@atom8n/n8n 2.2.0

package/dist/security-audit/risk-reporters/database-risk-reporter.js

@@ -0,0 +1,97 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseRiskReporter = void 0;
+const di_1 = require("@n8n/di");
+const constants_1 = require("../../security-audit/constants");
+const utils_1 = require("../../security-audit/utils");
+let DatabaseRiskReporter = class DatabaseRiskReporter {
+    async report(workflows) {
+        const { expressionsInQueries, expressionsInQueryParams, unusedQueryParams } = this.getIssues(workflows);
+        const issues = [expressionsInQueries, expressionsInQueryParams, unusedQueryParams];
+        if (issues.every((i) => i.length === 0))
+            return null;
+        const report = {
+            risk: constants_1.DATABASE_REPORT.RISK,
+            sections: [],
+        };
+        const sentenceStart = ({ length }) => length > 1 ? 'These SQL nodes have' : 'This SQL node has';
+        if (expressionsInQueries.length > 0) {
+            report.sections.push({
+                title: constants_1.DATABASE_REPORT.SECTIONS.EXPRESSIONS_IN_QUERIES,
+                description: [
+                    sentenceStart(expressionsInQueries),
+                    'an expression in the "Query" field of an "Execute Query" operation. Building a SQL query with an expression may lead to a SQL injection attack.',
+                ].join(' '),
+                recommendation: 'Consider using the "Query Parameters" field to pass parameters to the query, or validating the input of the expression in the "Query" field.',
+                location: expressionsInQueries,
+            });
+        }
+        if (expressionsInQueryParams.length > 0) {
+            report.sections.push({
+                title: constants_1.DATABASE_REPORT.SECTIONS.EXPRESSIONS_IN_QUERY_PARAMS,
+                description: [
+                    sentenceStart(expressionsInQueryParams),
+                    'an expression in the "Query Parameters" field of an "Execute Query" operation. Building a SQL query with an expression may lead to a SQL injection attack.',
+                ].join(' '),
+                recommendation: 'Consider validating the input of the expression in the "Query Parameters" field.',
+                location: expressionsInQueryParams,
+            });
+        }
+        if (unusedQueryParams.length > 0) {
+            report.sections.push({
+                title: constants_1.DATABASE_REPORT.SECTIONS.UNUSED_QUERY_PARAMS,
+                description: [
+                    sentenceStart(unusedQueryParams),
+                    'no "Query Parameters" field in the "Execute Query" operation. Building a SQL query with unsanitized data may lead to a SQL injection attack.',
+                ].join(' '),
+                recommendation: `Consider using the "Query Parameters" field to sanitize parameters passed to the query. See: ${constants_1.DB_QUERY_PARAMS_DOCS_URL}`,
+                location: unusedQueryParams,
+            });
+        }
+        return report;
+    }
+    getIssues(workflows) {
+        return workflows.reduce((acc, workflow) => {
+            workflow.nodes.forEach((node) => {
+                if (!constants_1.SQL_NODE_TYPES.has(node.type))
+                    return;
+                if (node.parameters === undefined)
+                    return;
+                if (node.parameters.operation !== 'executeQuery')
+                    return;
+                if (typeof node.parameters.query === 'string' && node.parameters.query.startsWith('=')) {
+                    acc.expressionsInQueries.push((0, utils_1.toFlaggedNode)({ node, workflow }));
+                }
+                if (!constants_1.SQL_NODE_TYPES_WITH_QUERY_PARAMS.has(node.type))
+                    return;
+                if (!node.parameters.additionalFields) {
+                    acc.unusedQueryParams.push((0, utils_1.toFlaggedNode)({ node, workflow }));
+                }
+                if (typeof node.parameters.additionalFields !== 'object')
+                    return;
+                if (node.parameters.additionalFields === null)
+                    return;
+                if (!('queryParams' in node.parameters.additionalFields)) {
+                    acc.unusedQueryParams.push((0, utils_1.toFlaggedNode)({ node, workflow }));
+                }
+                if ('queryParams' in node.parameters.additionalFields &&
+                    typeof node.parameters.additionalFields.queryParams === 'string' &&
+                    node.parameters.additionalFields.queryParams.startsWith('=')) {
+                    acc.expressionsInQueryParams.push((0, utils_1.toFlaggedNode)({ node, workflow }));
+                }
+            });
+            return acc;
+        }, { expressionsInQueries: [], expressionsInQueryParams: [], unusedQueryParams: [] });
+    }
+};
+exports.DatabaseRiskReporter = DatabaseRiskReporter;
+exports.DatabaseRiskReporter = DatabaseRiskReporter = __decorate([
+    (0, di_1.Service)()
+], DatabaseRiskReporter);
+//# sourceMappingURL=database-risk-reporter.js.map

package/dist/security-audit/risk-reporters/database-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/database-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gCAAkC;AAGlC,0DAKoC;AAEpC,kDAAuD;AAGhD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,KAAK,CAAC,MAAM,CAAC,SAA0B;QACtC,MAAM,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,GAC1E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QAEnF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,2BAAe,CAAC,IAAI;YAC1B,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE,CACxD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAE3D,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,sBAAsB;gBACtD,WAAW,EAAE;oBACZ,aAAa,CAAC,oBAAoB,CAAC;oBACnC,iJAAiJ;iBACjJ,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,8IAA8I;gBAC/I,QAAQ,EAAE,oBAAoB;aAC9B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,2BAA2B;gBAC3D,WAAW,EAAE;oBACZ,aAAa,CAAC,wBAAwB,CAAC;oBACvC,4JAA4J;iBAC5J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,kFAAkF;gBACnF,QAAQ,EAAE,wBAAwB;aAClC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,mBAAmB;gBACnD,WAAW,EAAE;oBACZ,aAAa,CAAC,iBAAiB,CAAC;oBAChC,8IAA8I;iBAC9I,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,gGAAgG,oCAAwB,EAAE;gBAC1I,QAAQ,EAAE,iBAAiB;aAC3B,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,SAA0B;QAC3C,OAAO,SAAS,CAAC,MAAM,CACtB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;YACjB,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC/B,IAAI,CAAC,0BAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAC3C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;oBAAE,OAAO;gBAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,cAAc;oBAAE,OAAO;gBAEzD,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxF,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;gBAED,IAAI,CAAC,4CAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAE7D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;oBACvC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,QAAQ;oBAAE,OAAO;gBACjE,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,IAAI;oBAAE,OAAO;gBAEtD,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,IACC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB;oBACjD,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,KAAK,QAAQ;oBAChE,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAC3D,CAAC;oBACF,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACtE,CAAC;YACF,CAAC,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC;QACZ,CAAC,EACD,EAAE,oBAAoB,EAAE,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CACjF,CAAC;IACH,CAAC;CACD,CAAA;AAjGY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,YAAO,GAAE;GACG,oBAAoB,CAiGhC"}

package/dist/security-audit/risk-reporters/filesystem-risk-reporter.d.ts

@@ -0,0 +1,5 @@
+import type { IWorkflowBase } from 'n8n-workflow';
+import type { RiskReporter, Risk } from '../../security-audit/types';
+export declare class FilesystemRiskReporter implements RiskReporter {
+    report(workflows: IWorkflowBase[]): Promise<Risk.StandardReport | null>;
+}

package/dist/security-audit/risk-reporters/filesystem-risk-reporter.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FilesystemRiskReporter = void 0;
+const di_1 = require("@n8n/di");
+const constants_1 = require("../../security-audit/constants");
+const utils_1 = require("../../security-audit/utils");
+let FilesystemRiskReporter = class FilesystemRiskReporter {
+    async report(workflows) {
+        const fsInteractionNodeTypes = (0, utils_1.getNodeTypes)(workflows, (node) => constants_1.FILESYSTEM_INTERACTION_NODE_TYPES.has(node.type));
+        if (fsInteractionNodeTypes.length === 0)
+            return null;
+        const report = {
+            risk: constants_1.FILESYSTEM_REPORT.RISK,
+            sections: [],
+        };
+        const sentenceStart = ({ length }) => length > 1 ? 'These nodes read from and write to' : 'This node reads from and writes to';
+        if (fsInteractionNodeTypes.length > 0) {
+            report.sections.push({
+                title: constants_1.FILESYSTEM_REPORT.SECTIONS.FILESYSTEM_INTERACTION_NODES,
+                description: [
+                    sentenceStart(fsInteractionNodeTypes),
+                    'any accessible file in the host filesystem. Sensitive file content may be manipulated through a node operation.',
+                ].join(' '),
+                recommendation: 'Consider protecting any sensitive files in the host filesystem, or refactoring the workflow so that it does not require host filesystem interaction.',
+                location: fsInteractionNodeTypes,
+            });
+        }
+        return report;
+    }
+};
+exports.FilesystemRiskReporter = FilesystemRiskReporter;
+exports.FilesystemRiskReporter = FilesystemRiskReporter = __decorate([
+    (0, di_1.Service)()
+], FilesystemRiskReporter);
+//# sourceMappingURL=filesystem-risk-reporter.js.map

package/dist/security-audit/risk-reporters/filesystem-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/filesystem-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gCAAkC;AAGlC,0DAAkG;AAElG,kDAAsD;AAG/C,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAClC,KAAK,CAAC,MAAM,CAAC,SAA0B;QACtC,MAAM,sBAAsB,GAAG,IAAA,oBAAY,EAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAC/D,6CAAiC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAChD,CAAC;QAEF,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,6BAAiB,CAAC,IAAI;YAC5B,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE,CACxD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,oCAAoC,CAAC;QAE1F,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,6BAAiB,CAAC,QAAQ,CAAC,4BAA4B;gBAC9D,WAAW,EAAE;oBACZ,aAAa,CAAC,sBAAsB,CAAC;oBACrC,iHAAiH;iBACjH,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,sJAAsJ;gBACvJ,QAAQ,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAA;AA/BY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,YAAO,GAAE;GACG,sBAAsB,CA+BlC"}

package/dist/security-audit/risk-reporters/instance-risk-reporter.d.ts

@@ -0,0 +1,19 @@
+import { Logger } from '@n8n/backend-common';
+import { GlobalConfig } from '@n8n/config';
+import { InstanceSettings } from 'n8n-core';
+import type { IWorkflowBase } from 'n8n-workflow';
+import type { RiskReporter, Risk } from '../../security-audit/types';
+export declare class InstanceRiskReporter implements RiskReporter {
+    private readonly instanceSettings;
+    private readonly logger;
+    private readonly globalConfig;
+    constructor(instanceSettings: InstanceSettings, logger: Logger, globalConfig: GlobalConfig);
+    report(workflows: IWorkflowBase[]): Promise<Risk.InstanceReport | null>;
+    private getSecuritySettings;
+    private hasValidatorChild;
+    private getUnprotectedWebhookNodes;
+    private getNextVersions;
+    private removeIconData;
+    private classify;
+    private getOutdatedState;
+}

package/dist/security-audit/risk-reporters/instance-risk-reporter.js

@@ -0,0 +1,172 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstanceRiskReporter = void 0;
+const backend_common_1 = require("@n8n/backend-common");
+const config_1 = require("@n8n/config");
+const db_1 = require("@n8n/db");
+const di_1 = require("@n8n/di");
+const axios_1 = __importDefault(require("axios"));
+const n8n_core_1 = require("n8n-core");
+const constants_1 = require("../../constants");
+const community_packages_config_1 = require("../../modules/community-packages/community-packages.config");
+const public_api_1 = require("../../public-api");
+const constants_2 = require("../../security-audit/constants");
+const utils_1 = require("../../security-audit/utils");
+let InstanceRiskReporter = class InstanceRiskReporter {
+    constructor(instanceSettings, logger, globalConfig) {
+        this.instanceSettings = instanceSettings;
+        this.logger = logger;
+        this.globalConfig = globalConfig;
+    }
+    async report(workflows) {
+        const unprotectedWebhooks = this.getUnprotectedWebhookNodes(workflows);
+        const outdatedState = await this.getOutdatedState();
+        const securitySettings = this.getSecuritySettings();
+        if (unprotectedWebhooks.length === 0 && outdatedState === null && securitySettings === null) {
+            return null;
+        }
+        const report = {
+            risk: constants_2.INSTANCE_REPORT.RISK,
+            sections: [],
+        };
+        if (unprotectedWebhooks.length > 0) {
+            const sentenceStart = ({ length }) => length > 1 ? 'These webhook nodes have' : 'This webhook node has';
+            const recommendedValidators = [...constants_2.WEBHOOK_VALIDATOR_NODE_TYPES]
+                .filter((nodeType) => !nodeType.endsWith('function') || !nodeType.endsWith('functionItem'))
+                .join(',');
+            report.sections.push({
+                title: constants_2.INSTANCE_REPORT.SECTIONS.UNPROTECTED_WEBHOOKS,
+                description: [
+                    sentenceStart(unprotectedWebhooks),
+                    `the "Authentication" field set to "None" and ${unprotectedWebhooks.length > 1 ? 'are' : 'is'} not directly connected to a node to validate the payload. Every unprotected webhook allows your workflow to be called by any third party who knows the webhook URL.`,
+                ].join(' '),
+                recommendation: `Consider setting the "Authentication" field to an option other than "None", or validating the payload with one of the following nodes: ${recommendedValidators}.`,
+                location: unprotectedWebhooks,
+            });
+        }
+        if (outdatedState !== null) {
+            report.sections.push({
+                title: constants_2.INSTANCE_REPORT.SECTIONS.OUTDATED_INSTANCE,
+                description: outdatedState.description,
+                recommendation: 'Consider updating this n8n instance to the latest version to prevent security vulnerabilities.',
+                nextVersions: outdatedState.nextVersions,
+            });
+        }
+        if (securitySettings !== null) {
+            report.sections.push({
+                title: constants_2.INSTANCE_REPORT.SECTIONS.SECURITY_SETTINGS,
+                description: 'This n8n instance has the following security settings.',
+                recommendation: `Consider adjusting the security settings for your n8n instance based on your needs. See: ${constants_2.ENV_VARS_DOCS_URL}`,
+                settings: securitySettings,
+            });
+        }
+        return report;
+    }
+    getSecuritySettings() {
+        if (this.globalConfig.deployment.type === 'cloud')
+            return null;
+        const settings = {};
+        settings.features = {
+            communityPackagesEnabled: di_1.Container.get(community_packages_config_1.CommunityPackagesConfig).enabled,
+            versionNotificationsEnabled: this.globalConfig.versionNotifications.enabled,
+            templatesEnabled: this.globalConfig.templates.enabled,
+            publicApiEnabled: (0, public_api_1.isApiEnabled)(),
+        };
+        const { exclude, include } = this.globalConfig.nodes;
+        settings.nodes = {
+            nodesExclude: exclude.length === 0 ? 'none' : exclude.join(', '),
+            nodesInclude: include.length === 0 ? 'none' : include.join(', '),
+        };
+        settings.telemetry = {
+            diagnosticsEnabled: this.globalConfig.diagnostics.enabled,
+        };
+        return settings;
+    }
+    hasValidatorChild({ node, workflow, }) {
+        const childNodeNames = workflow.connections[node.name]?.main[0]?.map((i) => i.node);
+        if (!childNodeNames)
+            return false;
+        return childNodeNames.some((name) => workflow.nodes.find((n) => n.name === name && constants_2.WEBHOOK_VALIDATOR_NODE_TYPES.has(n.type)));
+    }
+    getUnprotectedWebhookNodes(workflows) {
+        return workflows.reduce((acc, workflow) => {
+            if (!workflow.activeVersionId)
+                return acc;
+            workflow.nodes.forEach((node) => {
+                if (node.type === constants_2.WEBHOOK_NODE_TYPE &&
+                    node.parameters.authentication === undefined &&
+                    !this.hasValidatorChild({ node, workflow })) {
+                    acc.push((0, utils_1.toFlaggedNode)({ node, workflow }));
+                }
+            });
+            return acc;
+        }, []);
+    }
+    async getNextVersions(currentVersionName) {
+        const BASE_URL = this.globalConfig.versionNotifications.endpoint;
+        const { instanceId } = this.instanceSettings;
+        const response = await axios_1.default.get(BASE_URL + currentVersionName, {
+            headers: { 'n8n-instance-id': instanceId },
+        });
+        return response.data;
+    }
+    removeIconData(versions) {
+        return versions.map((version) => {
+            if (version.nodes.length === 0)
+                return version;
+            version.nodes.forEach((node) => delete node.iconData);
+            return version;
+        });
+    }
+    classify(versions, currentVersionName) {
+        const [pass, fail] = (0, db_1.separate)(versions, (v) => v.name === currentVersionName);
+        return { currentVersion: pass[0], nextVersions: fail };
+    }
+    async getOutdatedState() {
+        let versions = [];
+        const localVersion = constants_1.N8N_VERSION;
+        try {
+            versions = await this.getNextVersions(localVersion).then((v) => this.removeIconData(v));
+        }
+        catch (error) {
+            if (backend_common_1.inDevelopment) {
+                this.logger.error('Failed to fetch n8n versions. Skipping outdated instance report...');
+            }
+            return null;
+        }
+        const { currentVersion, nextVersions } = this.classify(versions, localVersion);
+        const nextVersionsNumber = nextVersions.length;
+        if (nextVersionsNumber === 0)
+            return null;
+        const description = [
+            `This n8n instance is outdated. Currently at version ${currentVersion.name}, missing ${nextVersionsNumber} ${nextVersionsNumber > 1 ? 'updates' : 'update'}.`,
+        ];
+        const upcomingSecurityUpdates = nextVersions.some((v) => v.hasSecurityIssue || v.hasSecurityFix);
+        if (upcomingSecurityUpdates)
+            description.push('Newer versions contain security updates.');
+        return {
+            description: description.join(' '),
+            nextVersions,
+        };
+    }
+};
+exports.InstanceRiskReporter = InstanceRiskReporter;
+exports.InstanceRiskReporter = InstanceRiskReporter = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [n8n_core_1.InstanceSettings,
+        backend_common_1.Logger,
+        config_1.GlobalConfig])
+], InstanceRiskReporter);
+//# sourceMappingURL=instance-risk-reporter.js.map

package/dist/security-audit/risk-reporters/instance-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/instance-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAA4D;AAC5D,wCAA2C;AAC3C,gCAAmC;AACnC,gCAA6C;AAC7C,kDAA0B;AAC1B,uCAA4C;AAG5C,2CAA0C;AAC1C,sGAAiG;AACjG,6CAA4C;AAC5C,0DAKoC;AAEpC,kDAAuD;AAGhD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,YACkB,gBAAkC,EAClC,MAAc,EACd,YAA0B;QAF1B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,WAAM,GAAN,MAAM,CAAQ;QACd,iBAAY,GAAZ,YAAY,CAAc;IACzC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,SAA0B;QACtC,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,KAAK,IAAI,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAgB;YAC3B,IAAI,EAAE,2BAAe,CAAC,IAAI;YAC1B,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE,CACxD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAEnE,MAAM,qBAAqB,GAAG,CAAC,GAAG,wCAA4B,CAAC;iBAC7D,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;iBAC1F,IAAI,CAAC,GAAG,CAAC,CAAC;YAEZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,oBAAoB;gBACpD,WAAW,EAAE;oBACZ,aAAa,CAAC,mBAAmB,CAAC;oBAClC,gDACC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAC1C,sKAAsK;iBACtK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,0IAA0I,qBAAqB,GAAG;gBAClL,QAAQ,EAAE,mBAAmB;aAC7B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,iBAAiB;gBACjD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,cAAc,EACb,gGAAgG;gBACjG,YAAY,EAAE,aAAa,CAAC,YAAY;aACxC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,iBAAiB;gBACjD,WAAW,EAAE,wDAAwD;gBACrE,cAAc,EAAE,4FAA4F,6BAAiB,EAAE;gBAC/H,QAAQ,EAAE,gBAAgB;aAC1B,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,mBAAmB;QAC1B,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAE7C,QAAQ,CAAC,QAAQ,GAAG;YACnB,wBAAwB,EAAE,cAAS,CAAC,GAAG,CAAC,mDAAuB,CAAC,CAAC,OAAO;YACxE,2BAA2B,EAAE,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,OAAO;YAC3E,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO;YACrD,gBAAgB,EAAE,IAAA,yBAAY,GAAE;SAChC,CAAC;QAEF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAErD,QAAQ,CAAC,KAAK,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAChE,YAAY,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;SAChE,CAAC;QAEF,QAAQ,CAAC,SAAS,GAAG;YACpB,kBAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO;SACzD,CAAC;QAEF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAKO,iBAAiB,CAAC,EACzB,IAAI,EACJ,QAAQ,GAIR;QACA,MAAM,cAAc,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEpF,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAElC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,wCAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACvF,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,SAA0B;QAC5D,OAAO,SAAS,CAAC,MAAM,CAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;YAC9D,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAAE,OAAO,GAAG,CAAC;YAE1C,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC/B,IACC,IAAI,CAAC,IAAI,KAAK,6BAAiB;oBAC/B,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;oBAC5C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC1C,CAAC;oBACF,GAAG,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACF,CAAC,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,kBAA0B;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QACjE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAE7C,MAAM,QAAQ,GAAG,MAAM,eAAK,CAAC,GAAG,CAAgB,QAAQ,GAAG,kBAAkB,EAAE;YAC9E,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE;SAC1C,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACtB,CAAC;IAEO,cAAc,CAAC,QAAuB;QAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YAE/C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEtD,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,QAAuB,EAAE,kBAA0B;QACnE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAA,aAAQ,EAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;QAE9E,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;QAElB,MAAM,YAAY,GAAG,uBAAW,CAAC;QAEjC,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,8BAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE/E,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC;QAE/C,IAAI,kBAAkB,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,WAAW,GAAG;YACnB,uDACC,cAAc,CAAC,IAChB,aAAa,kBAAkB,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG;SACnF,CAAC;QAEF,MAAM,uBAAuB,GAAG,YAAY,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,cAAc,CAC7C,CAAC;QAEF,IAAI,uBAAuB;YAAE,WAAW,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAE1F,OAAO;YACN,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,YAAY;SACZ,CAAC;IACH,CAAC;CACD,CAAA;AA/LY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,YAAO,GAAE;qCAG2B,2BAAgB;QAC1B,uBAAM;QACA,qBAAY;GAJhC,oBAAoB,CA+LhC"}

package/dist/security-audit/risk-reporters/nodes-risk-reporter.d.ts

@@ -0,0 +1,12 @@
+import type { IWorkflowBase } from 'n8n-workflow';
+import { LoadNodesAndCredentials } from '../../load-nodes-and-credentials';
+import type { Risk, RiskReporter } from '../../security-audit/types';
+import { PackagesRepository } from '../security-audit.repository';
+export declare class NodesRiskReporter implements RiskReporter {
+    private readonly loadNodesAndCredentials;
+    private readonly packagesRepository;
+    constructor(loadNodesAndCredentials: LoadNodesAndCredentials, packagesRepository: PackagesRepository);
+    report(workflows: IWorkflowBase[]): Promise<Risk.StandardReport | null>;
+    private getCommunityNodeDetails;
+    private getCustomNodeDetails;
+}

package/dist/security-audit/risk-reporters/nodes-risk-reporter.js

@@ -0,0 +1,143 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodesRiskReporter = void 0;
+const di_1 = require("@n8n/di");
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const path = __importStar(require("path"));
+const load_nodes_and_credentials_1 = require("../../load-nodes-and-credentials");
+const constants_1 = require("../../security-audit/constants");
+const utils_1 = require("../../security-audit/utils");
+const security_audit_repository_1 = require("../security-audit.repository");
+let NodesRiskReporter = class NodesRiskReporter {
+    constructor(loadNodesAndCredentials, packagesRepository) {
+        this.loadNodesAndCredentials = loadNodesAndCredentials;
+        this.packagesRepository = packagesRepository;
+    }
+    async report(workflows) {
+        const officialRiskyNodes = (0, utils_1.getNodeTypes)(workflows, (node) => constants_1.OFFICIAL_RISKY_NODE_TYPES.has(node.type));
+        const [communityNodes, customNodes] = await Promise.all([
+            this.getCommunityNodeDetails(),
+            this.getCustomNodeDetails(),
+        ]);
+        const issues = [officialRiskyNodes, communityNodes, customNodes];
+        if (issues.every((i) => i.length === 0))
+            return null;
+        const report = {
+            risk: constants_1.NODES_REPORT.RISK,
+            sections: [],
+        };
+        const sentenceStart = (length) => (length > 1 ? 'These nodes are' : 'This node is');
+        if (officialRiskyNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.OFFICIAL_RISKY_NODES,
+                description: [
+                    sentenceStart(officialRiskyNodes.length),
+                    "part of n8n's official nodes and may be used to fetch and run any arbitrary code in the host system. This may lead to exploits such as remote code execution.",
+                ].join(' '),
+                recommendation: `Consider reviewing the parameters in these nodes, replacing them with app nodes where possible, and not loading unneeded node types with the NODES_EXCLUDE environment variable. See: ${constants_1.ENV_VARS_DOCS_URL}`,
+                location: officialRiskyNodes,
+            });
+        }
+        if (communityNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.COMMUNITY_NODES,
+                description: [
+                    sentenceStart(communityNodes.length),
+                    `sourced from the n8n community. Community nodes are not vetted by the n8n team and have full access to the host system. See: ${constants_1.COMMUNITY_NODES_RISKS_URL}`,
+                ].join(' '),
+                recommendation: 'Consider reviewing the source code in any community nodes installed in this n8n instance, and uninstalling any community nodes no longer in use.',
+                location: communityNodes,
+            });
+        }
+        if (customNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.CUSTOM_NODES,
+                description: [
+                    sentenceStart(communityNodes.length),
+                    'unpublished and located in the host system. Custom nodes are not vetted by the n8n team and have full access to the host system.',
+                ].join(' '),
+                recommendation: 'Consider reviewing the source code in any custom node installed in this n8n instance, and removing any custom nodes no longer in use.',
+                location: customNodes,
+            });
+        }
+        return report;
+    }
+    async getCommunityNodeDetails() {
+        const installedPackages = await this.packagesRepository.find({ relations: ['installedNodes'] });
+        return installedPackages.reduce((acc, pkg) => {
+            pkg.installedNodes.forEach((node) => acc.push({
+                kind: 'community',
+                nodeType: node.type,
+                packageUrl: [constants_1.NPM_PACKAGE_URL, pkg.packageName].join('/'),
+            }));
+            return acc;
+        }, []);
+    }
+    async getCustomNodeDetails() {
+        const customNodeTypes = [];
+        for (const customDir of this.loadNodesAndCredentials.getCustomDirectories()) {
+            const customNodeFiles = await (0, fast_glob_1.default)('**/*.node.js', { cwd: customDir, absolute: true });
+            for (const nodeFile of customNodeFiles) {
+                const [fileName] = path.parse(nodeFile).name.split('.');
+                customNodeTypes.push({
+                    kind: 'custom',
+                    nodeType: ['CUSTOM', fileName].join('.'),
+                    filePath: nodeFile,
+                });
+            }
+        }
+        return customNodeTypes;
+    }
+};
+exports.NodesRiskReporter = NodesRiskReporter;
+exports.NodesRiskReporter = NodesRiskReporter = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [load_nodes_and_credentials_1.LoadNodesAndCredentials,
+        security_audit_repository_1.PackagesRepository])
+], NodesRiskReporter);
+//# sourceMappingURL=nodes-risk-reporter.js.map

package/dist/security-audit/risk-reporters/nodes-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/nodes-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gCAAkC;AAClC,0DAA6B;AAE7B,2CAA6B;AAE7B,6EAAuE;AACvE,0DAMoC;AAEpC,kDAAsD;AAEtD,4EAAkE;AAG3D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,YACkB,uBAAgD,EAChD,kBAAsC;QADtC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,uBAAkB,GAAlB,kBAAkB,CAAoB;IACrD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,SAA0B;QACtC,MAAM,kBAAkB,GAAG,IAAA,oBAAY,EAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,qCAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CACxC,CAAC;QAEF,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,uBAAuB,EAAE;YAC9B,IAAI,CAAC,oBAAoB,EAAE;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,wBAAY,CAAC,IAAI;YACvB,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAE5F,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,oBAAoB;gBACjD,WAAW,EAAE;oBACZ,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBACxC,+JAA+J;iBAC/J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,yLAAyL,6BAAiB,EAAE;gBAC5N,QAAQ,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,eAAe;gBAC5C,WAAW,EAAE;oBACZ,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC;oBACpC,gIAAgI,qCAAyB,EAAE;iBAC3J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,kJAAkJ;gBACnJ,QAAQ,EAAE,cAAc;aACxB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,YAAY;gBACzC,WAAW,EAAE;oBACZ,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC;oBACpC,kIAAkI;iBAClI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,uIAAuI;gBACxI,QAAQ,EAAE,WAAW;aACrB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAEhG,OAAO,iBAAiB,CAAC,MAAM,CAA8B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACzE,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,GAAG,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,UAAU,EAAE,CAAC,2BAAe,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACxD,CAAC,CACF,CAAC;YAEF,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,CAAC;IAEO,KAAK,CAAC,oBAAoB;QACjC,MAAM,eAAe,GAA6B,EAAE,CAAC;QAErD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,uBAAuB,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC7E,MAAM,eAAe,GAAG,MAAM,IAAA,mBAAI,EAAC,cAAc,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAEvF,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;gBACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxD,eAAe,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACxC,QAAQ,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,OAAO,eAAe,CAAC;IACxB,CAAC;CACD,CAAA;AAtGY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAGkC,oDAAuB;QAC5B,8CAAkB;GAH5C,iBAAiB,CAsG7B"}

package/dist/security-audit/security-audit.repository.d.ts

@@ -0,0 +1,5 @@
+import { DataSource, Repository } from '@n8n/typeorm';
+import { InstalledPackages } from '../modules/community-packages/installed-packages.entity';
+export declare class PackagesRepository extends Repository<InstalledPackages> {
+    constructor(dataSource: DataSource);
+}

package/dist/security-audit/security-audit.repository.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackagesRepository = void 0;
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const installed_packages_entity_1 = require("../modules/community-packages/installed-packages.entity");
+let PackagesRepository = class PackagesRepository extends typeorm_1.Repository {
+    constructor(dataSource) {
+        super(installed_packages_entity_1.InstalledPackages, dataSource.manager);
+    }
+};
+exports.PackagesRepository = PackagesRepository;
+exports.PackagesRepository = PackagesRepository = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], PackagesRepository);
+//# sourceMappingURL=security-audit.repository.js.map

package/dist/security-audit/security-audit.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.repository.js","sourceRoot":"","sources":["../../src/security-audit/security-audit.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,gCAAkC;AAElC,0CAAsD;AAEtD,sGAA2F;AAGpF,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,oBAA6B;IACpE,YAAY,UAAsB;QACjC,KAAK,CAAC,6CAAiB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;CACD,CAAA;AAJY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,YAAO,GAAE;qCAEe,oBAAU;GADtB,kBAAkB,CAI9B"}

package/dist/security-audit/security-audit.service.d.ts

@@ -0,0 +1,11 @@
+import { SecurityConfig } from '@n8n/config';
+import { WorkflowRepository } from '@n8n/db';
+import type { Risk } from '../security-audit/types';
+export declare class SecurityAuditService {
+    private readonly workflowRepository;
+    private readonly securityConfig;
+    constructor(workflowRepository: WorkflowRepository, securityConfig: SecurityConfig);
+    private reporters;
+    run(categories?: Risk.Category[], daysAbandonedWorkflow?: number): Promise<never[] | Risk.Audit>;
+    initReporters(categories: Risk.Category[]): Promise<void>;
+}