fix(tools): added stricter aura host db validation check for neo4j tool

[waleedlatif1]

Summary

• added stricter aura host db validation check for neo4j tool to prevent false positives (already wasn't possible to have false negatives)

Type of Change

• Bug fix

Testing

Tested manually.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Nov 20, 2025 2:35am

[greptile-apps]

Greptile Summary

• Changed Aura host validation from .includes() to exact match or .endsWith() to prevent false positives with malicious domains
• Prevents security issue where databases.neo4j.io.evil.com would incorrectly be treated as an Aura host

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The change is a focused security improvement that makes host validation stricter without breaking legitimate use cases, reducing false positive risk
• No files require special attention

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/neo4j/utils.ts	Improved Aura host validation from .includes() to exact match or .endsWith() to prevent false positives when malicious domains contain the Aura domain substring

Sequence Diagram

sequenceDiagram
    participant User
    participant API as "Neo4j API Route"
    participant Utils as "createNeo4jDriver"
    participant Neo4j as "Neo4j Database"
    
    User->>API: POST request with connection config
    API->>API: Validate request schema
    API->>API: "validateCypherQuery()"
    API->>Utils: "createNeo4jDriver(config)"
    Utils->>Utils: "Check if host is Aura (exact match or ends with .databases.neo4j.io)"
    Utils->>Utils: "Select protocol (neo4j+s for Aura, bolt/bolt+s otherwise)"
    Utils->>Utils: "Build URI with protocol, host, port"
    Utils->>Neo4j: "Create driver connection"
    Utils->>Neo4j: "verifyConnectivity()"
    Neo4j-->>Utils: Connection verified
    Utils-->>API: Return driver
    API->>Neo4j: "Execute query via session"
    Neo4j-->>API: Query results
    API->>API: "Convert Neo4j types to JSON"
    API-->>User: Return formatted results

Loading

[greptile-apps]

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile
React with 👍 or 👎 to share your feedback on this new summary format}