@nocobase/plugin-workflow-javascript 2.1.0-beta.8 → 2.2.0-alpha.1

package/dist/server/ScriptInstruction.js

@@ -43,15 +43,29 @@ var import_node_events = require("node:events");
 var import_node_path = __toESM(require("node:path"));
 var import_node_worker_threads = require("node:worker_threads");
 var import_winston = __toESM(require("winston"));
+var import_joi = __toESM(require("joi"));
 var import_plugin_workflow = require("@nocobase/plugin-workflow");
 var import_cache_logger = require("./cache-logger");
 class ScriptInstruction extends import_plugin_workflow.Instruction {
+  /**
+   * Returns the worker script path based on whether WORKFLOW_SCRIPT_MODULES is configured.
+   * - WORKFLOW_SCRIPT_MODULES set: uses Node.js vm with require support (unsafe; not a security boundary)
+   * - WORKFLOW_SCRIPT_MODULES unset: uses QuickJS (WASM) for maximum security (no require, no Node.js APIs)
+   */
+  static get workerScript() {
+    const hasModules = (process.env.WORKFLOW_SCRIPT_MODULES ?? "").split(",").filter(Boolean).length > 0;
+    return import_node_path.default.join(__dirname, hasModules ? "Vm.js" : "QuickJs.js");
+  }
   static async run(source, args, options) {
-    const { logger, timeout } = options;
+    const { logger, timeout, signal } = options;
     let result;
-    const worker = new import_node_worker_threads.Worker(import_node_path.default.join(__dirname, "Vm.js"), {
+    const worker = new import_node_worker_threads.Worker(this.workerScript, {
       workerData: { source, args, options: timeout ? { timeout } : {} }
     });
+    const abortListener = () => {
+      worker.terminate();
+    };
+    signal == null ? void 0 : signal.addEventListener("abort", abortListener, { once: true });
     worker.on("message", (message) => {
       if (message.type === "result") {
         result = message.result;
@@ -81,18 +95,33 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
     try {
       await excution;
     } catch (e) {
-      console.log(e);
+      signal == null ? void 0 : signal.removeEventListener("abort", abortListener);
+      if (signal == null ? void 0 : signal.aborted) {
+        throw signal.reason instanceof Error ? signal.reason : new import_plugin_workflow.WorkflowTimeoutError();
+      }
       return {
         status: import_plugin_workflow.JOB_STATUS.ERROR,
-        result: e.message
+        result: e instanceof Error ? e.message : String(e)
       };
     }
+    signal == null ? void 0 : signal.removeEventListener("abort", abortListener);
     return {
       status: import_plugin_workflow.JOB_STATUS.RESOLVED,
       result
     };
   }
-  async run(node, prevJob, processor) {
+  configSchema = import_joi.default.object({
+    content: import_joi.default.string(),
+    timeout: import_joi.default.number(),
+    continue: import_joi.default.boolean(),
+    arguments: import_joi.default.array().items(
+      import_joi.default.object({
+        name: import_joi.default.string().required(),
+        value: import_joi.default.any()
+      })
+    ).optional()
+  });
+  async run(node, prevJob, processor, options) {
     const { content = "", continue: cont, timeout } = node.config;
     const args = processor.getParsedValue(node.config.arguments ?? [], node.id);
     const _args = args.reduce((pre, item) => ({ ...pre, [item.name]: item.value }), {});
@@ -102,7 +131,8 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
     if (sync) {
       const result = await this.constructor.run(content, _args, {
         timeout,
-        logger: processor.logger
+        logger: processor.logger,
+        signal: options == null ? void 0 : options.signal
       });
       if (result.status === import_plugin_workflow.JOB_STATUS.RESOLVED) {
         processor.logger.info(`run script test success, node id: ${node.id},the result is ${result.result}`);
@@ -125,7 +155,7 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
     const jobResult = {
       status: import_plugin_workflow.JOB_STATUS.PENDING
     };
-    this.constructor.run(content, _args, { timeout, logger: processor.logger }).then((res) => {
+    this.constructor.run(content, _args, { timeout, logger: processor.logger, signal: options == null ? void 0 : options.signal }).then((res) => {
       if (res.status === import_plugin_workflow.JOB_STATUS.RESOLVED) {
         processor.logger.info(`script (#${node.id}) get result success`);
         jobResult.status = import_plugin_workflow.JOB_STATUS.RESOLVED;
@@ -143,14 +173,21 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
       jobResult.status = import_plugin_workflow.JOB_STATUS.ERROR;
       jobResult.result = res.result;
     }).catch((e) => {
-      processor.logger.error(`script (#${node.id}) get result failed, the reason is ${e.message}`);
+      const message = e instanceof Error ? e.message : String(e);
+      processor.logger.error(`script (#${node.id}) get result failed, the reason is ${message}`);
       jobResult.status = import_plugin_workflow.JOB_STATUS.ERROR;
-      jobResult.result = e.message;
+      jobResult.result = message;
     }).finally(() => {
       processor.logger.debug(`script (#${node.id}) ended, resume workflow...`);
       setImmediate(async () => {
         const job = await this.workflow.db.getRepository("jobs").findOne({ filterByTk: id });
+        const execution = await job.getExecution();
+        if (execution.status !== 0) {
+          processor.logger.warn(`script (#${node.id}) result discarded because execution (${execution.id}) is ended`);
+          return;
+        }
         job.set(jobResult);
+        job.execution = execution;
         this.workflow.resume(job);
       });
     });
@@ -160,12 +197,15 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
   }
   async test(config = {}) {
     const { content, timeout } = config;
-    const args = (config.arguments ?? []).reduce((pre, item) => ({ ...pre, [item.name]: item.value }), {});
+    const args = (config.arguments ?? []).reduce(
+      (pre, item) => ({ ...pre, [item.name]: item.value }),
+      {}
+    );
     const transport = new import_cache_logger.CacheTransport();
     const logger = import_winston.default.createLogger({
       transports: [transport]
     });
-    const result = await this.constructor.run(content, args, { timeout, logger });
+    const result = await this.constructor.run(content ?? "", args, { timeout, logger });
     const log = transport.getLogs();
     return {
       ...result,

package/dist/server/Vm.js

@@ -28,43 +28,58 @@ function customRequire(m) {
   }
   throw new Error(`module "${m}" not supported`);
 }
-customRequire.constructor = null;
-function createSafeConsole(originalConsole) {
-  const safe = /* @__PURE__ */ Object.create(null);
-  Object.defineProperty(safe, "constructor", {
+function hardenFunction(fn) {
+  Object.setPrototypeOf(fn, null);
+  Object.defineProperty(fn, "constructor", {
     value: null,
     writable: false,
     enumerable: false,
     configurable: false
   });
-  const allKeys = Reflect.ownKeys(originalConsole);
-  for (const key of allKeys) {
-    const descriptor = Object.getOwnPropertyDescriptor(originalConsole, key);
-    if (!descriptor) {
-      continue;
-    }
-    const wrap = (fn) => {
-      const bound = fn.bind(originalConsole);
-      Object.defineProperty(bound, "constructor", {
-        value: null,
+  return fn;
+}
+hardenFunction(customRequire);
+function createSafeConsole(originalConsole) {
+  const safe = /* @__PURE__ */ Object.create(null);
+  const allowedMethods = [
+    "log",
+    "info",
+    "warn",
+    "error",
+    "debug",
+    "trace",
+    "dir",
+    "dirxml",
+    "table",
+    "time",
+    "timeEnd",
+    "timeLog",
+    "count",
+    "countReset",
+    "group",
+    "groupCollapsed",
+    "groupEnd",
+    "clear",
+    "assert"
+  ];
+  for (const key of allowedMethods) {
+    if (typeof originalConsole[key] === "function") {
+      const bound = originalConsole[key].bind(originalConsole);
+      hardenFunction(bound);
+      Object.defineProperty(safe, key, {
+        value: bound,
         writable: false,
-        enumerable: false,
+        enumerable: true,
         configurable: false
       });
-      return bound;
-    };
-    if (typeof descriptor.value === "function") {
-      descriptor.value = wrap(descriptor.value);
-    }
-    if (typeof descriptor.get === "function") {
-      descriptor.get = wrap(descriptor.get);
     }
-    if (typeof descriptor.set === "function") {
-      descriptor.set = wrap(descriptor.set);
-    }
-    descriptor.configurable = false;
-    Object.defineProperty(safe, key, descriptor);
   }
+  Object.defineProperty(safe, "constructor", {
+    value: null,
+    writable: false,
+    enumerable: false,
+    configurable: false
+  });
   return Object.freeze(safe);
 }
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-workflow-javascript",
-  "version": "2.1.0-beta.8",
+  "version": "2.2.0-alpha.1",
   "displayName": "Workflow: JavaScript",
   "displayName.zh-CN": "工作流：JavaScript 节点",
   "description": "Execute a piece of JavaScript in an isolated Node.js environment.",
@@ -25,16 +25,13 @@
     "@codemirror/state": "^6.4.1",
     "@codemirror/view": "^6.37.2",
     "codemirror": "^6.0.2",
+    "joi": "^17.13.3",
     "jshint": "^2.13.6",
-    "node-gyp": "^10.2.0"
-  },
-  "resolutions": {
-    "nan": "2.18.0",
-    "node-gyp": "^10.2.0"
+    "quickjs-emscripten": "^0.32.0"
   },
   "keywords": [
     "Workflow"
   ],
   "license": "Apache-2.0",
-  "gitHead": "5099d561c5467292414c1e77ad6bad3730d97344"
+  "gitHead": "303663aba6c6eefa27e6a6435b4c0352074ec40f"
 }