fix(files): keep url fallback and validate base64 canonically

Empty inline data no longer shadows a url. `''` and an empty Buffer now
produce a zero-byte buffer, which made `if (!buffer && data.url)` skip a
download that previously ran, so a tool emitting a placeholder alongside a
real url would have stored an empty file.

Replace the hand-rolled zero-length base64 check with the shared
`isCanonicalBase64`. `Buffer.from(x, 'base64')` silently drops characters
outside the alphabet, so `a!b!c!AAAA` and the non-canonical `AAAAA` decoded
to plausible-looking bytes instead of failing. Normalize first so the
payloads that already worked keep working: line-wrapped MIME base64,
unpadded base64url, and a base64 `data:` URI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VxZCGfFjZnokR8uFeWrfLp

Author: waleedlatif1

apps/sim/executor/utils/file-tool-processor.test.ts

@@ -124,14 +124,7 @@ describe('FileToolProcessor', () => {
       mockUploadExecutionFile.mockResolvedValue(storedFile)
 
       const result = await FileToolProcessor.processToolOutputs(
-        {
-          file: {
-            name: 'empty.txt',
-            mimeType: 'text/plain',
-            data,
-            url: 'https://example.com/file',
-          },
-        },
+        { file: { name: 'empty.txt', mimeType: 'text/plain', data } },
         toolConfig,
         executionContext
       )
@@ -159,6 +152,46 @@ describe('FileToolProcessor', () => {
     expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.alloc(0))
   })
 
+  it.each([Buffer.alloc(0), '', { type: 'Buffer', data: [] }])(
+    'prefers the url over empty inline data: %j',
+    async (data) => {
+      mockDownloadFileFromUrl.mockResolvedValue(Buffer.from('downloaded'))
+
+      await FileToolProcessor.processToolOutputs(
+        {
+          file: {
+            name: 'file.txt',
+            mimeType: 'text/plain',
+            data,
+            url: 'https://example.com/file',
+          },
+        },
+        toolConfig,
+        executionContext
+      )
+
+      expect(mockDownloadFileFromUrl).toHaveBeenCalledWith(
+        'https://example.com/file',
+        expect.objectContaining({ userId: 'user-1' })
+      )
+      expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.from('downloaded'))
+    }
+  )
+
+  it.each([
+    ['line-wrapped base64', 'SGVsbG8s\nIHdvcmxkIQ=='],
+    ['unpadded base64url', 'SGVsbG8sIHdvcmxkIQ'],
+    ['a base64 data URI', 'data:text/plain;base64,SGVsbG8sIHdvcmxkIQ=='],
+  ])('decodes %s', async (_label, data) => {
+    await FileToolProcessor.processToolOutputs(
+      { file: { name: 'hello.txt', mimeType: 'text/plain', data } },
+      toolConfig,
+      executionContext
+    )
+
+    expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.from('Hello, world!'))
+  })
+
   it('stores a successful zero-byte URL download', async () => {
     mockDownloadFileFromUrl.mockResolvedValue(Buffer.alloc(0))
 
@@ -171,7 +204,7 @@ describe('FileToolProcessor', () => {
     expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.alloc(0))
   })
 
-  it.each([undefined, null, '!!!', { type: 'Buffer', data: 'invalid' }])(
+  it.each([undefined, null, '!!!', 'a!b!c!AAAA', 'AAAAA', { type: 'Buffer', data: 'invalid' }])(
     'does not turn missing or malformed data into an empty file: %j',
     async (data) => {
       await expect(

apps/sim/executor/utils/file-tool-processor.ts

@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
+import { isCanonicalBase64 } from '@/lib/api/contracts/primitives'
 import { isUserFile } from '@/lib/core/utils/user-file'
 import { uploadExecutionFile, uploadFileFromRawData } from '@/lib/uploads/contexts/execution'
 import { downloadFileFromUrl } from '@/lib/uploads/utils/file-utils.server'
@@ -16,6 +17,18 @@ const IMAGE_FILE_EXTENSIONS: Record<string, string> = {
   'image/webp': 'webp',
 }
 
+/**
+ * Normalize a tool-supplied base64 payload to canonical RFC 4648 form so it can be
+ * validated: strip a base64 `data:` URI prefix, drop the line wrapping MIME encoders
+ * emit, translate the base64url alphabet, and restore padding unpadded encoders omit.
+ */
+function normalizeBase64(value: string): string {
+  const payload = /^data:[^,]*;base64,/i.test(value) ? value.slice(value.indexOf(',') + 1) : value
+  const compact = payload.replace(/\s/g, '').replace(/-/g, '+').replace(/_/g, '/')
+  const remainder = compact.length % 4
+  return remainder === 0 ? compact : compact + '='.repeat(4 - remainder)
+}
+
 function assertFileSize(size: number, fileName: string): void {
   if (size > MAX_FILE_SIZE) {
     throw new Error(`File '${fileName}' exceeds the maximum allowed size of ${MAX_FILE_SIZE} bytes`)
@@ -170,21 +183,17 @@ export class FileToolProcessor {
           throw new Error(`Invalid serialized buffer format for ${data.name}`)
         }
       } else if (typeof data.data === 'string') {
-        let base64Data = data.data
-
-        if (base64Data.includes('-') || base64Data.includes('_')) {
-          base64Data = base64Data.replace(/-/g, '+').replace(/_/g, '/')
-        }
+        const base64Data = normalizeBase64(data.data)
 
         const paddingBytes = base64Data.endsWith('==') ? 2 : base64Data.endsWith('=') ? 1 : 0
         assertFileSize(Math.floor((base64Data.length * 3) / 4) - paddingBytes, data.name)
-        buffer = Buffer.from(base64Data, 'base64')
-        if (base64Data.length > 0 && buffer.length === 0) {
+        if (!isCanonicalBase64(base64Data)) {
           throw new Error(`File '${data.name}' has invalid base64 data`)
         }
+        buffer = Buffer.from(base64Data, 'base64')
       }
 
-      if (!buffer && data.url) {
+      if ((!buffer || buffer.length === 0) && data.url) {
         buffer = await downloadFileFromUrl(data.url, {
           maxBytes: MAX_FILE_SIZE,
           userId: context.userId,