@n8n/workflow-sdk 0.2.0

package/dist/ast-interpreter/validators.js

@@ -0,0 +1,243 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOWED_METHODS = exports.AUTO_RENAMEABLE_SDK_FUNCTIONS = exports.ALLOWED_SDK_FUNCTIONS = void 0;
+exports.isAutoRenameableSDKFunction = isAutoRenameableSDKFunction;
+exports.validateNodeType = validateNodeType;
+exports.validateIdentifier = validateIdentifier;
+exports.validateCallExpression = validateCallExpression;
+exports.validateMemberExpression = validateMemberExpression;
+exports.isAllowedSDKFunction = isAllowedSDKFunction;
+exports.isAllowedMethod = isAllowedMethod;
+exports.getSafeJSONMethod = getSafeJSONMethod;
+exports.getSafeStringMethod = getSafeStringMethod;
+const errors_1 = require("./errors");
+exports.ALLOWED_SDK_FUNCTIONS = new Set([
+    'workflow',
+    'node',
+    'trigger',
+    'sticky',
+    'placeholder',
+    'newCredential',
+    'ifElse',
+    'switchCase',
+    'merge',
+    'splitInBatches',
+    'nextBatch',
+    'languageModel',
+    'memory',
+    'tool',
+    'outputParser',
+    'embedding',
+    'embeddings',
+    'vectorStore',
+    'retriever',
+    'documentLoader',
+    'textSplitter',
+    'reranker',
+    'fromAi',
+]);
+exports.AUTO_RENAMEABLE_SDK_FUNCTIONS = new Set([
+    'languageModel',
+    'memory',
+    'tool',
+    'outputParser',
+    'embedding',
+    'embeddings',
+    'vectorStore',
+    'retriever',
+    'documentLoader',
+    'textSplitter',
+    'reranker',
+]);
+function isAutoRenameableSDKFunction(name) {
+    return exports.AUTO_RENAMEABLE_SDK_FUNCTIONS.has(name);
+}
+exports.ALLOWED_METHODS = new Set([
+    'add',
+    'to',
+    'input',
+    'output',
+    'onError',
+    'onTrue',
+    'onFalse',
+    'onCase',
+    'onEachBatch',
+    'onDone',
+    'connect',
+    'toJSON',
+    'validate',
+]);
+const DANGEROUS_GLOBALS = new Set([
+    'eval',
+    'Function',
+    'require',
+    'import',
+    'process',
+    'global',
+    'globalThis',
+    'window',
+    'document',
+    'setTimeout',
+    'setInterval',
+    'setImmediate',
+    'clearTimeout',
+    'clearInterval',
+    'clearImmediate',
+    '__dirname',
+    '__filename',
+    'module',
+    'exports',
+    'Buffer',
+    'Reflect',
+    'Proxy',
+    'Object',
+    'Array',
+    'String',
+    'Number',
+    'Boolean',
+    'Symbol',
+    'BigInt',
+    'JSON',
+    'Math',
+    'Date',
+    'RegExp',
+    'Promise',
+    'WeakRef',
+    'WeakMap',
+    'WeakSet',
+    'Map',
+    'Set',
+    'ArrayBuffer',
+    'SharedArrayBuffer',
+    'DataView',
+    'Atomics',
+    'WebAssembly',
+    'fetch',
+    'XMLHttpRequest',
+    'queueMicrotask',
+    'structuredClone',
+    'Error',
+    'TypeError',
+    'RangeError',
+    'console',
+]);
+const ALLOWED_NODE_TYPES = new Set([
+    'Program',
+    'VariableDeclaration',
+    'VariableDeclarator',
+    'ExpressionStatement',
+    'ExportDefaultDeclaration',
+    'CallExpression',
+    'MemberExpression',
+    'ObjectExpression',
+    'ArrayExpression',
+    'Identifier',
+    'Literal',
+    'TemplateLiteral',
+    'TemplateElement',
+    'SpreadElement',
+    'Property',
+    'AssignmentExpression',
+    'UnaryExpression',
+    'BinaryExpression',
+    'LogicalExpression',
+    'ConditionalExpression',
+]);
+const FORBIDDEN_NODE_TYPES = {
+    ArrowFunctionExpression: 'Arrow functions are not allowed. Use fromAi() directly instead of ($) => $.fromAi()',
+    FunctionExpression: 'Function expressions are not allowed in SDK code',
+    FunctionDeclaration: 'Function declarations are not allowed in SDK code',
+    ClassDeclaration: 'Class declarations are not allowed in SDK code',
+    ClassExpression: 'Class expressions are not allowed in SDK code',
+    ForStatement: 'For loops are not allowed in SDK code',
+    ForInStatement: 'For-in loops are not allowed in SDK code',
+    ForOfStatement: 'For-of loops are not allowed in SDK code',
+    WhileStatement: 'While loops are not allowed in SDK code',
+    DoWhileStatement: 'Do-while loops are not allowed in SDK code',
+    TryStatement: 'Try-catch is not allowed in SDK code',
+    ThrowStatement: 'Throw statements are not allowed in SDK code',
+    WithStatement: 'With statements are not allowed in SDK code',
+    UpdateExpression: 'Update expressions (++, --) are not allowed in SDK code',
+    NewExpression: 'new expressions are not allowed. Use SDK factory functions instead.',
+    ImportDeclaration: 'Import declarations are not allowed in SDK code',
+    ImportExpression: 'Dynamic imports are not allowed in SDK code',
+    ExportNamedDeclaration: 'Named exports are not allowed. Use export default only.',
+    ExportAllDeclaration: 'Re-exports are not allowed in SDK code',
+    AwaitExpression: 'Await expressions are not allowed in SDK code',
+    YieldExpression: 'Yield expressions are not allowed in SDK code',
+};
+function validateNodeType(node, sourceCode) {
+    if (FORBIDDEN_NODE_TYPES[node.type]) {
+        throw new errors_1.UnsupportedNodeError(`${node.type}: ${FORBIDDEN_NODE_TYPES[node.type]}`, node.loc ?? undefined, sourceCode);
+    }
+    if (!ALLOWED_NODE_TYPES.has(node.type)) {
+        throw new errors_1.UnsupportedNodeError(node.type, node.loc ?? undefined, sourceCode);
+    }
+}
+function validateIdentifier(name, _allowedVariables, node, sourceCode) {
+    if (DANGEROUS_GLOBALS.has(name)) {
+        throw new errors_1.SecurityError(`Access to '${name}' is not allowed`, node.loc ?? undefined, sourceCode);
+    }
+}
+function validateCallExpression(node, sourceCode) {
+    if (node.callee.type === 'Identifier') {
+        const name = node.callee.name;
+        if (name === 'eval') {
+            throw new errors_1.SecurityError('eval()', node.loc ?? undefined, sourceCode);
+        }
+        if (name === 'Function') {
+            throw new errors_1.SecurityError('Function()', node.loc ?? undefined, sourceCode);
+        }
+        if (name === 'require') {
+            throw new errors_1.SecurityError('require()', node.loc ?? undefined, sourceCode);
+        }
+    }
+    if (node.callee.type === 'MemberExpression') {
+        const memberExpr = node.callee;
+        if (memberExpr.property.type === 'Identifier' && memberExpr.property.name === 'constructor') {
+            throw new errors_1.SecurityError('constructor access', node.loc ?? undefined, sourceCode);
+        }
+    }
+}
+function validateMemberExpression(node, sourceCode) {
+    if (node.computed) {
+        if (node.property.type !== 'Literal') {
+            throw new errors_1.SecurityError('Dynamic property access is not allowed. Use static property names.', node.loc ?? undefined, sourceCode);
+        }
+    }
+    const propName = node.property.type === 'Identifier'
+        ? node.property.name
+        : node.property.type === 'Literal' && typeof node.property.value === 'string'
+            ? node.property.value
+            : undefined;
+    if (propName !== undefined &&
+        (propName === '__proto__' || propName === 'prototype' || propName === 'constructor')) {
+        throw new errors_1.SecurityError(`Access to '${propName}' is not allowed`, node.loc ?? undefined, sourceCode);
+    }
+}
+function isAllowedSDKFunction(name) {
+    return exports.ALLOWED_SDK_FUNCTIONS.has(name);
+}
+function isAllowedMethod(name) {
+    return exports.ALLOWED_METHODS.has(name);
+}
+const SAFE_JSON_METHODS = {
+    stringify: (...args) => JSON.stringify(args[0], args[1], args[2]),
+};
+function getSafeJSONMethod(objectName, methodName) {
+    if (objectName !== 'JSON')
+        return undefined;
+    return SAFE_JSON_METHODS[methodName];
+}
+const SAFE_STRING_METHODS = {
+    repeat: (str, count) => str.repeat(count),
+};
+function getSafeStringMethod(value, methodName) {
+    if (typeof value !== 'string')
+        return undefined;
+    const factory = SAFE_STRING_METHODS[methodName];
+    if (!factory)
+        return undefined;
+    return (...args) => factory(value, ...args);
+}
+//# sourceMappingURL=validators.js.map

package/dist/ast-interpreter/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/ast-interpreter/validators.ts"],"names":[],"mappings":";;;AAiEA,kEAEC;AA6KD,4CAYC;AAMD,gDAaC;AAMD,wDAsBC;AAMD,4DAgCC;AAKD,oDAEC;AAKD,0CAEC;AAeD,8CAMC;AAaD,kDAQC;AAnYD,qCAA+D;AAKlD,QAAA,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAE5C,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;IACR,aAAa;IACb,eAAe;IAGf,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,gBAAgB;IAChB,WAAW;IAGX,eAAe;IACf,QAAQ;IACR,MAAM;IACN,cAAc;IACd,WAAW;IACX,YAAY;IACZ,aAAa;IACb,WAAW;IACX,gBAAgB;IAChB,cAAc;IACd,UAAU;IAGV,QAAQ;CACR,CAAC,CAAC;AAMU,QAAA,6BAA6B,GAAG,IAAI,GAAG,CAAC;IACpD,eAAe;IACf,QAAQ;IACR,MAAM;IACN,cAAc;IACd,WAAW;IACX,YAAY;IACZ,aAAa;IACb,WAAW;IACX,gBAAgB;IAChB,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AAKH,SAAgB,2BAA2B,CAAC,IAAY;IACvD,OAAO,qCAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAKY,QAAA,eAAe,GAAG,IAAI,GAAG,CAAC;IAEtC,KAAK;IACL,IAAI;IAGJ,OAAO;IACP,QAAQ;IACR,SAAS;IAGT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,aAAa;IACb,QAAQ;IAGR,SAAS;IAGT,QAAQ;IACR,UAAU;CACV,CAAC,CAAC;AAKH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM;IACN,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,OAAO;IAGP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IAGR,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IAGR,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IAGL,aAAa;IACb,mBAAmB;IACnB,UAAU;IACV,SAAS;IAGT,aAAa;IAGb,OAAO;IACP,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IAGjB,OAAO;IACP,WAAW;IACX,YAAY;IAGZ,SAAS;CACT,CAAC,CAAC;AAKH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAElC,SAAS;IAGT,qBAAqB;IACrB,oBAAoB;IAGpB,qBAAqB;IACrB,0BAA0B;IAG1B,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,YAAY;IACZ,SAAS;IACT,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,UAAU;IAGV,sBAAsB;IAGtB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,uBAAuB;CACvB,CAAC,CAAC;AAKH,MAAM,oBAAoB,GAA2B;IACpD,uBAAuB,EACtB,qFAAqF;IACtF,kBAAkB,EAAE,kDAAkD;IACtE,mBAAmB,EAAE,mDAAmD;IACxE,gBAAgB,EAAE,gDAAgD;IAClE,eAAe,EAAE,+CAA+C;IAChE,YAAY,EAAE,uCAAuC;IACrD,cAAc,EAAE,0CAA0C;IAC1D,cAAc,EAAE,0CAA0C;IAC1D,cAAc,EAAE,yCAAyC;IACzD,gBAAgB,EAAE,4CAA4C;IAC9D,YAAY,EAAE,sCAAsC;IACpD,cAAc,EAAE,8CAA8C;IAC9D,aAAa,EAAE,6CAA6C;IAC5D,gBAAgB,EAAE,yDAAyD;IAC3E,aAAa,EAAE,qEAAqE;IACpF,iBAAiB,EAAE,iDAAiD;IACpE,gBAAgB,EAAE,6CAA6C;IAC/D,sBAAsB,EAAE,yDAAyD;IACjF,oBAAoB,EAAE,wCAAwC;IAC9D,eAAe,EAAE,+CAA+C;IAChE,eAAe,EAAE,+CAA+C;CAChE,CAAC;AAMF,SAAgB,gBAAgB,CAAC,IAAU,EAAE,UAAkB;IAC9D,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,6BAAoB,CAC7B,GAAG,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClD,IAAI,CAAC,GAAG,IAAI,SAAS,EACrB,UAAU,CACV,CAAC;IACH,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,6BAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,UAAU,CAAC,CAAC;IAC9E,CAAC;AACF,CAAC;AAMD,SAAgB,kBAAkB,CACjC,IAAY,EACZ,iBAA8B,EAC9B,IAAU,EACV,UAAkB;IAElB,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,sBAAa,CACtB,cAAc,IAAI,kBAAkB,EACpC,IAAI,CAAC,GAAG,IAAI,SAAS,EACrB,UAAU,CACV,CAAC;IACH,CAAC;AACF,CAAC;AAMD,SAAgB,sBAAsB,CAAC,IAAoB,EAAE,UAAkB;IAE9E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,sBAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,UAAU,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAa,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,UAAU,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,UAAU,CAAC,CAAC;QACzE,CAAC;IACF,CAAC;IAGD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC7F,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,UAAU,CAAC,CAAC;QAClF,CAAC;IACF,CAAC;AACF,CAAC;AAMD,SAAgB,wBAAwB,CAAC,IAAsB,EAAE,UAAkB;IAGlF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEnB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAa,CACtB,oEAAoE,EACpE,IAAI,CAAC,GAAG,IAAI,SAAS,EACrB,UAAU,CACV,CAAC;QACH,CAAC;IACF,CAAC;IAGD,MAAM,QAAQ,GACb,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;QAClC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;QACpB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ;YAC5E,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK;YACrB,CAAC,CAAC,SAAS,CAAC;IAEf,IACC,QAAQ,KAAK,SAAS;QACtB,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,aAAa,CAAC,EACnF,CAAC;QACF,MAAM,IAAI,sBAAa,CACtB,cAAc,QAAQ,kBAAkB,EACxC,IAAI,CAAC,GAAG,IAAI,SAAS,EACrB,UAAU,CACV,CAAC;IACH,CAAC;AACF,CAAC;AAKD,SAAgB,oBAAoB,CAAC,IAAY;IAChD,OAAO,6BAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAKD,SAAgB,eAAe,CAAC,IAAY;IAC3C,OAAO,uBAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAMD,MAAM,iBAAiB,GAAoD;IAC1E,SAAS,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAc,EAAE,IAAI,CAAC,CAAC,CAAc,CAAC;CACpE,CAAC;AAMF,SAAgB,iBAAiB,CAChC,UAAkB,EAClB,UAAkB;IAElB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,iBAAiB,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC;AAKD,MAAM,mBAAmB,GAAiE;IACzF,MAAM,EAAE,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAe,CAAC;CACpE,CAAC;AAMF,SAAgB,mBAAmB,CAClC,KAAc,EACd,UAAkB;IAElB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACxD,CAAC"}