feat(microsoft-excel): add SharePoint drive support for Excel integration#4162
feat(microsoft-excel): add SharePoint drive support for Excel integration#4162waleedlatif1 wants to merge 8 commits intostagingfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview Introduces a new Refactors Excel tool URL construction via Reviewed by Cursor Bugbot for commit f18af3c. Configure here. |
Greptile SummaryThis PR adds optional SharePoint drive support to the Microsoft Excel integration: a cascading Confidence Score: 5/5Safe to merge — no P0/P1 issues found; all previously reported security and logic concerns have been addressed. All three security fixes from the prior round (siteId/driveId path-traversal validation, direct single-drive fetchById endpoint, driveId guard in the files route) are correctly implemented. The getItemBasePath helper consolidates drive-aware URL building cleanly, the dependsOn gates include credential in every any list so OneDrive users are never locked out, and the selector context correctly propagates driveId through the full chain. No fresh P0/P1 findings identified. apps/sim/blocks/blocks/microsoft_excel.ts — dependsOn expressions are more complex than the original; worth a second read to confirm all mode combinations behave as expected. Important Files Changed
Sequence DiagramsequenceDiagram
participant U as User (Basic Mode)
participant SS as siteSelector
participant DS as driveSelector
participant FS as spreadsheetId selector
participant SH as sheetName selector
participant DR as /api/tools/microsoft_excel/drives
participant MF as /api/auth/oauth/microsoft/files
participant MS as /api/tools/microsoft_excel/sheets
participant Graph as Microsoft Graph API
U->>SS: Select SharePoint site
SS-->>U: siteId set in context
U->>DR: POST { credential, siteId }
DR->>Graph: GET /sites/{siteId}/drives
Graph-->>DR: drives[]
DR-->>DS: { drives: [{id, name}] }
DS-->>U: driveId set in context
U->>MF: GET ?credentialId&driveId&query
MF->>Graph: GET /drives/{driveId}/root/search(q=...)
Graph-->>MF: files[]
MF-->>FS: { files: [{id, name}] }
FS-->>U: spreadsheetId set in context
U->>MS: GET ?credentialId&spreadsheetId&driveId
MS->>Graph: GET /drives/{driveId}/items/{id}/workbook/worksheets
Graph-->>MS: worksheets[]
MS-->>SH: { sheets: [{id, name}] }
SH-->>U: sheetName set in context
Note over U,Graph: On execution: getItemBasePath(spreadsheetId, driveId)
Reviews (5): Last reviewed commit: "lint" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
- Validate siteId/driveId format in drives route to prevent path traversal - Use direct single-drive endpoint for fetchById instead of filtering full list - Fix dependsOn on sheet/spreadsheet selectors so driveId flows into context - Fix NextRequest type in drives route for build compatibility
|
@greptile |
|
@cusror review |
Add regex validation for driveId query param in the Microsoft OAuth files route to prevent path traversal, matching the drives route.
|
@greptile |
|
@cursor review |
…sheets route - Add credential to any[] arrays so OneDrive users (no drive selected) still pass the dependsOn gate while driveSelector remains in the dependency list for context flow to SharePoint users - Add /^[\w-]+$/ validation for driveId in sheets API route
|
@greptile |
|
@cursor review |
Add regex validation for driveId at the shared utility level to prevent path traversal through the tool execution path, which bypasses the API route validators.
|
@greptile |
|
@cursor review |
Replace inline regex validation with platform validators from @/lib/core/security/input-validation: - validateSharePointSiteId for siteId in drives route - validateAlphanumericId for driveId in drives, sheets, files routes and getItemBasePath utility
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit f18af3c. Configure here.
…rePoint visibility Replace always-visible optional SharePoint fields with a File Source dropdown (OneDrive/SharePoint) that conditionally shows site and drive selectors. OneDrive users see zero extra fields (default). SharePoint users switch the dropdown and get the full cascade.
1 participant
Summary
driveIdparameter to all Microsoft Excel tools for SharePoint file access/api/tools/microsoft_excel/drivesroute to list SharePoint document librariesType of Change
Testing
Tested manually
Checklist