@nocobase/plugin-workflow-javascript 2.1.0-alpha.17 → 2.1.0-alpha.19

package/.env.example

@@ -0,0 +1,15 @@
+# This is an example of environment variables for the plugin-workflow-javascript plugin.
+# You can merge this file with your existing .env file and customize the values as needed.
+#
+# --- SECURITY WARNING ---
+# * By default, no modules are allowed to be used in the JavaScript node. Your script will be executed in a sandboxed environment by `isolated-vm`.
+#
+# * By setting any module in WORKFLOW_SCRIPT_MODULES, the JavaScript node will use `node:vm` to execute the script,
+#   which will cause potential security risks. Please make sure the script content is managed by privileged users,
+#   and use it with caution. This will be at your own risk.
+#
+# See the documentation for more details: https://docs.nocobase.com/workflow/nodes/javascript#safe-mode-default
+#
+# Example: lodash,dayjs
+# WORKFLOW_SCRIPT_MODULES=lodash,dayjs
+WORKFLOW_SCRIPT_MODULES=

package/dist/externalVersion.js

@@ -13,11 +13,11 @@ module.exports = {
   "antd-style": "3.7.1",
   "@formily/antd-v5": "1.2.3",
   "@ant-design/icons": "5.6.1",
-  "@nocobase/client": "2.1.0-alpha.17",
-  "@nocobase/plugin-workflow": "2.1.0-alpha.17",
+  "@nocobase/client": "2.1.0-alpha.19",
+  "@nocobase/plugin-workflow": "2.1.0-alpha.19",
   "antd": "5.24.2",
-  "@nocobase/flow-engine": "2.1.0-alpha.17",
+  "@nocobase/flow-engine": "2.1.0-alpha.19",
   "react-i18next": "11.18.6",
   "winston": "3.13.0",
-  "@nocobase/server": "2.1.0-alpha.17"
+  "@nocobase/server": "2.1.0-alpha.19"
 };

package/dist/node_modules/isolated-vm/package.json

@@ -1 +1 @@
-{"name":"isolated-vm","version":"5.0.4","description":"Access to multiple isolates","main":"isolated-vm.js","types":"isolated-vm.d.ts","engines":{"node":">=18.0.0"},"scripts":{"install":"prebuild-install || (node-gyp rebuild --release -j max && node-gyp clean)","rebuild":"node-gyp rebuild --release -j max","lint":"find src -name '*.cc' | xargs -n1 clang-tidy","test":"node test.js"},"dependencies":{"prebuild-install":"^7.1.2"},"devDependencies":{"isolated-vm":".","prebuild":"^13.0.1"},"binary":{"module_path":"out"},"repository":{"type":"git","url":"git+https://github.com/laverdet/isolated-vm.git"},"author":"https://github.com/laverdet/","license":"ISC","gypfile":true,"bugs":{"url":"https://github.com/laverdet/isolated-vm/issues"},"homepage":"https://github.com/laverdet/isolated-vm#readme","_lastModified":"2026-04-17T02:46:33.127Z"}
+{"name":"isolated-vm","version":"5.0.4","description":"Access to multiple isolates","main":"isolated-vm.js","types":"isolated-vm.d.ts","engines":{"node":">=18.0.0"},"scripts":{"install":"prebuild-install || (node-gyp rebuild --release -j max && node-gyp clean)","rebuild":"node-gyp rebuild --release -j max","lint":"find src -name '*.cc' | xargs -n1 clang-tidy","test":"node test.js"},"dependencies":{"prebuild-install":"^7.1.2"},"devDependencies":{"isolated-vm":".","prebuild":"^13.0.1"},"binary":{"module_path":"out"},"repository":{"type":"git","url":"git+https://github.com/laverdet/isolated-vm.git"},"author":"https://github.com/laverdet/","license":"ISC","gypfile":true,"bugs":{"url":"https://github.com/laverdet/isolated-vm/issues"},"homepage":"https://github.com/laverdet/isolated-vm#readme","_lastModified":"2026-04-19T04:13:14.397Z"}

package/dist/node_modules/joi/package.json

@@ -1 +1 @@
-{"name":"joi","description":"Object schema validation","version":"17.13.3","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-04-17T02:46:33.579Z"}
+{"name":"joi","description":"Object schema validation","version":"17.13.3","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-04-19T04:13:14.872Z"}

package/dist/node_modules/winston-transport/package.json

@@ -1 +1 @@
-{"name":"winston-transport","description":"Base stream implementations for winston@3 and up.","version":"4.7.0","main":"index.js","browser":"dist/index.js","scripts":{"lint":"eslint test/*.js index.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist","pretest":"npm run lint && npm run build","test":"nyc mocha test/*.test.js","report":"nyc report --reporter=lcov","build":"rimraf dist && babel *.js -d ./dist","prepublishOnly":"npm run build"},"repository":{"type":"git","url":"git@github.com:winstonjs/winston-transport.git"},"keywords":["winston","transport","winston3"],"author":"Charlie Robbins <charlie.robbins@gmail.com>","license":"MIT","bugs":{"url":"https://github.com/winstonjs/winston-transport/issues"},"homepage":"https://github.com/winstonjs/winston-transport#readme","dependencies":{"logform":"^2.3.2","readable-stream":"^3.6.0","triple-beam":"^1.3.0"},"devDependencies":{"@types/node":"^20.8.6","abstract-winston-transport":">=0.5.1","assume":"^2.3.0","babel-cli":"^6.26.0","babel-preset-env":"^1.7.0","deep-equal":"^2.0.5","eslint":"^8.8.0","@dabh/eslint-config-populist":"^5.0.0","mocha":"^10.0.0","nyc":"^15.1.0","rimraf":"^5.0.5","winston-compat":"^0.1.5"},"engines":{"node":">= 12.0.0"},"_lastModified":"2026-04-17T02:46:34.197Z"}
+{"name":"winston-transport","description":"Base stream implementations for winston@3 and up.","version":"4.7.0","main":"index.js","browser":"dist/index.js","scripts":{"lint":"eslint test/*.js index.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist","pretest":"npm run lint && npm run build","test":"nyc mocha test/*.test.js","report":"nyc report --reporter=lcov","build":"rimraf dist && babel *.js -d ./dist","prepublishOnly":"npm run build"},"repository":{"type":"git","url":"git@github.com:winstonjs/winston-transport.git"},"keywords":["winston","transport","winston3"],"author":"Charlie Robbins <charlie.robbins@gmail.com>","license":"MIT","bugs":{"url":"https://github.com/winstonjs/winston-transport/issues"},"homepage":"https://github.com/winstonjs/winston-transport#readme","dependencies":{"logform":"^2.3.2","readable-stream":"^3.6.0","triple-beam":"^1.3.0"},"devDependencies":{"@types/node":"^20.8.6","abstract-winston-transport":">=0.5.1","assume":"^2.3.0","babel-cli":"^6.26.0","babel-preset-env":"^1.7.0","deep-equal":"^2.0.5","eslint":"^8.8.0","@dabh/eslint-config-populist":"^5.0.0","mocha":"^10.0.0","nyc":"^15.1.0","rimraf":"^5.0.5","winston-compat":"^0.1.5"},"engines":{"node":">= 12.0.0"},"_lastModified":"2026-04-19T04:13:15.583Z"}

package/dist/server/Vm.js

@@ -11,34 +11,184 @@ const { parentPort, workerData } = require("node:worker_threads");
 const { Script } = require("node:vm");
 const Path = require("node:path");
 let timer = null;
-function customRequire(m) {
-  var _a;
-  const configuredModules = (((_a = process.env.WORKFLOW_SCRIPT_MODULES) == null ? void 0 : _a.split(",")) ?? []).filter(Boolean);
-  let mainName;
-  if (Path.isAbsolute(m)) {
-    mainName = m;
-  } else if (m.startsWith(".")) {
-    mainName = m;
-    m = Path.resolve(process.cwd(), m);
-  } else {
-    mainName = m.split("/").slice(0, m.startsWith("@") ? 2 : 1).join("/");
-  }
-  if (configuredModules.includes(mainName)) {
-    return require(m);
-  }
-  throw new Error(`module "${m}" not supported`);
-}
-function hardenFunction(fn) {
-  Object.setPrototypeOf(fn, null);
-  Object.defineProperty(fn, "constructor", {
+function harden(v) {
+  Object.setPrototypeOf(v, null);
+  Object.defineProperty(v, "constructor", {
     value: null,
     writable: false,
     enumerable: false,
     configurable: false
   });
-  return fn;
+  return v;
+}
+function createSandboxError(msg) {
+  return harden(new Error(msg));
+}
+function resolveProperty(obj, key) {
+  const desc = Object.getOwnPropertyDescriptor(obj, key);
+  if (!desc) return void 0;
+  if ("value" in desc) return desc.value;
+  if (desc.get) {
+    try {
+      return desc.get.call(obj);
+    } catch (_) {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function sanitizeError(e) {
+  let msg;
+  try {
+    msg = e != null && typeof e.message === "string" ? e.message : String(e);
+  } catch (_) {
+    msg = "unknown error";
+  }
+  return createSandboxError(msg);
+}
+function sanitizeReturnValue(result) {
+  if (result === null || result === void 0) return result;
+  if (typeof result !== "object" && typeof result !== "function") return result;
+  if (typeof result.then === "function") {
+    const cleanThenable = /* @__PURE__ */ Object.create(null);
+    const originalThen = result.then.bind(result);
+    Object.defineProperty(cleanThenable, "then", {
+      value: harden(function(onFulfilled, onRejected) {
+        const next = originalThen(
+          typeof onFulfilled === "function" ? (v) => onFulfilled(sanitizeForSandbox(v, null, /* @__PURE__ */ new WeakMap())) : onFulfilled,
+          typeof onRejected === "function" ? (e) => onRejected(sanitizeError(e)) : onRejected
+        );
+        return sanitizeReturnValue(next);
+      }),
+      writable: false,
+      enumerable: true,
+      configurable: false
+    });
+    return cleanThenable;
+  }
+  return sanitizeForSandbox(result, null, /* @__PURE__ */ new WeakMap());
+}
+function sanitizeForSandbox(val, parent, cache) {
+  if (!cache) cache = /* @__PURE__ */ new WeakMap();
+  if (val === null || val === void 0) return val;
+  if (typeof val !== "object" && typeof val !== "function") return val;
+  if (cache.has(val)) return cache.get(val);
+  if (typeof val === "function") {
+    const fn = parent != null ? val.bind(parent) : val;
+    const wrapper = function(...args) {
+      let ret;
+      try {
+        ret = fn(...args);
+      } catch (e) {
+        throw sanitizeError(e);
+      }
+      return sanitizeReturnValue(ret);
+    };
+    cache.set(val, wrapper);
+    harden(wrapper);
+    const SKIP_PROPS = /* @__PURE__ */ new Set(["length", "name", "prototype", "caller", "arguments", "constructor"]);
+    for (const key of Object.getOwnPropertyNames(val)) {
+      if (SKIP_PROPS.has(key)) continue;
+      try {
+        const resolved = resolveProperty(val, key);
+        if (resolved !== void 0) {
+          Object.defineProperty(wrapper, key, {
+            value: sanitizeForSandbox(resolved, val, cache),
+            writable: false,
+            enumerable: true,
+            configurable: false
+          });
+        }
+      } catch (_) {
+      }
+    }
+    return wrapper;
+  }
+  if (Array.isArray(val)) {
+    const len = val.length;
+    const cleanArr = /* @__PURE__ */ Object.create(null);
+    cache.set(val, cleanArr);
+    Object.defineProperty(cleanArr, "length", {
+      value: len,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+    for (let i = 0; i < len; i++) {
+      try {
+        cleanArr[i] = sanitizeForSandbox(val[i], null, cache);
+      } catch (_) {
+      }
+    }
+    Object.defineProperty(cleanArr, Symbol.iterator, {
+      value: harden(function() {
+        let idx = 0;
+        const iterator = /* @__PURE__ */ Object.create(null);
+        iterator.next = harden(function() {
+          const result = /* @__PURE__ */ Object.create(null);
+          if (idx < len) {
+            result.value = cleanArr[idx++];
+            result.done = false;
+          } else {
+            result.value = void 0;
+            result.done = true;
+          }
+          return result;
+        });
+        iterator[Symbol.iterator] = harden(function() {
+          return iterator;
+        });
+        return iterator;
+      }),
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+    return cleanArr;
+  }
+  const clean = /* @__PURE__ */ Object.create(null);
+  cache.set(val, clean);
+  let proto = val;
+  while (proto !== null && proto !== Object.prototype) {
+    for (const key of Object.getOwnPropertyNames(proto)) {
+      if (key === "constructor" || key in clean) continue;
+      try {
+        const resolved = resolveProperty(proto, key);
+        if (resolved !== void 0) {
+          clean[key] = sanitizeForSandbox(resolved, val, cache);
+        }
+      } catch (_) {
+      }
+    }
+    proto = Object.getPrototypeOf(proto);
+  }
+  return clean;
 }
-hardenFunction(customRequire);
+function customRequire(m) {
+  var _a;
+  try {
+    if (typeof m !== "string") {
+      throw new Error("module name must be a string");
+    }
+    const configuredModules = (((_a = process.env.WORKFLOW_SCRIPT_MODULES) == null ? void 0 : _a.split(",")) ?? []).filter(Boolean);
+    let mainName;
+    if (Path.isAbsolute(m)) {
+      mainName = m;
+    } else if (m.startsWith(".")) {
+      mainName = m;
+      m = Path.resolve(process.cwd(), m);
+    } else {
+      mainName = m.split("/").slice(0, m.startsWith("@") ? 2 : 1).join("/");
+    }
+    if (configuredModules.includes(mainName)) {
+      return sanitizeForSandbox(require(m));
+    }
+    throw new Error(`module "${m}" not supported`);
+  } catch (e) {
+    throw sanitizeError(e);
+  }
+}
+harden(customRequire);
 function createSafeConsole(originalConsole) {
   const safe = /* @__PURE__ */ Object.create(null);
   const allowedMethods = [
@@ -64,8 +214,7 @@ function createSafeConsole(originalConsole) {
   ];
   for (const key of allowedMethods) {
     if (typeof originalConsole[key] === "function") {
-      const bound = originalConsole[key].bind(originalConsole);
-      hardenFunction(bound);
+      const bound = harden(originalConsole[key].bind(originalConsole));
       Object.defineProperty(safe, key, {
         value: bound,
         writable: false,
@@ -74,13 +223,7 @@ function createSafeConsole(originalConsole) {
       });
     }
   }
-  Object.defineProperty(safe, "constructor", {
-    value: null,
-    writable: false,
-    enumerable: false,
-    configurable: false
-  });
-  return Object.freeze(safe);
+  return Object.freeze(harden(safe));
 }
 async function main() {
   const { source, args = {}, options = {} } = workerData;
@@ -105,8 +248,17 @@ async function main() {
   const result = script.runInNewContext(context, { timeout: options.timeout });
   return result;
 }
+function toJsonResult(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object" && typeof value !== "function") return value;
+  try {
+    return JSON.parse(JSON.stringify(value));
+  } catch (_) {
+    return value;
+  }
+}
 main().then((result) => {
-  parentPort.postMessage({ type: "result", result });
+  parentPort.postMessage({ type: "result", result: toJsonResult(result) });
 }).catch((error) => {
   throw error;
 }).finally(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-workflow-javascript",
-  "version": "2.1.0-alpha.17",
+  "version": "2.1.0-alpha.19",
   "displayName": "Workflow: JavaScript",
   "displayName.zh-CN": "工作流：JavaScript 节点",
   "description": "Execute a piece of JavaScript in an isolated Node.js environment.",
@@ -38,5 +38,5 @@
     "Workflow"
   ],
   "license": "Apache-2.0",
-  "gitHead": "586cb00f56557e66168b9720d0e0193a1b752067"
+  "gitHead": "3d13700360eac1c0f9dbf6a5f167ed396a294a3c"
 }