fix(executor): stop resolved data from breaking out of generated code

A Condition expression is compiled by inlining each resolved reference as
source text, and the literal that gets emitted only ever anticipated the
quoting it chose itself. The author's quoting decides the real context, so
`"<start.input>".includes('urgent')` — a shape that works correctly with
benign data — let webhook, chat, or form data close the author's string and
run as JavaScript in the condition sandbox, which receives the workspace's
whole decrypted environment as the `environmentVariables` global. Template
literals, regex literals, and a crafted object key reached the same place.

Both condition formatters now escape every terminator of every JavaScript
string context rather than the one they open. `\"`, `` \` ``, `\$` and `\/`
are identity escapes, so a condition compares exactly what it compared
before; only its ability to parse as anything but data changes. A quoted
object reference additionally escapes its JSON, the only reading of that
shape that was not already a syntax error.

Function blocks bind block outputs as context variables but inlined the
remaining resolved values as literals, so a workflow variable a Variables
block had assigned from trigger data, or a loop item, could close the
string it landed in. Those bind now too. Numbers, booleans, null, and
strings that name an environment variable stay inline: the first three
cannot terminate a literal, and the last has to stay in source because the
placeholder — never the secret — is what is inlined, and the
execution-boundary compiler binds it downstream.

Condition evaluation also stops shipping the full secret map to the
sandbox: it mounts only the names its script references, so a future defect
in this path reaches nothing the condition did not already name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Vikhyath Mondreti

apps/sim/executor/handlers/condition/condition-handler.test.ts

@@ -202,6 +202,50 @@ describe('ConditionBlockHandler', () => {
     )
   })
 
+  it('mounts only the secrets the condition names', async () => {
+    mockExecuteTool.mockResolvedValueOnce(matchedAt(0))
+
+    const conditions = [
+      { id: 'cond1', title: 'if', value: '"{{ROUTE_KEY}}" === "beta"' },
+      { id: 'else1', title: 'else', value: '' },
+    ]
+
+    await handler.execute(mockContext, mockBlock, { conditions: JSON.stringify(conditions) })
+
+    const [, toolParams] = mockExecuteTool.mock.calls[0]
+    expect(toolParams.secretScope).toBe('selected')
+    expect(toolParams.mountedSecrets).toEqual(['ROUTE_KEY'])
+  })
+
+  it('denies every secret to a condition that names none', async () => {
+    mockExecuteTool.mockResolvedValueOnce(matchedAt(0))
+
+    const conditions = [
+      { id: 'cond1', title: 'if', value: 'context.value > 5' },
+      { id: 'else1', title: 'else', value: '' },
+    ]
+
+    await handler.execute(mockContext, mockBlock, { conditions: JSON.stringify(conditions) })
+
+    const [, toolParams] = mockExecuteTool.mock.calls[0]
+    expect(toolParams.secretScope).toBe('selected')
+    expect(toolParams.mountedSecrets).toEqual([])
+  })
+
+  it('keeps the whole environment for a condition that reads the environment directly', async () => {
+    mockExecuteTool.mockResolvedValueOnce(matchedAt(0))
+
+    const conditions = [
+      { id: 'cond1', title: 'if', value: 'environmentVariables.ROUTE_KEY === "beta"' },
+      { id: 'else1', title: 'else', value: '' },
+    ]
+
+    await handler.execute(mockContext, mockBlock, { conditions: JSON.stringify(conditions) })
+
+    const [, toolParams] = mockExecuteTool.mock.calls[0]
+    expect(toolParams.secretScope).toBe('all')
+  })
+
   it('should never forward collected block outputs in the request body', async () => {
     mockCollectBlockData.mockReturnValueOnce({
       blockData: { 'huge-block': { payload: 'x'.repeat(1024) } },

apps/sim/executor/handlers/condition/condition-handler.ts

@@ -10,6 +10,7 @@ import type { BlockOutput } from '@/blocks/types'
 import { BlockType, DEFAULTS, EDGE } from '@/executor/constants'
 import type { BlockHandler, ExecutionContext } from '@/executor/types'
 import { collectBlockData } from '@/executor/utils/block-data'
+import { createEnvVarPattern } from '@/executor/utils/reference-validation'
 import {
   buildBranchNodeId,
   extractBaseBlockId,
@@ -88,6 +89,34 @@ function buildConditionScript(expressions: string[], evalContext: Record<string,
   ].join('\n')
 }
 
+/**
+ * Narrows the secrets a condition evaluation can read to the ones its script names.
+ *
+ * A condition reaches a secret by writing `{{NAME}}`, which the execution-boundary
+ * compiler binds. Nothing else in the script needs the workspace's other secrets, so
+ * handing the sandbox the full environment only widens what a future defect in this
+ * path could reach — the whole map was readable as the `environmentVariables` global.
+ *
+ * Scanning the built script rather than the expressions covers the batched and
+ * per-branch scripts with one rule, and mounts exactly the set the compiler could
+ * substitute. A script that reads the `environmentVariables` global directly keeps the
+ * full map: that access is undocumented for conditions but costs nothing to preserve.
+ */
+function scopeConditionSecrets(code: string): {
+  secretScope: 'all' | 'selected'
+  mountedSecrets: string[]
+} {
+  if (/\benvironmentVariables\b/.test(code)) {
+    return { secretScope: 'all', mountedSecrets: [] }
+  }
+
+  const named = new Set<string>()
+  for (const match of code.matchAll(createEnvVarPattern())) {
+    named.add(String(match[1]).trim())
+  }
+  return { secretScope: 'selected', mountedSecrets: [...named] }
+}
+
 /**
  * Runs condition code through the shared function execution boundary.
  *
@@ -103,12 +132,15 @@ async function runConditionCode(
   currentNodeId?: string
 ): Promise<ToolResponse> {
   const { blockNameMapping, blockOutputSchemas } = collectBlockData(ctx, currentNodeId)
+  const { secretScope, mountedSecrets } = scopeConditionSecrets(code)
 
   return executeTool(
     'function_execute',
     {
       code,
       timeout: CONDITION_TIMEOUT_MS,
+      secretScope,
+      mountedSecrets,
       envVars: normalizeStringRecord(ctx.environmentVariables),
       workflowVariables: normalizeWorkflowVariables(ctx.workflowVariables),
       blockData: {},

apps/sim/executor/utils/code-formatting.ts

@@ -46,3 +46,36 @@ export function formatLiteralForCode(value: unknown, language: 'javascript' | 'p
   }
   return JSON.stringify(value)
 }
+
+/**
+ * Escapes text so it cannot terminate whatever JavaScript literal it is spliced into.
+ *
+ * Condition expressions are user-authored JavaScript into which resolved references are
+ * inlined as source, so the author's quoting — not this module's — decides which string
+ * context the value lands in. Escaping only the quote the emitted literal opens leaves
+ * `"`, a backtick, `${`, and `/` live, and `"<start.input>".includes('urgent')` then lets
+ * trigger data close the author's string and run as code in the condition sandbox.
+ *
+ * So every terminator of every JavaScript string context is escaped, not just the one the
+ * emitted literal opens. `\"`, `` \` ``, `\$`, and `\/` are identity escapes in JavaScript,
+ * so the value a condition compares is byte-identical to what it was before — this is a
+ * syntax guard, not a value transform.
+ *
+ * JavaScript only: `\$`, `` \` `` and `\/` are not identity escapes in Python, where they
+ * would change the value. Code blocks bind their values as runtime context variables
+ * instead of splicing them, which is why they need no escaping in any language.
+ */
+export function escapeInertStringContent(value: string): string {
+  return value
+    .replace(/\\/g, '\\\\')
+    .replace(/['"`$/]/g, '\\$&')
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029')
+}
+
+/** Wraps {@link escapeInertStringContent} output as a complete JavaScript string literal. */
+export function formatInertStringLiteral(value: string, quote: '"' | "'" = "'"): string {
+  return `${quote}${escapeInertStringContent(value)}${quote}`
+}

apps/sim/executor/variables/resolver.test.ts

@@ -144,6 +144,43 @@ async function resolveConditionExpression(
   return (result.conditions as Array<{ value: string }>)[0].value
 }
 
+/** Resolves one condition expression against a producer output an attacker supplied. */
+async function resolveConditionWithBlockOutput(value: string, result: unknown): Promise<string> {
+  const { ctx, resolver, state } = createResolver()
+  state.setBlockOutput('producer', { result } as never)
+  const conditionBlock = createBlock('condition', 'Condition', BlockType.CONDITION)
+  const resolved = await resolver.resolveInputs(
+    ctx,
+    conditionBlock.id,
+    { conditions: JSON.stringify([{ id: 'condition-1', title: 'if', value }]) },
+    conditionBlock
+  )
+  return (resolved.conditions as Array<{ value: string }>)[0].value
+}
+
+const INJECTION_CANARY = '__conditionInjectionCanary'
+
+/**
+ * Evaluates a resolved expression inside the same `Boolean(...)` wrapper the handler builds,
+ * reporting both the branch verdict and whether anything the resolved data carried executed.
+ */
+function runResolvedCondition(expression: string): { matched: boolean; injected: boolean } {
+  Reflect.set(globalThis, INJECTION_CANARY, 'not-executed')
+  try {
+    const matched = Boolean(
+      new Function(`const context = {};\nreturn Boolean(\n${expression}\n)`)()
+    )
+    return { matched, injected: Reflect.get(globalThis, INJECTION_CANARY) !== 'not-executed' }
+  } catch {
+    return {
+      matched: false,
+      injected: Reflect.get(globalThis, INJECTION_CANARY) !== 'not-executed',
+    }
+  } finally {
+    Reflect.deleteProperty(globalThis, INJECTION_CANARY)
+  }
+}
+
 /**
  * Completes the round trip a condition actually takes: resolver, then the execution-boundary
  * compiler, then evaluation of the same `Boolean(...)` wrapper `condition-handler.ts` builds.
@@ -255,6 +292,60 @@ describe('VariableResolver function block inputs', () => {
     ).resolves.toBe(true)
   })
 
+  it('stops trigger data from breaking out of a quoted condition reference', async () => {
+    // Every quoting an author can put around a reference. The author picks the context;
+    // the resolved value must be data in all of them, not just the one it wraps itself in.
+    const quotings = [
+      `"<producer.result>".includes('urgent')`,
+      '"<producer.result>" === "admin"',
+      '`<producer.result>`.length > 0',
+      '/<producer.result>/.test("x")',
+      `<producer.result> === 'admin'`,
+    ]
+    const payloads = [
+      `" + (globalThis.${INJECTION_CANARY} = "ran") + "`,
+      `\${(globalThis.${INJECTION_CANARY} = "ran")}`,
+      `' + (globalThis.${INJECTION_CANARY} = "ran") + '`,
+      `/ + (globalThis.${INJECTION_CANARY} = "ran") + /`,
+    ]
+
+    for (const value of quotings) {
+      for (const payload of payloads) {
+        const expression = await resolveConditionWithBlockOutput(value, payload)
+        expect(
+          runResolvedCondition(expression).injected,
+          `condition ${value} executed trigger data: ${expression}`
+        ).toBe(false)
+      }
+    }
+  })
+
+  it('stops a trigger-supplied object from closing the string it is quoted inside', async () => {
+    // JSON's own structural quotes close the author's string, and the key is the attacker's.
+    const expression = await resolveConditionWithBlockOutput('"<producer.result>" === "{}"', {
+      [`+(globalThis.${INJECTION_CANARY}=1)+`]: 1,
+    })
+    expect(runResolvedCondition(expression).injected).toBe(false)
+  })
+
+  it('keeps quoted and bare condition references comparing what they compared before', async () => {
+    const cases: Array<{ value: string; result: unknown; expected: boolean }> = [
+      { value: `<producer.result> === 'urgent'`, result: 'urgent', expected: true },
+      { value: `<producer.result> === 'urgent'`, result: 'other', expected: false },
+      { value: `"<producer.result>".includes('urgent')`, result: 'urgent ticket', expected: true },
+      { value: `"<producer.result>".includes('urgent')`, result: 'calm ticket', expected: false },
+      { value: '`<producer.result>`.length > 3', result: 'hello', expected: true },
+      { value: `<producer.result> === 'a"b'`, result: 'a"b', expected: true },
+      { value: '<producer.result> === `a$b/c`', result: 'a$b/c', expected: true },
+      { value: `<producer.result>.count === 2`, result: { count: 2 }, expected: true },
+    ]
+
+    for (const { value, result, expected } of cases) {
+      const expression = await resolveConditionWithBlockOutput(value, result)
+      expect(runResolvedCondition(expression).matched, `condition ${value}`).toBe(expected)
+    }
+  })
+
   it('compares a bare string placeholder instead of throwing a reference error', async () => {
     await expect(
       evaluateResolvedCondition(`{{NAME}} === 'alice'`, { NAME: 'alice' })
@@ -719,6 +810,28 @@ describe('VariableResolver function block inputs', () => {
     expect(result.contextVariables).toEqual({ __blockRef_0: ref })
   })
 
+  it('binds a workflow variable carrying quote characters instead of splicing it into code', async () => {
+    // A Variables block can assign trigger data at runtime, so a variable's value is not
+    // necessarily the author's. Inlined as a literal it closed the string it landed in.
+    const { block, ctx, resolver } = createResolver('javascript')
+    const payload = `' + (globalThis.__functionInjection = 1) + '`
+    ctx.workflowVariables = {
+      'var-1': { id: 'var-1', name: 'userinput', type: 'string', value: payload },
+    }
+
+    const result = await resolver.resolveInputsForFunctionBlock(
+      ctx,
+      'function',
+      { code: `const x = '<variable.userinput>'; return x` },
+      block
+    )
+
+    expect(result.resolvedInputs.code).toBe(
+      `const x = '' + JSON.stringify(globalThis["__blockRef_0"]) + ''; return x`
+    )
+    expect(result.contextVariables).toEqual({ __blockRef_0: payload })
+  })
+
   it('rewrites whole manifest workflow variables to lazy JavaScript array reads', async () => {
     const { block, ctx, resolver } = createResolver('javascript')
     const manifest = createTestManifest()
@@ -791,8 +904,11 @@ describe('VariableResolver function block inputs', () => {
       ['0', 'key'],
       expect.objectContaining({ allowLargeValueRefs: true })
     )
-    expect(result.resolvedInputs.code).toBe('return "SIM-0"')
-    expect(result.contextVariables).toEqual({})
+    // The navigated element binds like any other resolved value; what must not appear is
+    // the manifest, or the array it stands for.
+    expect(result.resolvedInputs.code).toBe('return globalThis["__blockRef_0"]')
+    expect(result.displayInputs.code).toBe('return "SIM-0"')
+    expect(result.contextVariables).toEqual({ __blockRef_0: 'SIM-0' })
   })
 
   it('resolves named loop result bracket paths in function code', async () => {