A decent size PR without self-review might be rejected).
I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Create an Akismet API key and add it to AKISMET_API_KEY .env variable
Create a workflow with a normal body
- User shouldn't lock
Create a workflow with a spam body
- The user should auto lock

vercel · 2025-01-23T05:00:36Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

2 Skipped Deployments

Name	Status	Preview	Comments	Updated (UTC)
cal	⬜️ Ignored (Inspect)	Visit Preview		Jan 24, 2025 10:32pm
calcom-web-canary	⬜️ Ignored (Inspect)	Visit Preview		Jan 24, 2025 10:32pm

joeauyeung · 2025-01-23T05:00:57Z

packages/features/tasker/tasks/scanWorkflowBody.ts

+import prisma from "@calcom/prisma";
+
+export const scanWorkflowBodySchema = z.object({
+  userId: z.number(),


Need the userId to know which user to lock. This comes from the context of the workflow update tRPC endpoint.

joeauyeung · 2025-01-23T05:01:35Z

packages/features/tasker/tasks/scanWorkflowBody.ts

+  const client = new AkismetClient({ key: process.env.AKISMET_API_KEY, blog: WEBAPP_URL });
+
+  const comment: Comment = {
+    user_ip: "127.0.0.1",


Comment needs an IP. From Akismet support we can just use this.

IP is used for scanning against know abuse IPs and adding a reputation score.

packages/features/tasker/tasks/scanWorkflowBody.ts

graphite-app · 2025-01-23T05:10:11Z

Graphite Automations

"Add consumer team as reviewer" took an action on this PR • (01/23/25)

1 reviewer was added to this PR based on Keith Williams's automation.

"Add foundation team as reviewer" took an action on this PR • (01/23/25)

1 reviewer was added to this PR based on Keith Williams's automation.

packages/features/tasker/tasks/scanWorkflowBody.ts

joeauyeung · 2025-01-23T18:22:07Z

packages/features/tasker/tasks/scanWorkflowBody.ts

+  const isSpam = await client.checkSpam(comment);
+
+  if (isSpam) {
+    // We won't delete the workflow step incase it is flagged as a false positive


Good call on not deleting the step in the case of a false positive @Udit-takkar

joeauyeung · 2025-01-23T18:22:29Z

packages/prisma/migrations/20250123170615_add_workflowstep_safe/migration.sql

+-- AlterTable
+ALTER TABLE "WorkflowStep" ADD COLUMN     "safe" BOOLEAN NOT NULL DEFAULT false;
+
+-- Update existing records to set safe to true


@emrysal does this look correct?

joeauyeung · 2025-01-23T18:22:46Z

packages/features/ee/workflows/lib/getAllWorkflows.ts

@@ -22,6 +22,7 @@ export const workflowSelect = {
      sender: true,
      includeCalendarEvent: true,
      numberRequired: true,
+      safe: true,


Add the safe property when fetching workflow steps

joeauyeung · 2025-01-23T18:22:58Z

packages/features/ee/workflows/lib/reminders/reminderScheduler.ts

@@ -54,6 +54,8 @@ const processWorkflowStep = async (
    seatReferenceUid,
  }: ProcessWorkflowStepParams
 ) => {
+  if (!step.safe) return;


Before processing the step, see if it is marked as safe

This reverts commit d096470.

This reverts commit d9a0313.

packages/features/tasker/tasks/scanWorkflowBody.ts

joeauyeung · 2025-01-24T04:41:04Z

packages/features/tasker/tasks/scanWorkflowBody.ts

+
+export const scanWorkflowBodySchema = z.object({
+  userId: z.number(),
+  workflowStepIds: z.array(z.number()),


Since scheduleWorkflowNotifications expects multiple steps we now accept multiple steps in the task

joeauyeung · 2025-01-24T04:42:33Z

packages/trpc/server/routers/viewer/workflows/update.handler.ts

@@ -269,29 +270,29 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => {
      isOrg,
    });

-    await scheduleWorkflowNotifications(
+    await scheduleWorkflowNotifications({


scheduleWorkflowNotifications is refactored to accept an object for better readability.

joeauyeung · 2025-01-24T04:42:48Z

packages/trpc/server/routers/viewer/workflows/update.handler.ts

@@ -337,7 +338,7 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => {
          id: oldStep.id,
        },
      });
-    } else if (isStepEdited(oldStep, newStep)) {
+    } else if (isStepEdited(oldStep, { ...newStep, safe: false })) {


Type fix, expects the safe property

Should this be safe: oldStep.safe? 🤔 Because otherwise if the oldStep is safe, isStepEdited would always be true because of the different value in the safe field

joeauyeung · 2025-01-24T04:43:02Z

packages/trpc/server/routers/viewer/workflows/update.handler.ts

@@ -398,20 +399,24 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => {
        },
      });

+      if (SCANNING_WORKFLOW_STEPS && newStep.reminderBody !== oldStep.reminderBody) {


Only send to scan the body if it's been updated

joeauyeung · 2025-01-24T04:43:35Z

packages/trpc/server/routers/viewer/workflows/update.handler.ts

+          data: {
+            ...step,
+            numberVerificationPending: false,
+            ...(!SCANNING_WORKFLOW_STEPS ? { safe: true } : {}),


Default to safe = true if a self-hoster isn't planning on scanning workflows

github-actions · 2025-01-24T05:58:50Z

E2E results are ready!

Workflow #45247.1 latest results

CarinaWolli · 2025-01-24T16:34:12Z

packages/trpc/server/routers/viewer/workflows/update.handler.ts

@@ -337,7 +338,7 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => {
          id: oldStep.id,
        },
      });
-    } else if (isStepEdited(oldStep, newStep)) {
+    } else if (isStepEdited(oldStep, { ...newStep, safe: false })) {


Should this be safe: oldStep.safe? 🤔 Because otherwise if the oldStep is safe, isStepEdited would always be true because of the different value in the safe field

CarinaWolli · 2025-01-24T16:40:12Z

packages/features/tasker/tasks/scanWorkflowBody.ts

+    workflowSteps,
+    time: workflow?.time || null,
+    timeUnit: workflow?.timeUnit || null,
+    trigger: WorkflowTriggerEvents.AFTER_EVENT,


Suggested change

trigger: WorkflowTriggerEvents.AFTER_EVENT,

trigger: workflow.trigger,

Should be like that I think

joeauyeung · 2025-01-24T17:08:52Z

packages/trpc/server/routers/viewer/workflows/update.handler.ts

@@ -395,23 +398,28 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => {
          sender: newStep.sender,
          numberVerificationPending: false,
          includeCalendarEvent: newStep.includeCalendarEvent,
+          ...(SCANNING_WORKFLOW_STEPS && didBodyChange ? { safe: true } : {}),


@CarinaWolli thoughts here? Only if the body has changed we should remark the step as unsafe.

oh wait, why true here and not false?

socket-security · 2025-01-24T21:20:45Z

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@formkit/[email protected]	None	`0`	35.4 kB	justin-schroeder
npm/[email protected]	None	`0`	221 kB	dcode

🚮 Removed packages: npm/[email protected], npm/[email protected]

View full report↗︎

socket-security · 2025-01-24T21:20:46Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	CI
Possible typosquat attack	npm/[email protected]	Did you mean: ~~css-~~gradient-parser	⚠︎

View full report↗︎

Next steps

What is a typosquat?

Package name is similar to other popular packages and may not be the package you want.

Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/[email protected]

zomars · 2025-01-24T21:57:13Z

reviewing

joeauyeung added 5 commits January 22, 2025 22:54

Add akismet package to tasker

a5fb61f

Create scanWorkflowBody task

8a63afa

Schedule workflow body scan

2db52be

Add AKISMET_API_KEY .env

da358a4

Auto lock user if spam is detected

38ca4fc

github-actions bot added the ❗️ .env changes contains changes to env variables label Jan 23, 2025

keithwillcode added consumer core area: core, team members only labels Jan 23, 2025

Uncommit key

60c5cdb

joeauyeung commented Jan 23, 2025

View reviewed changes

joeauyeung marked this pull request as ready for review January 23, 2025 05:09

graphite-app bot requested review from a team January 23, 2025 05:09

joeauyeung added the ready-for-e2e label Jan 23, 2025

dosubot bot added the workflows area: workflows, automations label Jan 23, 2025

vercel bot deployed to Preview – api January 23, 2025 05:12 View deployment

emrysal reviewed Jan 23, 2025

View reviewed changes

packages/features/tasker/tasks/scanWorkflowBody.ts Outdated Show resolved Hide resolved

joeauyeung marked this pull request as draft January 23, 2025 14:16

joeauyeung added 2 commits January 23, 2025 12:05

Add safe param to workflow step

5e447a1

Migration for safe field

7067778

vercel bot had a problem deploying to Preview – api January 23, 2025 17:09 Failure

joeauyeung added 3 commits January 23, 2025 13:08

Do not process workflow steps is safe is false

abd1b50

Update migration to set previous records to true

01d2d58

Address comments

834cb6b

github-actions bot added the ❗️ migrations contains migration files label Jan 23, 2025

joeauyeung commented Jan 23, 2025

View reviewed changes

joeauyeung marked this pull request as ready for review January 23, 2025 18:23

vercel bot had a problem deploying to Preview – api January 23, 2025 18:25 Failure

Fix IS_SELF_HOSTED

0700a53

vercel bot had a problem deploying to Preview – api January 24, 2025 04:42 Failure

Remove unused function

b88cd3e

vercel bot had a problem deploying to Preview – api January 24, 2025 05:04 Failure

joeauyeung added 5 commits January 24, 2025 00:20

Make safe optional in schema

d096470

Type fix

d9a0313

Revert "Make safe optional in schema"

c314420

This reverts commit d096470.

Revert "Type fix"

60ca133

This reverts commit d9a0313.

Type fixes

2e569e3

joeauyeung commented Jan 24, 2025

View reviewed changes

vercel bot deployed to Preview – api January 24, 2025 05:43 View deployment

CarinaWolli reviewed Jan 24, 2025

View reviewed changes

joeauyeung added 2 commits January 24, 2025 12:03

Type fixes

bdfa6f9

Address comments

a33e995

joeauyeung commented Jan 24, 2025

View reviewed changes

vercel bot deployed to Preview – api January 24, 2025 17:12 View deployment

Fix tests

2133ea3

vercel bot deployed to Preview – api January 24, 2025 17:51 View deployment

Add tests

60b0879

vercel bot deployed to Preview – api January 24, 2025 18:24 View deployment

Update tests

5d2762f

vercel bot deployed to Preview – api January 24, 2025 21:24 View deployment

joeauyeung marked this pull request as ready for review January 24, 2025 21:27

joeauyeung requested a review from CarinaWolli January 24, 2025 21:40

Typo fix

9f53fd0

vercel bot deployed to Preview – api January 24, 2025 22:38 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Add spam checking for workflow bodies #18822

chore: Add spam checking for workflow bodies #18822

joeauyeung commented Jan 23, 2025

vercel bot commented Jan 23, 2025 •

edited

Loading

joeauyeung Jan 23, 2025

joeauyeung Jan 23, 2025

graphite-app bot commented Jan 23, 2025

joeauyeung Jan 23, 2025

joeauyeung Jan 23, 2025

joeauyeung Jan 23, 2025

joeauyeung Jan 23, 2025

joeauyeung Jan 24, 2025

joeauyeung Jan 24, 2025

joeauyeung Jan 24, 2025

CarinaWolli Jan 24, 2025

joeauyeung Jan 24, 2025

joeauyeung Jan 24, 2025

github-actions bot commented Jan 24, 2025 •

edited

Loading

CarinaWolli Jan 24, 2025

CarinaWolli Jan 24, 2025

joeauyeung Jan 24, 2025

CarinaWolli Jan 24, 2025

CarinaWolli Jan 24, 2025

socket-security bot commented Jan 24, 2025 •

edited

Loading

socket-security bot commented Jan 24, 2025 •

edited

Loading

zomars commented Jan 24, 2025

	trigger: WorkflowTriggerEvents.AFTER_EVENT,
	trigger: workflow.trigger,

chore: Add spam checking for workflow bodies #18822

Are you sure you want to change the base?

chore: Add spam checking for workflow bodies #18822

Conversation

joeauyeung commented Jan 23, 2025

What does this PR do?

Mandatory Tasks (DO NOT REMOVE)

How should this be tested?

vercel bot commented Jan 23, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

graphite-app bot commented Jan 23, 2025

Graphite Automations

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Jan 24, 2025 • edited Loading

E2E results are ready!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

socket-security bot commented Jan 24, 2025 • edited Loading

socket-security bot commented Jan 24, 2025 • edited Loading

Next steps

zomars commented Jan 24, 2025

vercel bot commented Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 24, 2025 •

edited

Loading

socket-security bot commented Jan 24, 2025 •

edited

Loading

socket-security bot commented Jan 24, 2025 •

edited

Loading