🛂 Make sure customDomain can't be spoofed

Closes #569

apps/builder/src/features/typebot/api/updateTypebot.ts

@@ -10,6 +10,7 @@ import { z } from 'zod'
 import {
   isCustomDomainNotAvailable,
   isPublicIdNotAvailable,
+  sanitizeCustomDomain,
   sanitizeGroups,
   sanitizeSettings,
 } from '../helpers/sanitizers'
@@ -201,8 +202,10 @@ export const updateTypebot = authenticatedProcedure
             : typebot.publicId && isPublicIdValid(typebot.publicId)
             ? typebot.publicId
             : undefined,
-        customDomain:
-          typebot.customDomain === null ? null : typebot.customDomain,
+        customDomain: await sanitizeCustomDomain({
+          customDomain: typebot.customDomain,
+          workspaceId: existingTypebot.workspace.id,
+        }),
         isClosed: typebot.isClosed,
         whatsAppCredentialsId: typebot.whatsAppCredentialsId ?? undefined,
         updatedAt: typebot.updatedAt,

apps/builder/src/features/typebot/helpers/sanitizers.ts

@@ -163,3 +163,20 @@ export const sanitizeFolderId = async ({
   })
   return folderCount !== 0 ? folderId : undefined
 }
+
+export const sanitizeCustomDomain = async ({
+  customDomain,
+  workspaceId,
+}: {
+  customDomain?: string | null
+  workspaceId: string
+}) => {
+  if (!customDomain) return customDomain
+  const domainCount = await prisma.customDomain.count({
+    where: {
+      name: customDomain?.split('/')[0],
+      workspaceId,
+    },
+  })
+  return domainCount === 0 ? null : customDomain
+}