fix(quickbooks): enforce attachment upload bounds

Author: Bill Leoutsakos

apps/sim/app/api/tools/quickbooks/add-attachment/route.ts

@@ -72,11 +72,14 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       const files = processFilesToUserFiles([rawFile], requestId, logger)
       if (files.length !== 1) throw new Error('Exactly one valid file is required')
       const file = files[0]
+      assertKnownSizeWithinLimit(file.size, MAX_FILE_SIZE, 'QuickBooks attachment file')
       const denied = await assertToolFileAccess(file.key, authResult.userId, requestId, logger)
       if (denied) return denied
       let downloaded: Awaited<ReturnType<typeof downloadServableFileFromStorage>>
       try {
-        downloaded = await downloadServableFileFromStorage(file, requestId, logger)
+        downloaded = await downloadServableFileFromStorage(file, requestId, logger, {
+          maxBytes: MAX_FILE_SIZE,
+        })
       } catch (error) {
         const notReady = docNotReadyResponse(error)
         if (notReady) return notReady

apps/sim/app/api/tools/quickbooks/documents.test.ts

@@ -184,6 +184,12 @@ describe('QuickBooks document API routes', () => {
       expect.anything()
     )
     expect(mockDownloadServableFileFromStorage).toHaveBeenCalledTimes(1)
+    expect(mockDownloadServableFileFromStorage).toHaveBeenCalledWith(
+      attachmentFile,
+      expect.any(String),
+      expect.anything(),
+      { maxBytes: MAX_FILE_SIZE }
+    )
     const formData = mockFetch.mock.calls[0][1].body as FormData
     expect(formData.get('file_metadata_01')).toBeInstanceOf(Blob)
     expect(formData.get('file_content_01')).toBeInstanceOf(Blob)
@@ -223,6 +229,22 @@ describe('QuickBooks document API routes', () => {
     )
     expect(mixed.status).toBe(400)
 
+    mockProcessFilesToUserFiles.mockReturnValueOnce([
+      { ...attachmentFile, size: MAX_FILE_SIZE + 1 },
+    ])
+    const declaredOversized = await addAttachment(
+      createMockRequest('POST', {
+        ...auth,
+        attachmentKind: 'file',
+        targetType: 'invoice',
+        targetId: '1',
+        file: attachmentFile,
+      })
+    )
+    expect(declaredOversized.status).toBe(413)
+    expect(mockAssertToolFileAccess).not.toHaveBeenCalled()
+    expect(mockDownloadServableFileFromStorage).not.toHaveBeenCalled()
+
     mockDownloadServableFileFromStorage.mockResolvedValueOnce({
       buffer: Buffer.alloc(0),
       contentType: 'application/pdf',