@wbce-d9/api 10.6.0 → 11.0.0

package/dist/env.js

@@ -191,8 +191,9 @@ const allowedEnvironmentVars = [
     'RELATIONAL_BATCH_SIZE',
     'EXPORT_BATCH_SIZE',
     // flows
-    'FLOWS_EXEC_ALLOWED_MODULES',
     'FLOWS_ENV_ALLOW_LIST',
+    'FLOWS_SCRIPT_MAX_MEMORY',
+    'FLOWS_SCRIPT_EXEC_TIMEOUT',
 ].map((name) => new RegExp(`^${name}$`));
 const acceptedEnvTypes = ['string', 'number', 'regex', 'array', 'json'];
 const defaults = {
@@ -270,8 +271,9 @@ const defaults = {
     EXPORT_BATCH_SIZE: 5000,
     FILE_METADATA_ALLOW_LIST: 'ifd0.Make,ifd0.Model,exif.FNumber,exif.ExposureTime,exif.FocalLength,exif.ISO',
     GRAPHQL_INTROSPECTION: true,
-    FLOWS_EXEC_ALLOWED_MODULES: false,
     FLOWS_ENV_ALLOW_LIST: false,
+    FLOWS_SCRIPT_MAX_MEMORY: 32,
+    FLOWS_SCRIPT_EXEC_TIMEOUT: 10000,
 };
 // Allows us to force certain environment variable into a type, instead of relying
 // on the auto-parsed type in processValues. ref #3705

package/dist/operations/exec/index.d.ts

@@ -1,5 +1,5 @@
-type Options = {
+type ExecutionOptions = {
     code: string;
 };
-declare const _default: import("@wbce-d9/types").OperationApiConfig<Options>;
+declare const _default: import("@wbce-d9/types").OperationApiConfig<ExecutionOptions>;
 export default _default;

package/dist/operations/exec/index.js

@@ -1,38 +1,44 @@
-import { defineOperationApi, toArray } from '@wbce-d9/utils';
-import { isBuiltin } from 'node:module';
-import { NodeVM, VMScript } from 'vm2';
+import { defineOperationApi } from '@wbce-d9/utils';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const ivm = require('isolated-vm');
 export default defineOperationApi({
-    id: 'exec',
-    handler: async ({ code }, { data, env }) => {
-        const allowedModules = env['FLOWS_EXEC_ALLOWED_MODULES'] ? toArray(env['FLOWS_EXEC_ALLOWED_MODULES']) : [];
-        const allowedModulesBuiltIn = [];
-        const allowedModulesExternal = [];
-        const allowedEnv = data['$env'] ?? {};
-        const opts = {
-            eval: false,
-            wasm: false,
-            env: allowedEnv,
-        };
-        for (const module of allowedModules) {
-            if (isBuiltin(module)) {
-                allowedModulesBuiltIn.push(module);
-            }
-            else {
-                allowedModulesExternal.push(module);
-            }
-        }
-        if (allowedModules.length > 0) {
-            opts.require = {
-                builtin: allowedModulesBuiltIn,
-                external: {
-                    modules: allowedModulesExternal,
-                    transitive: false,
-                },
-            };
-        }
-        const vm = new NodeVM(opts);
-        const script = new VMScript(code).compile();
-        const fn = await vm.run(script);
-        return await fn(data);
+    id: 'execute_script',
+    handler: async ({ code }, { data, env, logger }) => {
+        // Fetching execution limits and environment variables
+        const memoryLimit = env['FLOWS_SCRIPT_MAX_MEMORY'];
+        const executionTimeout = env['FLOWS_SCRIPT_EXEC_TIMEOUT'];
+        const environmentVariables = data['$env'] ?? {};
+        // Creating an isolate with the specified memory limit
+        const isolate = new ivm.Isolate({ memoryLimit });
+        const context = isolate.createContextSync();
+        const jail = context.global;
+        jail.setSync('global', jail.derefInto());
+        jail.setSync('process', { env: environmentVariables }, { copy: true });
+        jail.setSync('module', { exports: null }, { copy: true });
+        // Adding a secure logger for the isolate
+        const createLoggerCallback = (logFn) => new ivm.Callback((...args) => logFn(args.length === 1 ? args[0] : args), { sync: true });
+        jail.setSync('console', {
+            log: createLoggerCallback(() => logger.info),
+            info: createLoggerCallback(() => logger.info),
+            warn: createLoggerCallback(() => logger.warn),
+            error: createLoggerCallback(() => logger.error),
+            debug: createLoggerCallback(() => logger.debug),
+            trace: createLoggerCallback(() => logger.trace),
+        }, { copy: true });
+        // Executing the code within the isolate
+        await context.eval(code, { timeout: executionTimeout });
+        const dataCopy = new ivm.ExternalCopy({ data });
+        const resultReference = await context.evalClosure(`return module.exports($0.data)`, [dataCopy.copyInto()], {
+            result: { reference: true, promise: true },
+            timeout: executionTimeout,
+        });
+        const finalResult = await resultReference.copy();
+        // Cleanup memory
+        resultReference.release();
+        dataCopy.release();
+        context.release();
+        isolate.dispose();
+        return finalResult;
     },
 });

package/dist/services/graphql/index.js

@@ -1526,16 +1526,6 @@ export class GraphQLService {
                         }),
                     }
                     : GraphQLBoolean,
-                flows: {
-                    type: new GraphQLObjectType({
-                        name: 'server_info_flows',
-                        fields: {
-                            execAllowedModules: {
-                                type: new GraphQLList(GraphQLString),
-                            },
-                        },
-                    }),
-                },
             });
         }
         if (this.accountability?.admin === true) {

package/dist/services/server.js

@@ -61,9 +61,6 @@ export class ServerService {
             else {
                 info['rateLimitGlobal'] = false;
             }
-            info['flows'] = {
-                execAllowedModules: env['FLOWS_EXEC_ALLOWED_MODULES'] ? toArray(env['FLOWS_EXEC_ALLOWED_MODULES']) : [],
-            };
         }
         if (this.accountability?.admin === true) {
             const { osType, osVersion } = getOSInfo();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "10.6.0",
+  "version": "11.0.0",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -101,6 +101,7 @@
     "icc": "3.0.0",
     "inquirer": "9.1.5",
     "ioredis": "5.3.2",
+    "isolated-vm": "^5.0.3",
     "joi": "17.9.1",
     "js-yaml": "4.1.0",
     "js2xmlparser": "5.0.0",
@@ -141,21 +142,20 @@
     "tsx": "3.12.6",
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
-    "vm2": "^3.9.19",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.32.0",
+    "@wbce-d9/app": "9.33.0",
     "@wbce-d9/constants": "9.28.0",
     "@wbce-d9/extensions-sdk": "9.27.1",
     "@wbce-d9/exceptions": "9.26.4",
-    "@wbce-d9/schema": "9.26.4",
-    "@wbce-d9/storage-driver-azure": "9.26.8",
     "@wbce-d9/specs": "9.26.4",
+    "@wbce-d9/storage-driver-azure": "9.26.8",
     "@wbce-d9/storage": "9.26.4",
     "@wbce-d9/storage-driver-cloudinary": "9.27.0",
-    "@wbce-d9/storage-driver-local": "9.26.8",
+    "@wbce-d9/schema": "9.26.4",
     "@wbce-d9/storage-driver-s3": "9.26.10",
-    "@wbce-d9/storage-driver-gcs": "9.26.8",
     "@wbce-d9/utils": "9.29.1",
+    "@wbce-d9/storage-driver-local": "9.26.8",
+    "@wbce-d9/storage-driver-gcs": "9.26.8",
     "@wbce-d9/update-check": "9.28.0"
   },
   "devDependencies": {