n8n-nodes-base 1.121.54 → 1.121.56

package/dist/credentials/CiscoSecureEndpointApi.credentials.d.ts

@@ -1,4 +1,4 @@
-import type { ICredentialDataDecryptedObject, ICredentialTestRequest, ICredentialType, IHttpRequestOptions, INodeProperties } from 'n8n-workflow';
+import { type ICredentialDataDecryptedObject, type ICredentialTestRequest, type ICredentialType, type IHttpRequestOptions, type INodeProperties } from 'n8n-workflow';
 export declare class CiscoSecureEndpointApi implements ICredentialType {
     name: string;
     displayName: string;

package/dist/credentials/CiscoSecureEndpointApi.credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CiscoSecureEndpointApi.credentials.d.ts","sourceRoot":"","sources":["../../credentials/CiscoSecureEndpointApi.credentials.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,MAAM,cAAc,CAAC;AAEtB,qBAAa,sBAAuB,YAAW,eAAe;IAC7D,IAAI,SAA4B;IAEhC,WAAW,SAAqC;IAEhD,gBAAgB,SAAyB;IAEzC,IAAI;;;MAAiF;IAErF,eAAe;;;;MAIb;IAEF,UAAU,EAAE,eAAe,EAAE,CAsC3B;IAEI,YAAY,CACjB,WAAW,EAAE,8BAA8B,EAC3C,cAAc,EAAE,mBAAmB,GACjC,OAAO,CAAC,mBAAmB,CAAC;IA6C/B,IAAI,EAAE,sBAAsB,CAQ1B;CACF"}
+{"version":3,"file":"CiscoSecureEndpointApi.credentials.d.ts","sourceRoot":"","sources":["../../credentials/CiscoSecureEndpointApi.credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAIN,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,MAAM,cAAc,CAAC;AAiBtB,qBAAa,sBAAuB,YAAW,eAAe;IAC7D,IAAI,SAA4B;IAEhC,WAAW,SAAqC;IAEhD,gBAAgB,SAAyB;IAEzC,IAAI;;;MAAiF;IAErF,eAAe;;;;MAIb;IAEF,UAAU,EAAE,eAAe,EAAE,CAyB3B;IAEI,YAAY,CACjB,WAAW,EAAE,8BAA8B,EAC3C,cAAc,EAAE,mBAAmB,GACjC,OAAO,CAAC,mBAAmB,CAAC;IA4E/B,IAAI,EAAE,sBAAsB,CAQ1B;CACF"}

package/dist/credentials/CiscoSecureEndpointApi.credentials.js

@@ -5,6 +5,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CiscoSecureEndpointApi = void 0;
 const axios_1 = __importDefault(require("axios"));
+const n8n_workflow_1 = require("n8n-workflow");
+// `region` is interpolated into the token-exchange host, so the stored value must stay
+// inside this fixed set. The options field and the runtime check both read it from here.
+const REGION_OPTIONS = [
+    { name: 'Asia Pacific, Japan, and China', value: 'apjc.amp' },
+    { name: 'Europe', value: 'eu.amp' },
+    { name: 'North America', value: 'amp' },
+];
+function assertSupportedRegion(region) {
+    if (typeof region !== 'string' || !REGION_OPTIONS.some((option) => option.value === region)) {
+        throw new n8n_workflow_1.UserError('Unsupported Cisco Secure Endpoint region');
+    }
+}
 class CiscoSecureEndpointApi {
     name = 'ciscoSecureEndpointApi';
     displayName = 'Cisco Secure Endpoint (AMP) API';
@@ -20,20 +33,7 @@ class CiscoSecureEndpointApi {
             displayName: 'Region',
             name: 'region',
             type: 'options',
-            options: [
-                {
-                    name: 'Asia Pacific, Japan, and China',
-                    value: 'apjc.amp',
-                },
-                {
-                    name: 'Europe',
-                    value: 'eu.amp',
-                },
-                {
-                    name: 'North America',
-                    value: 'amp',
-                },
-            ],
+            options: [...REGION_OPTIONS],
             default: 'amp',
         },
         {
@@ -58,6 +58,26 @@ class CiscoSecureEndpointApi {
         const clientId = credentials.clientId;
         const clientSecret = credentials.clientSecret;
         const region = credentials.region;
+        assertSupportedRegion(region);
+        // These token POSTs go through axios directly, so apply the credential's own
+        // allow-list to each request host instead of relying on the node HTTP layer.
+        const allowedDomains = (0, n8n_workflow_1.getCredentialAllowedDomains)(credentials);
+        if (credentials.allowedHttpRequestDomains === 'domains' && !allowedDomains) {
+            throw new n8n_workflow_1.UserError('No allowed domains specified. Configure allowed domains or change restriction setting.');
+        }
+        const assertHostAllowed = (url) => {
+            if (allowedDomains && !(0, n8n_workflow_1.isDomainAllowed)(url, { allowedDomains })) {
+                throw new n8n_workflow_1.UserError(`Domain not allowed: This credential is restricted from accessing ${new URL(url).host}. Only the following domains are allowed: ${allowedDomains}`);
+            }
+        };
+        // axios follows redirects on its own, so re-check each redirect target against the
+        // allow-list, not only the initial URL.
+        const beforeRedirect = (redirectedRequest) => {
+            if (redirectedRequest.href)
+                assertHostAllowed(redirectedRequest.href);
+        };
+        const secureXTokenUrl = `https://visibility.${region}.cisco.com/iroh/oauth2/token`;
+        assertHostAllowed(secureXTokenUrl);
         const secureXToken = await (0, axios_1.default)({
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded',
@@ -71,8 +91,11 @@ class CiscoSecureEndpointApi {
             data: new URLSearchParams({
                 grant_type: 'client_credentials',
             }).toString(),
-            url: `https://visibility.${region}.cisco.com/iroh/oauth2/token`,
+            url: secureXTokenUrl,
+            beforeRedirect,
         });
+        const secureEndpointTokenUrl = `https://api.${region}.cisco.com/v3/access_tokens`;
+        assertHostAllowed(secureEndpointTokenUrl);
         const secureEndpointToken = await (0, axios_1.default)({
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded',
@@ -83,7 +106,8 @@ class CiscoSecureEndpointApi {
             data: new URLSearchParams({
                 grant_type: 'client_credentials',
             }).toString(),
-            url: `https://api.${region}.cisco.com/v3/access_tokens`,
+            url: secureEndpointTokenUrl,
+            beforeRedirect,
         });
         const requestOptionsWithAuth = {
             ...requestOptions,

package/dist/credentials/CiscoSecureEndpointApi.credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"CiscoSecureEndpointApi.credentials.js","sourceRoot":"","sources":["../../credentials/CiscoSecureEndpointApi.credentials.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAS1B,MAAa,sBAAsB;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEhC,WAAW,GAAG,iCAAiC,CAAC;IAEhD,gBAAgB,GAAG,qBAAqB,CAAC;IAEzC,IAAI,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,EAAW,CAAC;IAErF,eAAe,GAAG;QACjB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,EAAE;KACd,CAAC;IAEF,UAAU,GAAsB;QAC/B;YACC,WAAW,EAAE,QAAQ;YACrB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,SAAS;YACf,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,gCAAgC;oBACtC,KAAK,EAAE,UAAU;iBACjB;gBACD;oBACC,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,QAAQ;iBACf;gBACD;oBACC,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,KAAK;iBACZ;aACD;YACD,OAAO,EAAE,KAAK;SACd;QACD;YACC,WAAW,EAAE,WAAW;YACxB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,IAAI;SACd;QACD;YACC,WAAW,EAAE,eAAe;YAC5B,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACZ,QAAQ,EAAE,IAAI;aACd;YACD,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,IAAI;SACd;KACD,CAAC;IAEF,KAAK,CAAC,YAAY,CACjB,WAA2C,EAC3C,cAAmC;QAEnC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAkB,CAAC;QAChD,MAAM,YAAY,GAAG,WAAW,CAAC,YAAsB,CAAC;QACxD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAgB,CAAC;QAE5C,MAAM,YAAY,GAAG,MAAM,IAAA,eAAK,EAAC;YAChC,OAAO,EAAE;gBACR,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;aACtB;YACD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;aAChC,CAAC,CAAC,QAAQ,EAAE;YACb,GAAG,EAAE,sBAAsB,MAAM,8BAA8B;SAC/D,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,MAAM,IAAA,eAAK,EAAC;YACvC,OAAO,EAAE;gBACR,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE;aACzD;YACD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;aAChC,CAAC,CAAC,QAAQ,EAAE;YACb,GAAG,EAAE,eAAe,MAAM,6BAA6B;SACvD,CAAC,CAAC;QAEH,MAAM,sBAAsB,GAAwB;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE;gBACR,GAAG,cAAc,CAAC,OAAO;gBACzB,aAAa,EAAE,UAAU,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE;aAChE;SACD,CAAC;QAEF,OAAO,sBAAsB,CAAC;IAC/B,CAAC;IAED,IAAI,GAA2B;QAC9B,OAAO,EAAE;YACR,OAAO,EAAE,gDAAgD;YACzD,GAAG,EAAE,mBAAmB;YACxB,EAAE,EAAE;gBACH,IAAI,EAAE,EAAE;aACR;SACD;KACD,CAAC;CACF;AAhHD,wDAgHC"}
+{"version":3,"file":"CiscoSecureEndpointApi.credentials.js","sourceRoot":"","sources":["../../credentials/CiscoSecureEndpointApi.credentials.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAC1B,+CASsB;AAEtB,uFAAuF;AACvF,yFAAyF;AACzF,MAAM,cAAc,GAAG;IACtB,EAAE,IAAI,EAAE,gCAAgC,EAAE,KAAK,EAAE,UAAU,EAAE;IAC7D,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE;CAC9B,CAAC;AAGX,SAAS,qBAAqB,CAAC,MAAe;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,wBAAS,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC;AACF,CAAC;AAED,MAAa,sBAAsB;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEhC,WAAW,GAAG,iCAAiC,CAAC;IAEhD,gBAAgB,GAAG,qBAAqB,CAAC;IAEzC,IAAI,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,EAAW,CAAC;IAErF,eAAe,GAAG;QACjB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,EAAE;KACd,CAAC;IAEF,UAAU,GAAsB;QAC/B;YACC,WAAW,EAAE,QAAQ;YACrB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC;YAC5B,OAAO,EAAE,KAAK;SACd;QACD;YACC,WAAW,EAAE,WAAW;YACxB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,IAAI;SACd;QACD;YACC,WAAW,EAAE,eAAe;YAC5B,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACZ,QAAQ,EAAE,IAAI;aACd;YACD,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,IAAI;SACd;KACD,CAAC;IAEF,KAAK,CAAC,YAAY,CACjB,WAA2C,EAC3C,cAAmC;QAEnC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAkB,CAAC;QAChD,MAAM,YAAY,GAAG,WAAW,CAAC,YAAsB,CAAC;QACxD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAElC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE9B,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,cAAc,GAAG,IAAA,0CAA2B,EAAC,WAAW,CAAC,CAAC;QAChE,IAAI,WAAW,CAAC,yBAAyB,KAAK,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5E,MAAM,IAAI,wBAAS,CAClB,wFAAwF,CACxF,CAAC;QACH,CAAC;QACD,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE;YACzC,IAAI,cAAc,IAAI,CAAC,IAAA,8BAAe,EAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,wBAAS,CAClB,oEAAoE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,6CAA6C,cAAc,EAAE,CAClJ,CAAC;YACH,CAAC;QACF,CAAC,CAAC;QACF,mFAAmF;QACnF,wCAAwC;QACxC,MAAM,cAAc,GAAG,CAAC,iBAAoC,EAAE,EAAE;YAC/D,IAAI,iBAAiB,CAAC,IAAI;gBAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC;QAEF,MAAM,eAAe,GAAG,sBAAsB,MAAM,8BAA8B,CAAC;QACnF,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAEnC,MAAM,YAAY,GAAG,MAAM,IAAA,eAAK,EAAC;YAChC,OAAO,EAAE;gBACR,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE;gBACL,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;aACtB;YACD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;aAChC,CAAC,CAAC,QAAQ,EAAE;YACb,GAAG,EAAE,eAAe;YACpB,cAAc;SACd,CAAC,CAAC;QAEH,MAAM,sBAAsB,GAAG,eAAe,MAAM,6BAA6B,CAAC;QAClF,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QAE1C,MAAM,mBAAmB,GAAG,MAAM,IAAA,eAAK,EAAC;YACvC,OAAO,EAAE;gBACR,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE;aACzD;YACD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;aAChC,CAAC,CAAC,QAAQ,EAAE;YACb,GAAG,EAAE,sBAAsB;YAC3B,cAAc;SACd,CAAC,CAAC;QAEH,MAAM,sBAAsB,GAAwB;YACnD,GAAG,cAAc;YACjB,OAAO,EAAE;gBACR,GAAG,cAAc,CAAC,OAAO;gBACzB,aAAa,EAAE,UAAU,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE;aAChE;SACD,CAAC;QAEF,OAAO,sBAAsB,CAAC;IAC/B,CAAC;IAED,IAAI,GAA2B;QAC9B,OAAO,EAAE;YACR,OAAO,EAAE,gDAAgD;YACzD,GAAG,EAAE,mBAAmB;YACxB,EAAE,EAAE;gBACH,IAAI,EAAE,EAAE;aACR;SACD;KACD,CAAC;CACF;AAlID,wDAkIC"}

package/dist/nodes/Files/ReadWriteFile/actions/read.operation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.operation.d.ts","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/actions/read.operation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAEf,MAAM,cAAc,CAAC;AAMtB,eAAO,MAAM,UAAU,EAAE,eAAe,EAsDvC,CAAC;AAQF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;GAAmD,CAAC;AAE5E,wBAAsB,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,iCAiFjF"}
+{"version":3,"file":"read.operation.d.ts","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/actions/read.operation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAEf,MAAM,cAAc,CAAC;AAWtB,eAAO,MAAM,UAAU,EAAE,eAAe,EAsDvC,CAAC;AAQF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;GAAmD,CAAC;AAE5E,wBAAsB,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,iCAoGjF"}

package/dist/nodes/Files/ReadWriteFile/actions/read.operation.js

@@ -1,11 +1,7 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.description = exports.properties = void 0;
 exports.execute = execute;
-const fast_glob_1 = __importDefault(require("fast-glob"));
 const n8n_workflow_1 = require("n8n-workflow");
 const utilities_1 = require("../../../../utils/utilities");
 const utils_1 = require("../helpers/utils");
@@ -72,6 +68,10 @@ exports.description = (0, utilities_1.updateDisplayOptions)(displayOptions, expo
 async function execute(items) {
     const returnData = [];
     let fileSelector;
+    // One glob-time budget for the whole execution, so N items cannot each burn a
+    // full timeout. Only time spent globbing is charged — file reads in between
+    // must not make a later selector look slow.
+    let remainingGlobMs = utils_1.GLOB_TIMEOUT_MS;
     for (let itemIndex = 0; itemIndex < items.length; itemIndex++) {
         try {
             fileSelector = String(this.getNodeParameter('fileSelector', itemIndex));
@@ -84,7 +84,16 @@ async function execute(items) {
             if (options.dataPropertyName) {
                 dataPropertyName = options.dataPropertyName;
             }
-            const files = await (0, fast_glob_1.default)(fileSelector);
+            const startedGlobAt = Date.now();
+            let files;
+            try {
+                files = await (0, utils_1.globWithDeadline)(this.getNode(), fileSelector, {}, itemIndex, remainingGlobMs);
+            }
+            finally {
+                // Charge the budget even when the glob times out, so a failing item
+                // cannot hand the next one (with Continue On Fail) a fresh full budget.
+                remainingGlobMs -= Date.now() - startedGlobAt;
+            }
             const newItems = [];
             for (const filePath of files) {
                 const stream = await this.helpers.createReadStream(await this.helpers.resolvePath(filePath));

package/dist/nodes/Files/ReadWriteFile/actions/read.operation.js.map

@@ -1 +1 @@
-{"version":3,"file":"read.operation.js","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/actions/read.operation.ts"],"names":[],"mappings":";;;;;;AA6EA,0BAiFC;AA9JD,0DAA6B;AAC7B,+CAA4C;AAQ5C,gDAAwD;AAExD,4CAAwE;AAE3D,QAAA,UAAU,GAAsB;IAC5C;QACC,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,mCAAmC;QAChD,IAAI,EAAE,yHAAyH;QAC/H,WAAW,EACV,8HAA8H;KAC/H;IACD;QACC,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE;YACR;gBACC,WAAW,EAAE,gBAAgB;gBAC7B,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,UAAU;gBACvB,WAAW,EAAE,4CAA4C;aACzD;YACD;gBACC,WAAW,EAAE,WAAW;gBACxB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,eAAe;gBAC5B,WAAW,EAAE,uCAAuC;aACpD;YACD;gBACC,WAAW,EAAE,WAAW;gBACxB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,sBAAsB;gBACnC,WAAW,EAAE,4CAA4C;aACzD;YACD;gBACC,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,WAAW;gBACxB,WAAW,EAAE,2BAA2B;gBACxC,IAAI,EAAE,wDAAwD;aAC9D;SACD;KACD;CACD,CAAC;AAEF,MAAM,cAAc,GAAG;IACtB,IAAI,EAAE;QACL,SAAS,EAAE,CAAC,MAAM,CAAC;KACnB;CACD,CAAC;AAEW,QAAA,WAAW,GAAG,IAAA,gCAAoB,EAAC,cAAc,EAAE,kBAAU,CAAC,CAAC;AAErE,KAAK,UAAU,OAAO,CAA0B,KAA2B;IACjF,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,IAAI,YAAY,CAAC;IAEjB,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC;YACJ,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;YAExE,YAAY,GAAG,IAAA,+BAAuB,EAAC,YAAY,CAAC,CAAC;YAErD,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAEhE,IAAI,gBAAgB,GAAG,MAAM,CAAC;YAE9B,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC9B,gBAAgB,GAAG,OAAO,CAAC,gBAA0B,CAAC;YACvD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAI,EAAC,YAAY,CAAC,CAAC;YAEvC,MAAM,QAAQ,GAAyB,EAAE,CAAC;YAC1C,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CACjD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CACxC,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAE1E,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACpC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;gBAClD,CAAC;gBAED,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;oBACzC,UAAU,CAAC,aAAa,GAAG,OAAO,CAAC,aAAuB,CAAC;gBAC5D,CAAC;gBAED,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACpC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;gBAClD,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACb,MAAM,EAAE;wBACP,CAAC,gBAAgB,CAAC,EAAE,UAAU;qBAC9B;oBACD,IAAI,EAAE;wBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;wBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;qBAC7B;oBACD,UAAU,EAAE;wBACX,IAAI,EAAE,SAAS;qBACf;iBACD,CAAC,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,mBAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE;gBACpE,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE;wBACL,KAAK,EAAE,mBAAmB,CAAC,OAAO;qBAClC;oBACD,UAAU,EAAE;wBACX,IAAI,EAAE,SAAS;qBACf;iBACD,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,MAAM,IAAI,2BAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAmB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAC;AACnB,CAAC"}
+{"version":3,"file":"read.operation.js","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/actions/read.operation.ts"],"names":[],"mappings":";;;AAiFA,0BAoGC;AArLD,+CAA4C;AAQ5C,gDAAwD;AAExD,4CAK0B;AAEb,QAAA,UAAU,GAAsB;IAC5C;QACC,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,mCAAmC;QAChD,IAAI,EAAE,yHAAyH;QAC/H,WAAW,EACV,8HAA8H;KAC/H;IACD;QACC,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE;YACR;gBACC,WAAW,EAAE,gBAAgB;gBAC7B,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,UAAU;gBACvB,WAAW,EAAE,4CAA4C;aACzD;YACD;gBACC,WAAW,EAAE,WAAW;gBACxB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,eAAe;gBAC5B,WAAW,EAAE,uCAAuC;aACpD;YACD;gBACC,WAAW,EAAE,WAAW;gBACxB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,sBAAsB;gBACnC,WAAW,EAAE,4CAA4C;aACzD;YACD;gBACC,WAAW,EAAE,0BAA0B;gBACvC,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,WAAW;gBACxB,WAAW,EAAE,2BAA2B;gBACxC,IAAI,EAAE,wDAAwD;aAC9D;SACD;KACD;CACD,CAAC;AAEF,MAAM,cAAc,GAAG;IACtB,IAAI,EAAE;QACL,SAAS,EAAE,CAAC,MAAM,CAAC;KACnB;CACD,CAAC;AAEW,QAAA,WAAW,GAAG,IAAA,gCAAoB,EAAC,cAAc,EAAE,kBAAU,CAAC,CAAC;AAErE,KAAK,UAAU,OAAO,CAA0B,KAA2B;IACjF,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,IAAI,YAAY,CAAC;IAEjB,8EAA8E;IAC9E,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,eAAe,GAAG,uBAAe,CAAC;IAEtC,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC;YACJ,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;YAExE,YAAY,GAAG,IAAA,+BAAuB,EAAC,YAAY,CAAC,CAAC;YAErD,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAEhE,IAAI,gBAAgB,GAAG,MAAM,CAAC;YAE9B,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC9B,gBAAgB,GAAG,OAAO,CAAC,gBAA0B,CAAC;YACvD,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBACJ,KAAK,GAAG,MAAM,IAAA,wBAAgB,EAC7B,IAAI,CAAC,OAAO,EAAE,EACd,YAAY,EACZ,EAAE,EACF,SAAS,EACT,eAAe,CACf,CAAC;YACH,CAAC;oBAAS,CAAC;gBACV,oEAAoE;gBACpE,wEAAwE;gBACxE,eAAe,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;YAC/C,CAAC;YAED,MAAM,QAAQ,GAAyB,EAAE,CAAC;YAC1C,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CACjD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CACxC,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAE1E,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACpC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;gBAClD,CAAC;gBAED,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;oBACzC,UAAU,CAAC,aAAa,GAAG,OAAO,CAAC,aAAuB,CAAC;gBAC5D,CAAC;gBAED,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACpC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;gBAClD,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACb,MAAM,EAAE;wBACP,CAAC,gBAAgB,CAAC,EAAE,UAAU;qBAC9B;oBACD,IAAI,EAAE;wBACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;wBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;qBAC7B;oBACD,UAAU,EAAE;wBACX,IAAI,EAAE,SAAS;qBACf;iBACD,CAAC,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,mBAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE;gBACpE,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE;wBACL,KAAK,EAAE,mBAAmB,CAAC,OAAO;qBAClC;oBACD,UAAU,EAAE;wBACX,IAAI,EAAE,SAAS;qBACf;iBACD,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,MAAM,IAAI,2BAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAmB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAC;AACnB,CAAC"}

package/dist/nodes/Files/ReadWriteFile/helpers/glob.worker.d.ts

@@ -0,0 +1,18 @@
+import glob from 'fast-glob';
+export interface GlobWorkerData {
+    pattern: string;
+    options: glob.Options;
+}
+export type GlobWorkerError = {
+    message: string;
+    code?: string;
+    path?: string;
+};
+export type GlobWorkerResponse = {
+    ok: true;
+    files: string[];
+} | {
+    ok: false;
+    error: GlobWorkerError;
+};
+//# sourceMappingURL=glob.worker.d.ts.map

package/dist/nodes/Files/ReadWriteFile/helpers/glob.worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.worker.d.ts","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/helpers/glob.worker.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAM7B,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;CACtB;AAID,MAAM,MAAM,eAAe,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,MAAM,MAAM,kBAAkB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC"}

package/dist/nodes/Files/ReadWriteFile/helpers/glob.worker.js

@@ -0,0 +1,22 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const node_worker_threads_1 = require("node:worker_threads");
+const { pattern, options } = node_worker_threads_1.workerData;
+(0, fast_glob_1.default)(pattern, options)
+    .then((files) => node_worker_threads_1.parentPort?.postMessage({ ok: true, files }))
+    .catch((error) => {
+    const errno = error;
+    node_worker_threads_1.parentPort?.postMessage({
+        ok: false,
+        error: {
+            message: error instanceof Error ? error.message : String(error),
+            code: errno?.code,
+            path: errno?.path,
+        },
+    });
+});
+//# sourceMappingURL=glob.worker.js.map

package/dist/nodes/Files/ReadWriteFile/helpers/glob.worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.worker.js","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/helpers/glob.worker.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,6DAA6D;AAkB7D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,gCAA4B,CAAC;AAE1D,IAAA,mBAAI,EAAC,OAAO,EAAE,OAAO,CAAC;KACpB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAU,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAA+B,CAAC,CAAC;KAC1F,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACzB,MAAM,KAAK,GAAG,KAA8B,CAAC;IAC7C,gCAAU,EAAE,WAAW,CAAC;QACvB,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACN,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,IAAI,EAAE,KAAK,EAAE,IAAI;YACjB,IAAI,EAAE,KAAK,EAAE,IAAI;SACjB;KAC4B,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC"}

package/dist/nodes/Files/ReadWriteFile/helpers/utils.d.ts

@@ -1,5 +1,9 @@
-import type { IDataObject, IExecuteFunctions } from 'n8n-workflow';
+import glob from 'fast-glob';
+import type { IDataObject, IExecuteFunctions, INode } from 'n8n-workflow';
 import { NodeOperationError } from 'n8n-workflow';
 export declare function errorMapper(this: IExecuteFunctions, error: Error, itemIndex: number, context?: IDataObject): NodeOperationError;
 export declare function escapeSpecialCharacters(str: string): string;
+export declare const GLOB_TIMEOUT_MS = 10000;
+export declare function isTriviallyCheapSelector(selector: string): boolean;
+export declare function globWithDeadline(node: INode, pattern: string, options?: glob.Options, itemIndex?: number, budgetMs?: number): Promise<string[]>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/nodes/Files/ReadWriteFile/helpers/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/helpers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,wBAAgB,WAAW,CAC1B,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,WAAW,sBA0BrB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,UAKlD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/helpers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,wBAAgB,WAAW,CAC1B,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,WAAW,sBA0BrB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,UAKlD;AAOD,eAAO,MAAM,eAAe,QAAS,CAAC;AAiCtC,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,KAAK,EACX,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,IAAI,CAAC,OAAY,EAC1B,SAAS,SAAI,EACb,QAAQ,SAAkB,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiCnB"}

package/dist/nodes/Files/ReadWriteFile/helpers/utils.js

@@ -1,8 +1,18 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLOB_TIMEOUT_MS = void 0;
 exports.errorMapper = errorMapper;
 exports.escapeSpecialCharacters = escapeSpecialCharacters;
+exports.isTriviallyCheapSelector = isTriviallyCheapSelector;
+exports.globWithDeadline = globWithDeadline;
+const fast_glob_1 = __importDefault(require("fast-glob"));
 const n8n_workflow_1 = require("n8n-workflow");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const node_worker_threads_1 = require("node:worker_threads");
 function errorMapper(error, itemIndex, context) {
     let message;
     let description;
@@ -32,4 +42,81 @@ function escapeSpecialCharacters(str) {
     str = str.replace(/[()]/g, '\\$&');
     return str;
 }
+// Matching a free-form selector can cost far more than the files it returns —
+// e.g. many `*` in one segment, or a deep `**` walk. Run it off the main event
+// loop so a slow selector can be bounded and terminated, keeping the instance
+// responsive. One budget covers a whole node execution (see read.operation),
+// and it counts glob time only, so file reads between items never spend it.
+exports.GLOB_TIMEOUT_MS = 10_000;
+// Compiled output is `helpers/utils.js`, with `glob.worker.js` beside it. Under
+// Vitest the source `.ts` runs, whose sibling `.js` is absent, so fall back to
+// the build output (the package is built before tests run). `lastIndexOf` keeps
+// the mapping correct even when a parent directory is also named `nodes`.
+function resolveGlobWorkerPath() {
+    const { dir } = node_path_1.default.parse(__filename);
+    const sibling = node_path_1.default.join(dir, 'glob.worker.js');
+    if ((0, node_fs_1.existsSync)(sibling))
+        return sibling;
+    const marker = `${node_path_1.default.sep}nodes${node_path_1.default.sep}`;
+    const at = dir.lastIndexOf(marker);
+    const distDir = `${dir.slice(0, at)}${node_path_1.default.sep}dist${dir.slice(at)}`;
+    return node_path_1.default.join(distDir, 'glob.worker.js');
+}
+function tooComplexError(node, itemIndex) {
+    return new n8n_workflow_1.NodeOperationError(node, 'File(s) Selector is too complex', {
+        itemIndex,
+        description: 'The selector took too long to evaluate. Use a more specific pattern with fewer wildcards.',
+    });
+}
+const MAX_MAIN_THREAD_WILDCARDS = 2;
+// A whitelist fast path, never a security check: it only returns true for a
+// selector that provably cannot backtrack or recurse, so the match is safe to
+// run inline and skip the worker. Anything with glob syntax we would have to
+// parse — braces, parens/extglob, classes, escapes, `!`, or a `**` globstar —
+// falls through to the worker instead, as does more than a couple of `*`. `?`
+// is fixed-width, so its count is irrelevant.
+function isTriviallyCheapSelector(selector) {
+    if (selector.includes('**'))
+        return false;
+    if (/[{}()[\]\\!]/.test(selector))
+        return false;
+    return (selector.match(/\*/g)?.length ?? 0) <= MAX_MAIN_THREAD_WILDCARDS;
+}
+async function globWithDeadline(node, pattern, options = {}, itemIndex = 0, budgetMs = exports.GLOB_TIMEOUT_MS) {
+    // Plain selectors run inline; only the rest pay for a worker and a deadline.
+    if (isTriviallyCheapSelector(pattern))
+        return await (0, fast_glob_1.default)(pattern, options);
+    if (budgetMs <= 0)
+        throw tooComplexError(node, itemIndex);
+    const worker = new node_worker_threads_1.Worker(resolveGlobWorkerPath(), {
+        workerData: { pattern, options },
+    });
+    let timer;
+    try {
+        return await new Promise((resolve, reject) => {
+            timer = setTimeout(() => reject(tooComplexError(node, itemIndex)), budgetMs);
+            worker.once('message', (response) => {
+                if (response.ok)
+                    return resolve(response.files);
+                // Reattach `code`/`path` so errorMapper and NodeApiError see the real values.
+                const error = new Error(response.error.message);
+                error.code = response.error.code;
+                error.path = response.error.path;
+                reject(error);
+            });
+            worker.once('error', reject);
+            worker.once('exit', (code) => {
+                if (code !== 0)
+                    reject(new Error(`Glob worker stopped with exit code ${code}`));
+            });
+        });
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        // Fire-and-forget: tear the thread down without blocking the result or
+        // letting a terminate rejection mask the real outcome.
+        void worker.terminate().catch(() => { });
+    }
+}
 //# sourceMappingURL=utils.js.map

package/dist/nodes/Files/ReadWriteFile/helpers/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/helpers/utils.ts"],"names":[],"mappings":";;AAGA,kCA8BC;AAED,0DAKC;AAvCD,+CAAkD;AAElD,SAAgB,WAAW,CAE1B,KAAY,EACZ,SAAiB,EACjB,OAAqB;IAErB,IAAI,OAAO,CAAC;IACZ,IAAI,WAAW,CAAC;IAEhB,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC,EAAE,CAAC;YAClE,OAAO,GAAG,uBAAuB,CAAC;YAClC,WAAW;gBACV,2PAA2P,CAAC;QAC9P,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC;YAC9E,MAAM,IAAI,GACP,KAAgC,CAAC,IAAe,IAAK,OAAO,EAAE,QAAmB,CAAC;YACrF,OAAO,GAAG,4CAA4C,IAAI,EAAE,CAAC;YAC7D,WAAW;gBACV,8GAA8G,CAAC;QACjH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,EAAE,CAAC;YAC/E,MAAM,IAAI,GACP,KAAgC,CAAC,IAAe,IAAK,OAAO,EAAE,QAAmB,CAAC;YACrF,OAAO,GAAG,oDAAoD,IAAI,EAAE,CAAC;YACrE,WAAW;gBACV,4GAA4G,CAAC;QAC/G,CAAC;IACF,CAAC;IAED,OAAO,IAAI,iCAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAgB,uBAAuB,CAAC,GAAW;IAClD,qBAAqB;IACrB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnC,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../../nodes/Files/ReadWriteFile/helpers/utils.ts"],"names":[],"mappings":";;;;;;AASA,kCA8BC;AAED,0DAKC;AAwCD,4DAIC;AAED,4CAuCC;AAnID,0DAA6B;AAE7B,+CAAkD;AAClD,qCAAqC;AACrC,0DAA6B;AAC7B,6DAA6C;AAI7C,SAAgB,WAAW,CAE1B,KAAY,EACZ,SAAiB,EACjB,OAAqB;IAErB,IAAI,OAAO,CAAC;IACZ,IAAI,WAAW,CAAC;IAEhB,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,oCAAoC,CAAC,EAAE,CAAC;YAClE,OAAO,GAAG,uBAAuB,CAAC;YAClC,WAAW;gBACV,2PAA2P,CAAC;QAC9P,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC;YAC9E,MAAM,IAAI,GACP,KAAgC,CAAC,IAAe,IAAK,OAAO,EAAE,QAAmB,CAAC;YACrF,OAAO,GAAG,4CAA4C,IAAI,EAAE,CAAC;YAC7D,WAAW;gBACV,8GAA8G,CAAC;QACjH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,SAAS,KAAK,OAAO,EAAE,CAAC;YAC/E,MAAM,IAAI,GACP,KAAgC,CAAC,IAAe,IAAK,OAAO,EAAE,QAAmB,CAAC;YACrF,OAAO,GAAG,oDAAoD,IAAI,EAAE,CAAC;YACrE,WAAW;gBACV,4GAA4G,CAAC;QAC/G,CAAC;IACF,CAAC;IAED,OAAO,IAAI,iCAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAgB,uBAAuB,CAAC,GAAW;IAClD,qBAAqB;IACrB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnC,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC/D,QAAA,eAAe,GAAG,MAAM,CAAC;AAEtC,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,SAAS,qBAAqB;IAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,mBAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,IAAA,oBAAU,EAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,mBAAI,CAAC,GAAG,QAAQ,mBAAI,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,mBAAI,CAAC,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,IAAW,EAAE,SAAiB;IACtD,OAAO,IAAI,iCAAkB,CAAC,IAAI,EAAE,iCAAiC,EAAE;QACtE,SAAS;QACT,WAAW,EACV,2FAA2F;KAC5F,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,8CAA8C;AAC9C,SAAgB,wBAAwB,CAAC,QAAgB;IACxD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,yBAAyB,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACrC,IAAW,EACX,OAAe,EACf,UAAwB,EAAE,EAC1B,SAAS,GAAG,CAAC,EACb,QAAQ,GAAG,uBAAe;IAE1B,6EAA6E;IAC7E,IAAI,wBAAwB,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,IAAA,mBAAI,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE3E,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,IAAI,4BAAM,CAAC,qBAAqB,EAAE,EAAE;QAClD,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,EAA2B;KACzD,CAAC,CAAC;IACH,IAAI,KAAiC,CAAC;IAEtC,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAA4B,EAAE,EAAE;gBACvD,IAAI,QAAQ,CAAC,EAAE;oBAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChD,8EAA8E;gBAC9E,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAA0B,CAAC;gBACzE,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBACjC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC5B,IAAI,IAAI,KAAK,CAAC;oBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,uEAAuE;QACvE,uDAAuD;QACvD,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,CAAC;AACF,CAAC"}

package/dist/nodes/Form/utils/formCompletionUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formCompletionUtils.d.ts","sourceRoot":"","sources":["../../../../nodes/Form/utils/formCompletionUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAIzB,MAAM,cAAc,CAAC;AAQtB,eAAO,MAAM,cAAc,GAC1B,SAAS,iBAAiB,KACxB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAsBnE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAChC,SAAS,iBAAiB,EAC1B,KAAK,QAAQ,EACb,SAAS,kBAAkB,KACzB,OAAO,CAAC,oBAAoB,CA2C9B,CAAC"}
+{"version":3,"file":"formCompletionUtils.d.ts","sourceRoot":"","sources":["../../../../nodes/Form/utils/formCompletionUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAIzB,MAAM,cAAc,CAAC;AAQtB,eAAO,MAAM,cAAc,GAC1B,SAAS,iBAAiB,KACxB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAsBnE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAChC,SAAS,iBAAiB,EAC1B,KAAK,QAAQ,EACb,SAAS,kBAAkB,KACzB,OAAO,CAAC,oBAAoB,CAmD9B,CAAC"}

package/dist/nodes/Form/utils/formCompletionUtils.js

@@ -31,7 +31,7 @@ exports.binaryResponse = binaryResponse;
 const renderFormCompletion = async (context, res, trigger) => {
     const completionTitle = context.getNodeParameter('completionTitle', '');
     const completionMessage = context.getNodeParameter('completionMessage', '');
-    const redirectUrl = context.getNodeParameter('redirectUrl', '');
+    const redirectUrl = (0, utils_1.validateSafeRedirectUrl)(context.getNodeParameter('redirectUrl', '')) ?? undefined;
     const options = context.getNodeParameter('options', {});
     const respondWith = context.getNodeParameter('respondWith', '');
     const binary = respondWith === 'returnBinary' ? await (0, exports.binaryResponse)(context) : '';
@@ -43,9 +43,16 @@ const renderFormCompletion = async (context, res, trigger) => {
         title = context.evaluateExpression(`{{ $('${trigger?.name}').params.formTitle }}`);
     }
     const appendAttribution = context.evaluateExpression(`{{ $('${trigger?.name}').params.options?.appendAttribution === false ? false : true }}`);
-    if (respondWith !== 'redirect' && !(0, n8n_core_1.isFormHtmlSandboxingDisabled)()) {
+    // Without a valid URL the page shows the completion card, so it keeps the sandbox.
+    const redirects = respondWith === 'redirect' && redirectUrl !== undefined;
+    if (!redirects && !(0, n8n_core_1.isFormHtmlSandboxingDisabled)()) {
         res.setHeader('Content-Security-Policy', (0, n8n_core_1.getHtmlSandboxCSP)());
     }
+    else {
+        // The form route sandboxes every response. Remove it here: the redirect does not
+        // work under the sandbox (n8n-io/n8n#20303).
+        res.removeHeader('Content-Security-Policy');
+    }
     res.render('form-trigger-completion', {
         title: completionTitle,
         message: (0, utils_1.sanitizeHtml)(completionMessage),
@@ -54,7 +61,7 @@ const renderFormCompletion = async (context, res, trigger) => {
         responseText,
         responseBinary: encodeURIComponent(JSON.stringify(binary)),
         dangerousCustomCss: (0, utils_1.sanitizeCustomCss)(options.customCss),
-        redirectUrl: (0, utils_1.validateSafeRedirectUrl)(redirectUrl) ?? undefined,
+        redirectUrl,
     });
     return { noWebhookResponse: true };
 };

package/dist/nodes/Form/utils/formCompletionUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"formCompletionUtils.js","sourceRoot":"","sources":["../../../../nodes/Form/utils/formCompletionUtils.ts"],"names":[],"mappings":";;;AACA,uCAA2E;AAC3E,+CAOsB;AAEtB,mCAAmF;AAEnF,MAAM,qBAAqB,GAAG,CAAC,OAA0B,EAAE,QAAgB,EAAe,EAAE;IAC3F,OAAO,OAAO,CAAC,kBAAkB,CAAC,SAAS,QAAQ,sBAAsB,CAAgB,CAAC;AAC3F,CAAC,CAAC;AAEK,MAAM,cAAc,GAAG,KAAK,EAClC,OAA0B,EAC2C,EAAE;IACvE,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,CAAW,CAAC;IACxF,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,WAAW;SAC5B,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,+BAAgB,CAAC,6BAA6B,kBAAkB,SAAS,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAClE,kBAAkB,CACH,CAAC;IAEjB,OAAO;QACN,yDAAyD;QACzD,0CAA0C;QAC1C,IAAI,EAAE,UAAU,CAAC,EAAE;YAClB,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,MAAM;QACvC,IAAI,EAAE,UAAU,CAAC,QAAQ;KACzB,CAAC;AACH,CAAC,CAAC;AAxBW,QAAA,cAAc,kBAwBzB;AAEK,MAAM,oBAAoB,GAAG,KAAK,EACxC,OAA0B,EAC1B,GAAa,EACb,OAA2B,EACK,EAAE;IAClC,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAW,CAAC;IAClF,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,CAAW,CAAC;IACtF,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAW,CAAC;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAGrD,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAI7C,CAAC;IAClB,MAAM,MAAM,GAAG,WAAW,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,IAAA,sBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,YAAY,GACjB,WAAW,KAAK,UAAU;QACzB,CAAC,CAAC,CAAE,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAY,IAAI,EAAE,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC,SAAS,OAAO,EAAE,IAAI,wBAAwB,CAAW,CAAC;IAC9F,CAAC;IACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CACnD,SAAS,OAAO,EAAE,IAAI,kEAAkE,CAC7E,CAAC;IAEb,IAAI,WAAW,KAAK,UAAU,IAAI,CAAC,IAAA,uCAA4B,GAAE,EAAE,CAAC;QACnE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,IAAA,4BAAiB,GAAE,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,yBAAyB,EAAE;QACrC,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,IAAA,oBAAY,EAAC,iBAAiB,CAAC;QACxC,SAAS,EAAE,KAAK;QAChB,iBAAiB;QACjB,YAAY;QACZ,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1D,kBAAkB,EAAE,IAAA,yBAAiB,EAAC,OAAO,CAAC,SAAS,CAAC;QACxD,WAAW,EAAE,IAAA,+BAAuB,EAAC,WAAW,CAAC,IAAI,SAAS;KAC9D,CAAC,CAAC;IAEH,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC,CAAC;AA/CW,QAAA,oBAAoB,wBA+C/B"}
+{"version":3,"file":"formCompletionUtils.js","sourceRoot":"","sources":["../../../../nodes/Form/utils/formCompletionUtils.ts"],"names":[],"mappings":";;;AACA,uCAA2E;AAC3E,+CAOsB;AAEtB,mCAAmF;AAEnF,MAAM,qBAAqB,GAAG,CAAC,OAA0B,EAAE,QAAgB,EAAe,EAAE;IAC3F,OAAO,OAAO,CAAC,kBAAkB,CAAC,SAAS,QAAQ,sBAAsB,CAAgB,CAAC;AAC3F,CAAC,CAAC;AAEK,MAAM,cAAc,GAAG,KAAK,EAClC,OAA0B,EAC2C,EAAE;IACvE,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,CAAW,CAAC;IACxF,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,WAAW;SAC5B,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,+BAAgB,CAAC,6BAA6B,kBAAkB,SAAS,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAClE,kBAAkB,CACH,CAAC;IAEjB,OAAO;QACN,yDAAyD;QACzD,0CAA0C;QAC1C,IAAI,EAAE,UAAU,CAAC,EAAE;YAClB,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,MAAM;QACvC,IAAI,EAAE,UAAU,CAAC,QAAQ;KACzB,CAAC;AACH,CAAC,CAAC;AAxBW,QAAA,cAAc,kBAwBzB;AAEK,MAAM,oBAAoB,GAAG,KAAK,EACxC,OAA0B,EAC1B,GAAa,EACb,OAA2B,EACK,EAAE;IAClC,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAW,CAAC;IAClF,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,CAAW,CAAC;IACtF,MAAM,WAAW,GAChB,IAAA,+BAAuB,EAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAW,CAAC,IAAI,SAAS,CAAC;IAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAGrD,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAI7C,CAAC;IAClB,MAAM,MAAM,GAAG,WAAW,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,IAAA,sBAAc,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,YAAY,GACjB,WAAW,KAAK,UAAU;QACzB,CAAC,CAAC,CAAE,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAY,IAAI,EAAE,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC,SAAS,OAAO,EAAE,IAAI,wBAAwB,CAAW,CAAC;IAC9F,CAAC;IACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CACnD,SAAS,OAAO,EAAE,IAAI,kEAAkE,CAC7E,CAAC;IAEb,mFAAmF;IACnF,MAAM,SAAS,GAAG,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,SAAS,CAAC;IAE1E,IAAI,CAAC,SAAS,IAAI,CAAC,IAAA,uCAA4B,GAAE,EAAE,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,IAAA,4BAAiB,GAAE,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACP,iFAAiF;QACjF,6CAA6C;QAC7C,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,yBAAyB,EAAE;QACrC,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,IAAA,oBAAY,EAAC,iBAAiB,CAAC;QACxC,SAAS,EAAE,KAAK;QAChB,iBAAiB;QACjB,YAAY;QACZ,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1D,kBAAkB,EAAE,IAAA,yBAAiB,EAAC,OAAO,CAAC,SAAS,CAAC;QACxD,WAAW;KACX,CAAC,CAAC;IAEH,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC,CAAC;AAvDW,QAAA,oBAAoB,wBAuD/B"}

package/dist/nodes/Git/Git.node.d.ts

@@ -1,4 +1,5 @@
 import type { IExecuteFunctions, INodeExecutionData, INodeType, INodeTypeDescription } from 'n8n-workflow';
+export declare const fileUrlToGitPath: (reference: string) => string;
 export declare class Git implements INodeType {
     description: INodeTypeDescription;
     execute(this: IExecuteFunctions): Promise<INodeExecutionData[][]>;

package/dist/nodes/Git/Git.node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Git.node.d.ts","sourceRoot":"","sources":["../../../nodes/Git/Git.node.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,oBAAoB,EAEpB,MAAM,cAAc,CAAC;AAoEtB,qBAAa,GAAI,YAAW,SAAS;IACpC,WAAW,EAAE,oBAAoB,CAoL/B;IAEI,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;CAoxBvE"}
+{"version":3,"file":"Git.node.d.ts","sourceRoot":"","sources":["../../../nodes/Git/Git.node.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,oBAAoB,EAEpB,MAAM,cAAc,CAAC;AA8DtB,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,MAyBpD,CAAC;AAwDF,qBAAa,GAAI,YAAW,SAAS;IACpC,WAAW,EAAE,oBAAoB,CAoL/B;IAEI,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;CAk0BvE"}

package/dist/nodes/Git/Git.node.js

@@ -3,18 +3,87 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Git = void 0;
+exports.Git = exports.fileUrlToGitPath = void 0;
 const config_1 = require("@n8n/config");
 const di_1 = require("@n8n/di");
 const n8n_workflow_1 = require("n8n-workflow");
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
 const path_1 = require("path");
 const simple_git_1 = __importDefault(require("simple-git"));
 const url_1 = require("url");
 const descriptions_1 = require("./descriptions");
 const GenericFunctions_1 = require("./GenericFunctions");
 const REMOTE_HELPER_TRANSPORT = /^[a-zA-Z][a-zA-Z0-9+.-]*::/;
+const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
+// Decode `%XX` runs to bytes like git does; throw on invalid UTF-8 or NUL so a path that
+// cannot be compared to git's byte-for-byte is denied, not checked against a lossy `U+FFFD`.
+const decodeGitPercentEscapes = (segment) => segment.replace(/(?:%[0-9a-fA-F]{2})+/g, (run) => {
+    const decoded = utf8Decoder.decode(Uint8Array.from(run.match(/%[0-9a-fA-F]{2}/g).map((pair) => parseInt(pair.slice(1), 16))));
+    if (decoded.includes('\0')) {
+        throw new n8n_workflow_1.ApplicationError('Repository reference contains a NUL byte');
+    }
+    return decoded;
+});
+// Reconstruct the path git's file transport opens, without the normalisation `URL` applies:
+// `URL` splits off `?`/`#` and collapses `..` lexically; git keeps them and lets the kernel
+// resolve `..` after symlinks. Validate what git opens, not a URL-normalised derivative.
+const fileUrlToGitPath = (reference) => {
+    const hasAuthority = /^file:\/\//i.test(reference);
+    // Decode before splitting: git decodes first, so a `%2F` in the authority shifts the boundary.
+    let path = decodeGitPercentEscapes(reference.replace(/^file:(\/\/)?/i, ''));
+    if (hasAuthority) {
+        const pathStart = path.indexOf('/');
+        const authority = pathStart === -1 ? path : path.slice(0, pathStart);
+        // `file://C:/repo` puts a Windows drive, not a host, in the authority slot; keep it as
+        // the path. On POSIX git reads `C:` as a named authority and opens the path after it,
+        // so the drive-letter case only holds on Windows. A real named authority is not a local
+        // path (the OS can read it as a UNC share on Windows), so refuse anything but an empty
+        // host or `localhost` rather than guess which side wins.
+        if (process.platform === 'win32' && /^[a-zA-Z]:$/.test(authority)) {
+            return path;
+        }
+        if (authority !== '' && authority.toLowerCase() !== 'localhost') {
+            throw new n8n_workflow_1.ApplicationError('Repository reference has an unsupported file authority');
+        }
+        path = pathStart === -1 ? '' : path.slice(pathStart);
+    }
+    // `file:///C:/repo` -> `C:/repo`: drop the slash git strips before a Windows drive letter.
+    if (process.platform === 'win32' && /^\/[a-zA-Z]:[\\/]/.test(path)) {
+        path = path.slice(1);
+    }
+    return path;
+};
+exports.fileUrlToGitPath = fileUrlToGitPath;
+// Ask git which git directory a candidate resolves to, so the gitfile (`gitdir: <path>`) is
+// parsed exactly as git parses it at clone time, not by a reimplementation that drifts from
+// git's byte semantics. Runs with the command-bearing config pinned and a clean env, like the
+// operation itself, so resolution cannot invoke an external program.
+const resolveGitDirWithGit = async (candidate) => {
+    const config = ['core.hooksPath=/dev/null'];
+    const unsafe = { allowUnsafeHooksPath: true };
+    for (const [key, value, unsafeFlag] of COMMAND_CONFIG_KEYS) {
+        config.push(`${key}=${value}`);
+        unsafe[unsafeFlag] = true;
+    }
+    const env = Object.create(null);
+    env.GIT_TERMINAL_PROMPT = '0';
+    try {
+        // `--resolve-git-dir` takes an absolute path, so git's cwd does not steer resolution.
+        const resolver = (0, simple_git_1.default)({ baseDir: (0, node_os_1.tmpdir)(), config, unsafe }).env(env);
+        const output = await resolver.raw(['rev-parse', '--resolve-git-dir', candidate]);
+        // git prints the path and a single terminator. Strip only that terminator: a trailing
+        // space, or an embedded newline, is a real byte of a POSIX directory name. Windows
+        // forbids `\r`/`\n` in a name, so there the terminator can include `\r`.
+        return process.platform === 'win32' ? output.replace(/\r?\n$/, '') : output.replace(/\n$/, '');
+    }
+    catch {
+        // git could not resolve a git directory from this candidate. The clone runs the same
+        // git, so a candidate git cannot resolve here is one git cannot open there either.
+        return undefined;
+    }
+};
 // Deliberately distinct from the `repositoryPath` message so the two guards can be told apart.
 const REPOSITORY_OUT_OF_BOUNDS_MESSAGE = 'The git repository containing this path is outside the allowed file paths';
 const REPOSITORY_OUT_OF_BOUNDS_DESCRIPTION = "The working tree or the git directory of this repository is outside the allowed file paths, matched by the blocked file patterns, or inside n8n's own directories";
@@ -226,7 +295,9 @@ class Git {
         };
         const prepareRepository = async (repositoryPath) => {
             const authentication = this.getNodeParameter('authentication', 0);
-            if (authentication === 'gitPassword') {
+            // Skip `file:` refs: they carry no credentials, and `new URL` would collapse `..`
+            // and diverge from the path the allowed-path check validated.
+            if (authentication === 'gitPassword' && !/^file:/i.test(repositoryPath.trim())) {
                 const gitCredentials = await this.getCredentials('gitPassword');
                 const url = new url_1.URL(repositoryPath);
                 url.username = gitCredentials.username;
@@ -298,9 +369,39 @@ class Git {
             if (this.helpers.isFilePathBlocked(resolvedLocalRepositoryPath)) {
                 throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Access to the ${repositoryType} repository path is not allowed`);
             }
+            await assertGitLinkTargetAllowed(resolvedLocalRepositoryPath, repositoryType);
+        };
+        // git discovers a repository through a `.git` gitfile (`gitdir: <path>`), which can point
+        // the real git directory anywhere, including outside the allowed paths. Resolve the
+        // pointer with git and bound-check the directory git would open.
+        const assertGitLinkTargetAllowed = async (resolvedRepositoryPath, repositoryType) => {
+            // The same locations git appends to a local source, built like git does: a bare path
+            // and a `.git` suffix with no separator, so `<path>.git` and `<path>.git/.git` are
+            // siblings of the source, not children.
+            const candidates = [
+                resolvedRepositoryPath,
+                (0, path_1.join)(resolvedRepositoryPath, '.git'),
+                `${resolvedRepositoryPath}.git`,
+                `${resolvedRepositoryPath}.git${path_1.sep}.git`,
+            ];
+            for (const candidate of candidates) {
+                const gitDir = await resolveGitDirWithGit(candidate);
+                if (gitDir === undefined) {
+                    continue;
+                }
+                const resolvedGitDir = await resolvePathAllowingMissingParents(gitDir);
+                if (this.helpers.isFilePathBlocked((0, GenericFunctions_1.ownerOfGitDir)(resolvedGitDir))) {
+                    throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Access to the ${repositoryType} repository path is not allowed`);
+                }
+            }
         };
         const assertRepositoryReferenceAllowed = async (repository, repositoryType) => {
             const trimmedRepository = repository.trim();
+            // git clones the raw value, so surrounding whitespace would make it open a path this
+            // check never saw. Refuse it instead of validating a trimmed stand-in.
+            if (repository !== trimmedRepository) {
+                throw new n8n_workflow_1.NodeOperationError(this.getNode(), `${repositoryType === 'source' ? 'Source' : 'Target'} repository cannot have leading or trailing whitespace`);
+            }
             if (trimmedRepository.startsWith('-')) {
                 throw new n8n_workflow_1.NodeOperationError(this.getNode(), `${repositoryType === 'source' ? 'Source' : 'Target'} repository cannot start with a hyphen`);
             }
@@ -312,15 +413,16 @@ class Git {
                 throw new n8n_workflow_1.NodeOperationError(this.getNode(), `${repositoryType === 'source' ? 'Source' : 'Target'} repository protocol is not allowed`);
             }
             if (hasUrlScheme(trimmedRepository)) {
-                let repositoryUrl;
-                try {
-                    repositoryUrl = new url_1.URL(trimmedRepository);
-                }
-                catch {
-                    repositoryUrl = undefined;
-                }
-                if (repositoryUrl?.protocol === 'file:') {
-                    await assertLocalRepositoryPathAllowed((0, url_1.fileURLToPath)(repositoryUrl), repositoryType);
+                // git uses its local transport for any `file:` scheme, even one `new URL` rejects.
+                if (/^file:/i.test(trimmedRepository)) {
+                    let gitPath;
+                    try {
+                        gitPath = (0, exports.fileUrlToGitPath)(trimmedRepository);
+                    }
+                    catch {
+                        throw new n8n_workflow_1.NodeOperationError(this.getNode(), `Access to the ${repositoryType} repository path is not allowed`);
+                    }
+                    await assertLocalRepositoryPathAllowed(gitPath, repositoryType);
                 }
                 return;
             }
@@ -847,7 +949,7 @@ class Git {
                     });
                     continue;
                 }
-                throw error;
+                throw new n8n_workflow_1.NodeOperationError(this.getNode(), error, { itemIndex });
             }
         }
         return [returnItems];