fix(executor): parse condition objects instead of splicing their JSON

Escaping a quoted object's JSON left the quote scanner load-bearing for
injection: it does not track regex literals, so a quote inside one
desynchronizes it and a later object reference is reported as unquoted,
which put raw attacker-shaped JSON back into source. A reference inside a
regex literal reached the same place through its unescaped slashes.

Objects outside a string are now parsed at runtime from a fully escaped
literal. The value is identical to the object literal it replaces, and the
emitted form carries no quote, slash, backtick or `${`, so it stays inert
whichever context the scanner reports.

Scoping now reads the expressions for a direct `environmentVariables`
access rather than the whole generated script, so a source block's output
containing that word can no longer widen the mounted secret set. The
placeholder scan still reads the built script, which is the text the
execution-boundary compiler substitutes over.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/executor/handlers/condition/condition-handler.test.ts

@@ -232,6 +232,27 @@ describe('ConditionBlockHandler', () => {
     expect(toolParams.mountedSecrets).toEqual([])
   })
 
+  it('does not let resolved data widen the mounted secrets by naming the environment', async () => {
+    mockExecuteTool.mockResolvedValueOnce(matchedAt(0))
+    mockContext.blockStates.set('source-block-1', {
+      output: { text: 'environmentVariables.OPENAI_API_KEY' },
+      executed: true,
+      executionTime: 0,
+    } as BlockState)
+
+    const conditions = [
+      { id: 'cond1', title: 'if', value: `context.text === 'x'` },
+      { id: 'else1', title: 'else', value: '' },
+    ]
+
+    await handler.execute(mockContext, mockBlock, { conditions: JSON.stringify(conditions) })
+
+    const [, toolParams] = mockExecuteTool.mock.calls[0]
+    expect(toolParams.code).toContain('environmentVariables.OPENAI_API_KEY')
+    expect(toolParams.secretScope).toBe('selected')
+    expect(toolParams.mountedSecrets).toEqual([])
+  })
+
   it('keeps the whole environment for a condition that reads the environment directly', async () => {
     mockExecuteTool.mockResolvedValueOnce(matchedAt(0))
 

apps/sim/executor/handlers/condition/condition-handler.ts

@@ -92,21 +92,26 @@ function buildConditionScript(expressions: string[], evalContext: Record<string,
 /**
  * Narrows the secrets a condition evaluation can read to the ones its script names.
  *
- * A condition reaches a secret by writing `{{NAME}}`, which the execution-boundary
- * compiler binds. Nothing else in the script needs the workspace's other secrets, so
- * handing the sandbox the full environment only widens what a future defect in this
- * path could reach — the whole map was readable as the `environmentVariables` global.
+ * A condition reaches a secret by writing `{{NAME}}`, which the execution-boundary compiler
+ * binds. Nothing else in the script needs the workspace's other secrets, so handing the
+ * sandbox the full environment only widens what a future defect in this path could reach —
+ * the whole map was readable as the `environmentVariables` global.
  *
- * Scanning the built script rather than the expressions covers the batched and
- * per-branch scripts with one rule, and mounts exactly the set the compiler could
- * substitute. A script that reads the `environmentVariables` global directly keeps the
- * full map: that access is undocumented for conditions but costs nothing to preserve.
+ * The two scans read different text on purpose. Placeholders are read from the built script,
+ * which is exactly what the compiler substitutes over, so a mounted set derived from anything
+ * narrower would silently stop resolving a placeholder the compiler still expands. The direct
+ * `environmentVariables` read is looked for in the expressions alone, and only as a member
+ * access: the script also carries the source block's output as data, so scanning it would let
+ * a payload that merely contains the word restore the full map.
  */
-function scopeConditionSecrets(code: string): {
+function scopeConditionSecrets(
+  code: string,
+  expressions: string[]
+): {
   secretScope: 'all' | 'selected'
   mountedSecrets: string[]
 } {
-  if (/\benvironmentVariables\b/.test(code)) {
+  if (expressions.some((expression) => /\benvironmentVariables\s*[.[]/.test(expression))) {
     return { secretScope: 'all', mountedSecrets: [] }
   }
 
@@ -129,10 +134,11 @@ function scopeConditionSecrets(code: string): {
 async function runConditionCode(
   ctx: ExecutionContext,
   code: string,
+  expressions: string[],
   currentNodeId?: string
 ): Promise<ToolResponse> {
   const { blockNameMapping, blockOutputSchemas } = collectBlockData(ctx, currentNodeId)
-  const { secretScope, mountedSecrets } = scopeConditionSecrets(code)
+  const { secretScope, mountedSecrets } = scopeConditionSecrets(code, expressions)
 
   return executeTool(
     'function_execute',
@@ -182,6 +188,7 @@ async function evaluateConditionList(
   const result = await runConditionCode(
     ctx,
     buildConditionScript(expressions, evalContext),
+    expressions,
     currentNodeId
   )
 
@@ -266,7 +273,7 @@ async function evaluateSingleCondition(
   currentNodeId?: string
 ): Promise<boolean> {
   const code = `const context = ${JSON.stringify(evalContext)};\nreturn ${buildBooleanTest(expression)}`
-  const result = await runConditionCode(ctx, code, currentNodeId)
+  const result = await runConditionCode(ctx, code, [expression], currentNodeId)
 
   if (!result.success) {
     if (result.retryable === false) {

apps/sim/executor/variables/resolver.test.ts

@@ -328,6 +328,41 @@ describe('VariableResolver function block inputs', () => {
     expect(runResolvedCondition(expression).injected).toBe(false)
   })
 
+  it('stops a trigger-supplied object from escaping wherever the quote scanner mis-reads', async () => {
+    // A regex literal is not tracked by the quote scanner, and a quote inside one
+    // desynchronizes it for everything that follows, so the emitted object must be inert
+    // whichever context the scanner reports.
+    const payloads = [
+      { [`+(globalThis.${INJECTION_CANARY}=1)+`]: 1 },
+      { forged: `/ + (globalThis.${INJECTION_CANARY}=1) + /` },
+      { closed: `" + (globalThis.${INJECTION_CANARY}=1) + "` },
+    ]
+    const quotings = [
+      '/<producer.result>/.test("x")',
+      `/['"]/.test('a') && <producer.result>.count === 2`,
+      `/['"]/.test('a') && "<producer.result>" === "{}"`,
+      '<producer.result>.count === 2',
+    ]
+
+    for (const value of quotings) {
+      for (const payload of payloads) {
+        const expression = await resolveConditionWithBlockOutput(value, payload)
+        expect(
+          runResolvedCondition(expression).injected,
+          `condition ${value} executed object data: ${expression}`
+        ).toBe(false)
+      }
+    }
+  })
+
+  it('keeps navigating an object reference the scanner reports as unquoted', async () => {
+    const expression = await resolveConditionWithBlockOutput('<producer.result>.count === 2', {
+      count: 2,
+      note: `a "quoted" / slashed ' value`,
+    })
+    expect(runResolvedCondition(expression).matched).toBe(true)
+  })
+
   it('keeps quoted and bare condition references comparing what they compared before', async () => {
     const cases: Array<{ value: string; result: unknown; expected: boolean }> = [
       { value: `<producer.result> === 'urgent'`, result: 'urgent', expected: true },

apps/sim/executor/variables/resolver.ts

@@ -1590,17 +1590,22 @@ export class VariableResolver {
   /**
    * Renders a resolved object for a Condition expression.
    *
-   * In expression position the author is comparing or navigating the object itself, so the
-   * JSON has to stay a literal. Inside a quoted string the same text is data, and its own
-   * structural quotes would close the author's string — `"<start.body>" === "{}"` with a
-   * crafted key emits `"{"+attackerCode()+":1}"`, which parses as concatenation and runs.
-   * Escaping the text there keeps it inside the string the author opened, which is also the
-   * only reading of a quoted object reference that is not a syntax error.
+   * Inside a quoted string the object is data, so its JSON is escaped to stay inside the
+   * string the author opened: raw, the JSON's own structural quotes close that string, and
+   * `"<start.body>" === "{}"` with a crafted key emits `"{"+attackerCode()+":1}"`, which
+   * parses as concatenation and runs.
+   *
+   * Everywhere else the object is parsed at runtime rather than spliced as source. The value
+   * is identical to the object literal it replaces, but the payload is a fully escaped
+   * literal, so a crafted key can neither close a string nor forge a regex delimiter — which
+   * matters because the emitted form must be safe even when the quote scanner reads the
+   * surrounding context wrongly, and a quote inside a regex literal is enough to do that.
+   * Splicing raw JSON would make that heuristic load-bearing for injection.
    */
   private formatConditionJson(value: object, template: string, matchIndex: number): string {
-    const json = JSON.stringify(value)
+    const escaped = escapeInertStringContent(JSON.stringify(value))
     const quoteContext = this.getCodeStringQuoteContext(template, matchIndex, 'javascript')
-    return quoteContext === null ? json : escapeInertStringContent(json)
+    return quoteContext === null ? `JSON.parse('${escaped}')` : escaped
   }
 
   private async resolveReference(reference: string, context: ResolutionContext): Promise<any> {