fix(security): prevent SSRF in task-automation enterprise API calls (#3411)

Fixes CodeQL js/request-forgery (alert #116, critical). callEnterpriseApi
builds `new URL(endpoint, enterpriseApiUrl)` then fetches it; getAutomationRunStatus
interpolated a user-provided runId straight into the endpoint path
(`/api/tasks-automations/runs/${runId}`), so a crafted runId could inject
path segments into the request URL.

- Encode the user value in the path (encodeURIComponent(runId)).
- Add an origin allowlist guard in callEnterpriseApi: resolve the URL against
  the configured enterprise API base and reject anything whose origin differs,
  so no caller can redirect the request to another host.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: Marfuen

apps/app/src/app/(app)/[orgId]/tasks/[taskId]/automation/[automationId]/actions/task-automation-actions.ts

@@ -55,7 +55,15 @@ async function callEnterpriseApi<T>(
 ): Promise<T> {
   const { enterpriseApiUrl, enterpriseApiKey } = getEnterpriseConfig();
 
-  const url = new URL(endpoint, enterpriseApiUrl);
+  const baseUrl = new URL(enterpriseApiUrl);
+  const url = new URL(endpoint, baseUrl);
+
+  // SSRF guard: `endpoint` and params can carry user-derived values, so pin the
+  // request to the configured enterprise API origin — never allow it to be
+  // redirected to another host.
+  if (url.origin !== baseUrl.origin) {
+    throw new EnterpriseApiError('Invalid enterprise API endpoint', 400);
+  }
 
   if (options.params) {
     Object.entries(options.params).forEach(([key, value]) => {
@@ -243,8 +251,10 @@ export async function analyzeAutomationWorkflow(scriptContent: string) {
 
 export const getAutomationRunStatus = async (runId: string) => {
   try {
-    const result = await callEnterpriseApi(`/api/tasks-automations/runs/${runId}`, {
-    });
+    const result = await callEnterpriseApi(
+      `/api/tasks-automations/runs/${encodeURIComponent(runId)}`,
+      {},
+    );
 
     return {
       success: true,