n8n-nodes-redactor 5.0.0 → 5.2.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -767,7 +767,7 @@ class Redactor {
         };
     }
     async execute() {
-        var _a, _b, _c, _d, _e, _f, _g;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         const items = this.getInputData();
         const allPaired = items.map((_, i) => ({ item: i }));
         const operation = this.getNodeParameter('operation', 0);
@@ -1041,6 +1041,7 @@ class Redactor {
                 keyOrigins: new WeakMap(),
                 inputText: (0, engine_1.collectInputText)(items.map((it) => it.json)),
                 lockedSpans: new WeakMap(),
+                priorTokens: (0, engine_1.priorTokenMatcher)((_e = vault.getSession(sessionId)) === null || _e === void 0 ? void 0 : _e.entries),
             };
             const allHits = [];
             const returnData = [];
@@ -1091,7 +1092,7 @@ class Redactor {
                 if (includeReport && this.getNodeParameter('includeRopa', 0, false)) {
                     const d = this.getNodeParameter('ropa', 0, {});
                     const list = (v) => String(v !== null && v !== void 0 ? v : '').split(',').map((x) => x.trim()).filter(Boolean);
-                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_e = d.controllerName) !== null && _e !== void 0 ? _e : ''), contactEmail: String((_f = d.controllerContact) !== null && _f !== void 0 ? _f : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_g = d.legalBasis) !== null && _g !== void 0 ? _g : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
+                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_f = d.controllerName) !== null && _f !== void 0 ? _f : ''), contactEmail: String((_g = d.controllerContact) !== null && _g !== void 0 ? _g : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_h = d.legalBasis) !== null && _h !== void 0 ? _h : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
                 }
                 return [returnData, [{ json: report, pairedItem: allPaired }]];
             }

package/dist/nodes/Redactor/engine.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectTokenLike = collectTokenLike;
 exports.collectInputText = collectInputText;
 exports.redactValue = redactValue;
+exports.priorTokenMatcher = priorTokenMatcher;
 exports.restoreValue = restoreValue;
 exports.enhanceWithPresidio = enhanceWithPresidio;
 exports.buildReport = buildReport;
@@ -70,7 +71,11 @@ function isAllowListed(value, allowList) {
     });
 }
 function generateToken(label, index) {
-    return `[${label}_${index}]`;
+    const safe = label.toUpperCase().replace(/[^A-Z0-9_]/g, '_');
+    return `[${/^[A-Z]/.test(safe) ? safe : `X${safe}`}_${index}]`;
+}
+function setOwn(obj, key, value) {
+    Object.defineProperty(obj, key, { value, enumerable: true, writable: true, configurable: true });
 }
 const TOKEN_RE = /^\[[A-Z][A-Z0-9_]*_\d+\]$/;
 function maskValue(value, label) {
@@ -460,7 +465,7 @@ function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, displ
     if (out === null || out === text)
         return value;
     if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize') {
-        ctx.lastLocked = [[0, out.length]];
+        ctx.lastLocked = numCtx.lastLocked;
         return out;
     }
     const mapped = numericMapping(out, text, ctx, vault, sessionId);
@@ -472,7 +477,7 @@ function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, key
     const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
     if (out === key)
         return key;
-    const clashes = (k) => k === '' || k in taken || sourceKeys.has(k);
+    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || sourceKeys.has(k);
     if (!clashes(out))
         return out;
     if (ctx.mode === 'token' || ctx.mode === 'pseudonymize') {
@@ -502,7 +507,7 @@ function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
             hits.push({ ...h, field: childDisplay });
-        obj[outKey] = lockChild(ctx, obj, outKey, () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay));
+        setOwn(obj, outKey, lockChild(ctx, obj, outKey, () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay)));
     }
     (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.set(obj, origins);
     return obj;
@@ -544,35 +549,56 @@ function assertUserRegexInput(text, what) {
     throw new Error(`${what} cannot scan a value of ${text.length} characters, the limit is ${USER_REGEX_MAX_INPUT}. ` +
         'Exclude the field with field rules, or remove the regex.');
 }
-function replaceInFree(seg, re, fn, into) {
-    var _a;
-    let last = 0;
-    for (const m of seg.text.matchAll(re)) {
-        const at = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
-        if (m[0] === '')
-            continue;
-        const replacement = fn(m[0], seg.src + at);
-        if (replacement === null)
-            continue;
-        if (at > last)
-            into.push({ text: seg.text.slice(last, at), locked: false, src: seg.src + last });
-        into.push({ text: replacement, locked: true, src: -1 });
-        last = at + m[0].length;
+class SegmentCursor {
+    constructor(segs) {
+        this.segs = segs;
+        this.next = [];
+        this.i = 0;
+        this.cur = segs[0];
+    }
+    freeAt(start, end) {
+        while (this.cur && (this.cur.locked || this.cur.src + this.cur.text.length <= start))
+            this.take();
+        const cur = this.cur;
+        return cur && cur.src <= start && end <= cur.src + cur.text.length ? cur : undefined;
+    }
+    lock(start, end, replacement) {
+        const cur = this.cur;
+        if (start > cur.src)
+            this.next.push({ text: cur.text.slice(0, start - cur.src), locked: false, src: cur.src });
+        this.next.push({ text: replacement, locked: true, src: -1 });
+        const tail = end - cur.src;
+        if (tail < cur.text.length)
+            this.cur = { text: cur.text.slice(tail), locked: false, src: end };
+        else
+            this.cur = this.segs[++this.i];
+    }
+    finish() {
+        while (this.cur)
+            this.take();
+        return this.next;
+    }
+    take() {
+        this.next.push(this.cur);
+        this.cur = this.segs[++this.i];
     }
-    if (last < seg.text.length)
-        into.push({ text: seg.text.slice(last), locked: false, src: seg.src + last });
 }
 function replaceFree(pass, re, fn) {
-    const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
-    const global = new RegExp(re.source, flags);
-    const next = [];
-    for (const seg of pass.segs) {
-        if (seg.locked)
-            next.push(seg);
-        else
-            replaceInFree(seg, global, fn, next);
+    const global = new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
+    const cursor = new SegmentCursor(pass.segs);
+    let m;
+    while ((m = global.exec(pass.source)) !== null) {
+        const start = m.index;
+        const end = start + m[0].length;
+        if (m[0] === '' || !cursor.freeAt(start, end)) {
+            global.lastIndex = start + 1;
+            continue;
+        }
+        const replacement = fn(m[0], start);
+        if (replacement !== null)
+            cursor.lock(start, end, replacement);
     }
-    pass.segs = next;
+    pass.segs = cursor.finish();
 }
 function redactMatch(pass, match, pattern, detail) {
     const replacement = applyRedaction(match, pattern, pass.ctx, pass.vault, pass.sessionId);
@@ -621,19 +647,18 @@ function builtInStage(pass) {
         replaceFree(pass, pattern.regex, (match, offset) => builtInMatch(pass, pattern, match, offset));
     }
 }
-function freeNames(pass) {
-    const names = new Set();
-    for (const seg of pass.segs) {
+function sourceNames(pass) {
+    const names = new Set((0, names_1.detectNamesInText)(pass.source).map((nm) => nm.name));
+    for (const seg of pass.segs)
         if (!seg.locked)
             for (const nm of (0, names_1.detectNamesInText)(seg.text))
                 names.add(nm.name);
-    }
-    return names;
+    return [...names].sort((x, y) => y.length - x.length);
 }
 function nameStage(pass) {
     if (pass.ctx.skipSemantic)
         return;
-    for (const name of freeNames(pass)) {
+    for (const name of sourceNames(pass)) {
         if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
             continue;
         let replacement;
@@ -689,12 +714,27 @@ function lockChild(ctx, container, key, compute) {
     ctx.lastLocked = undefined;
     return out;
 }
+function priorTokenMatcher(entries) {
+    const tokens = Object.keys(entries !== null && entries !== void 0 ? entries : {}).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
+    return tokens.length > 0 ? new RegExp(tokens.map(escapeRe).join('|'), 'g') : undefined;
+}
+function literalStage(pass) {
+    const { ctx, vault, sessionId } = pass;
+    if (!ctx.priorTokens || (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize'))
+        return;
+    replaceFree(pass, ctx.priorTokens, (match) => {
+        const token = freshToken('LITERAL', vault, sessionId, ctx.reservedTokens);
+        vault.addEntry(sessionId, { token, original: match, patternLabel: 'LITERAL', category: 'other', createdAt: new Date().toISOString() });
+        return token;
+    });
+}
 function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     var _a;
     const pass = {
         source: text, segs: [{ text, locked: false, src: 0 }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
         ctx, vault, sessionId, hits, itemIndex, fieldPath,
     };
+    literalStage(pass);
     denyListStage(pass);
     builtInStage(pass);
     nameStage(pass);
@@ -721,7 +761,7 @@ function restoreWith(value, restore, entries) {
     if (value !== null && typeof value === 'object') {
         const obj = {};
         for (const [k, v] of Object.entries(value)) {
-            obj[restore(k)] = restoreWith(v, restore, entries);
+            setOwn(obj, restore(k), restoreWith(v, restore, entries));
         }
         return obj;
     }
@@ -808,7 +848,7 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path,
             const child = path ? `${path}.${k}` : k;
             const childPolicy = policyPath ? `${policyPath}.${original}` : original;
             const lock = (_f = (_e = ctx.lockedSpans) === null || _e === void 0 ? void 0 : _e.get(value)) === null || _f === void 0 ? void 0 : _f.get(k);
-            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock);
+            setOwn(out, k, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock));
         }
         return out;
     }

package/dist/nodes/Redactor/regexCharset.js

@@ -50,6 +50,7 @@ const CLASS_ESCAPES = {
     },
 };
 const HEX = /^[0-9a-fA-F]+$/;
+const CONTROL = { n: 10, r: 13, t: 9, v: 11, f: 12 };
 function readEscape(src, i) {
     var _a, _b;
     const e = (_a = src[i + 1]) !== null && _a !== void 0 ? _a : '';
@@ -62,10 +63,18 @@ function readEscape(src, i) {
         return { length: 3, code: src.charCodeAt(i + 2) % 32 };
     if (e === '0')
         return { length: 2, code: 0 };
+    const control = CONTROL[e];
+    if (control !== undefined)
+        return { length: 2, code: control };
     if (/[a-zA-Z0-9]/.test(e))
         return { length: 2, code: null };
     return { length: 2, code: e.charCodeAt(0) };
 }
+function codeSet(code) {
+    const set = (0, exports.emptySet)();
+    addCode(set, code);
+    return set;
+}
 function escapeSet(src, i) {
     var _a;
     const { code } = readEscape(src, i);
@@ -82,6 +91,10 @@ function escapeSet(src, i) {
     return letter === letter.toLowerCase() ? set : complement(set);
 }
 function classMember(body, j) {
+    if (body[j] === '\\' && body[j + 1] === 'b')
+        return { set: codeSet(8), next: j + 2, code: 8 };
+    if (body[j] === '\\' && body[j + 1] === 'B')
+        return { set: codeSet(66), next: j + 2, code: 66 };
     if (body[j] === '\\') {
         const { length, code } = readEscape(body, j);
         return { set: escapeSet(body, j), next: j + length, code };

package/dist/nodes/Redactor/regexSafety.js

@@ -3,9 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkRegex = checkRegex;
 const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
-const newFrame = (zeroWidth = false) => ({
+const newFrame = (zeroWidth = false, inLook = zeroWidth) => ({
     hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
-    branchConsumes: false, allConsume: true, nullable: false,
+    branchConsumes: false, allConsume: true, nullable: false, inLook,
 });
 function endBranch(frame) {
     frame.allConsume && (frame.allConsume = frame.branchConsumes);
@@ -48,7 +48,7 @@ function skipClass(src, i) {
 function groupPrefixLength(src, i) {
     if (src[i + 1] !== '?')
         return 1;
-    const named = /^\(\?<[A-Za-z_$][\w$]*>/.exec(src.slice(i));
+    const named = /^\(\?<[^=!>][^>]*>/.exec(src.slice(i));
     if (named)
         return named[0].length;
     const look = /^\(\?(?::|=|!|<=|<!)/.exec(src.slice(i));
@@ -79,7 +79,8 @@ function readToken(src, i, stack) {
     if (c === '[')
         return { atomEnd: skipClass(src, i), closed: null };
     if (c === '(') {
-        stack.push(newFrame(/^\(\?(?:=|!|<=|<!)/.test(src.slice(i))));
+        const look = /^\(\?(?:=|!|<=|<!)/.test(src.slice(i));
+        stack.push(newFrame(look, look || stack[stack.length - 1].inLook));
         return { atomEnd: i, closed: null, next: i + groupPrefixLength(src, i) };
     }
     if (c === '|')
@@ -127,8 +128,11 @@ function consumes(q, chars, closed) {
         return false;
     return !(closed === null || closed === void 0 ? void 0 : closed.nullable);
 }
+const IN_LOOK = 'repeats a variable part inside a lookahead or lookbehind, which is not supported';
 function stepProblem(src, i, step, q, top) {
     var _a;
+    if (top.inLook && isVariable(q))
+        return IN_LOOK;
     const problem = applyQuantifier(q, step.closed, top);
     if (problem || (q === null || q === void 0 ? void 0 : q.max) === 0)
         return problem;
@@ -157,7 +161,45 @@ function structuralProblem(src) {
     }
     return null;
 }
+const KNOWN_ESCAPES = /^(?:[dDwWsSbBnrtvf]|x[0-9a-fA-F]{2}|u[0-9a-fA-F]{4}|c[A-Za-z]|0(?![0-9])|[^A-Za-z0-9])/;
+const CLASS_ESCAPE_RANGE = /\\[dDwWsS]-[^\]]|[^[^\\]-\\[dDwWsS]/;
+const BAD_ESCAPE = 'uses an escape that is not supported (octal, back-reference or unknown letter)';
+const EMPTY_CLASS = 'uses an empty class [] or [^], which is not supported';
+const ESCAPE_RANGE = 'uses a range with \\d, \\w or \\s as an end, which is not supported';
+function classProblem(src, i) {
+    if (/^\[\^?\]/.test(src.slice(i)))
+        return { end: i, problem: EMPTY_CLASS };
+    const end = skipClass(src, i);
+    const body = src.slice(i, end);
+    for (let j = 1; j < body.length; j++) {
+        if (body[j] === '\\' && !KNOWN_ESCAPES.test(body.slice(j + 1)))
+            return { end, problem: BAD_ESCAPE };
+        if (body[j] === '\\')
+            j++;
+    }
+    return { end, problem: CLASS_ESCAPE_RANGE.test(body) ? ESCAPE_RANGE : null };
+}
+function unsupportedSyntax(src) {
+    let i = 0;
+    while (i < src.length) {
+        if (src[i] === '[') {
+            const { end, problem } = classProblem(src, i);
+            if (problem)
+                return problem;
+            i = end;
+        }
+        else if (src[i] === '\\') {
+            if (!KNOWN_ESCAPES.test(src.slice(i + 1)))
+                return BAD_ESCAPE;
+            i += 2;
+        }
+        else
+            i++;
+    }
+    return null;
+}
 function checkRegex(regexStr) {
+    var _a;
     if (typeof regexStr !== 'string' || regexStr.length === 0)
         return 'is empty';
     if (regexStr.length > MAX_REGEX_LENGTH)
@@ -168,5 +210,5 @@ function checkRegex(regexStr) {
     catch {
         return 'is not a valid regular expression';
     }
-    return structuralProblem(regexStr);
+    return (_a = unsupportedSyntax(regexStr)) !== null && _a !== void 0 ? _a : structuralProblem(regexStr);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",