fix(google-meet): validate chrome node policy params (#103752)

Leon-SK668 · web-flow · commit f8aa995856ec · 2026-07-11T04:00:28.000-07:00
diff --git a/extensions/google-meet/src/node-invoke-policy.test.ts b/extensions/google-meet/src/node-invoke-policy.test.ts
@@ -121,6 +121,48 @@ describe("Google Meet node invoke policy", () => {
     expect(invokeNode).toHaveBeenCalledWith({ params: { action: "setup" } });
   });
 
+  it("rejects malformed bridge control before node dispatch", async () => {
+    const policy = createGoogleMeetChromeNodeInvokePolicy(resolveGoogleMeetConfig({}));
+
+    for (const params of [
+      { action: "pullAudio" },
+      { action: "pushAudio", bridgeId: "bridge-1" },
+      { action: "clearAudio", bridgeId: "" },
+      { action: "stopByUrl" },
+      { action: "stopByUrl", url: "https://example.com/not-meet" },
+    ]) {
+      const { ctx, invokeNode } = createContext(params);
+
+      await expect(policy.handle(ctx)).resolves.toMatchObject({
+        ok: false,
+        code: "GOOGLE_MEET_NODE_POLICY_DENIED",
+      });
+      expect(invokeNode).not.toHaveBeenCalled();
+    }
+  });
+
+  it("normalizes forwarded Meet URL filters before node dispatch", async () => {
+    const policy = createGoogleMeetChromeNodeInvokePolicy(resolveGoogleMeetConfig({}));
+    const { ctx, invokeNode } = createContext({
+      action: "stopByUrl",
+      url: "https://meet.google.com/abc-defg-hij?authuser=1",
+      mode: "agent",
+      exceptBridgeId: "bridge-1",
+      audioBridgeCommand: ["node", "-e", "process.exit(99)"],
+    });
+
+    await policy.handle(ctx);
+
+    expect(invokeNode).toHaveBeenCalledWith({
+      params: {
+        action: "stopByUrl",
+        url: "https://meet.google.com/abc-defg-hij?authuser=1",
+        mode: "agent",
+        exceptBridgeId: "bridge-1",
+      },
+    });
+  });
+
   it("rejects unsupported googlemeet.chrome actions before node dispatch", async () => {
     const policy = createGoogleMeetChromeNodeInvokePolicy(resolveGoogleMeetConfig({}));
     const { ctx, invokeNode } = createContext({ action: "exec", command: ["id"] });
diff --git a/extensions/google-meet/src/node-invoke-policy.ts b/extensions/google-meet/src/node-invoke-policy.ts
@@ -91,71 +91,104 @@ function buildStartParams(
   return approved(startParams);
 }
 
-function buildForwardParams(params: Record<string, unknown>): Record<string, unknown> | null {
+function denyMissing(action: string, field: string): PolicyDecision {
+  return {
+    approved: false,
+    result: denied(`googlemeet.chrome ${action} requires ${field}`),
+  };
+}
+
+function buildForwardParams(params: Record<string, unknown>): PolicyDecision | null {
   const action = readString(params.action);
   switch (action) {
     case "setup":
-      return { action };
+      return approved({ action });
     case "status": {
       const bridgeId = readString(params.bridgeId);
-      return bridgeId ? { action, bridgeId } : { action };
+      return approved(bridgeId ? { action, bridgeId } : { action });
     }
     case "list": {
       const forwarded: Record<string, unknown> = { action };
       const url = readString(params.url);
       const mode = readString(params.mode);
       if (url) {
-        forwarded.url = url;
+        try {
+          forwarded.url = normalizeMeetUrl(url);
+        } catch (error) {
+          return {
+            approved: false,
+            result: denied(error instanceof Error ? error.message : "googlemeet.chrome list url"),
+          };
+        }
       }
       if (mode) {
         forwarded.mode = mode;
       }
-      return forwarded;
+      return approved(forwarded);
     }
     case "stopByUrl": {
       const forwarded: Record<string, unknown> = { action };
       const url = readString(params.url);
       const mode = readString(params.mode);
       const exceptBridgeId = readString(params.exceptBridgeId);
-      if (url) {
-        forwarded.url = url;
+      if (!url) {
+        return denyMissing(action, "url");
+      }
+      try {
+        forwarded.url = normalizeMeetUrl(url);
+      } catch (error) {
+        return {
+          approved: false,
+          result: denied(
+            error instanceof Error ? error.message : "googlemeet.chrome stopByUrl url",
+          ),
+        };
       }
       if (mode) {
         forwarded.mode = mode;
       }
       if (exceptBridgeId) {
         forwarded.exceptBridgeId = exceptBridgeId;
       }
-      return forwarded;
+      return approved(forwarded);
     }
     case "pullAudio": {
       const forwarded: Record<string, unknown> = { action };
       const bridgeId = readString(params.bridgeId);
       const timeoutMs = readPositiveNumber(params.timeoutMs);
-      if (bridgeId) {
-        forwarded.bridgeId = bridgeId;
+      if (!bridgeId) {
+        return denyMissing(action, "bridgeId");
       }
+      forwarded.bridgeId = bridgeId;
       if (timeoutMs) {
         forwarded.timeoutMs = timeoutMs;
       }
-      return forwarded;
+      return approved(forwarded);
     }
     case "pushAudio": {
       const forwarded: Record<string, unknown> = { action };
       const bridgeId = readString(params.bridgeId);
       const base64 = readString(params.base64);
-      if (bridgeId) {
-        forwarded.bridgeId = bridgeId;
+      if (!bridgeId) {
+        return denyMissing(action, "bridgeId");
+      }
+      if (!base64) {
+        return denyMissing(action, "base64");
       }
-      if (base64) {
-        forwarded.base64 = base64;
+      forwarded.bridgeId = bridgeId;
+      forwarded.base64 = base64;
+      return approved(forwarded);
+    }
+    case "clearAudio": {
+      const bridgeId = readString(params.bridgeId);
+      if (!bridgeId) {
+        return denyMissing(action, "bridgeId");
       }
-      return forwarded;
+      return approved({ action, bridgeId });
     }
-    case "clearAudio":
     case "stop": {
       const bridgeId = readString(params.bridgeId);
-      return bridgeId ? { action, bridgeId } : { action };
+      return approved(bridgeId ? { action, bridgeId } : { action });
     }
     default:
       return null;
@@ -178,10 +211,10 @@ export function createGoogleMeetChromeNodeInvokePolicy(
       if (action === "start") {
         decision = buildStartParams(params, config);
       } else {
-        const forwardParams = buildForwardParams(params);
-        decision = forwardParams
-          ? approved(forwardParams)
-          : { approved: false, result: denied("unsupported googlemeet.chrome action") };
+        decision = buildForwardParams(params) ?? {
+          approved: false,
+          result: denied("unsupported googlemeet.chrome action"),
+        };
       }
       if (!decision.approved) {
         return decision.result;
