n8n 1.56.2 → 1.57.0

package/dist/security-audit/risk-reporters/database-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/database-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,kDAAuD;AACvD,0DAKoC;AAGpC,mCAAiC;AAG1B,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,KAAK,CAAC,MAAM,CAAC,SAAqB;QACjC,MAAM,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,GAC1E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QAEnF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,2BAAe,CAAC,IAAI;YAC1B,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE,CACxD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAE3D,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,sBAAsB;gBACtD,WAAW,EAAE;oBACZ,aAAa,CAAC,oBAAoB,CAAC;oBACnC,iJAAiJ;iBACjJ,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,8IAA8I;gBAC/I,QAAQ,EAAE,oBAAoB;aAC9B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,2BAA2B;gBAC3D,WAAW,EAAE;oBACZ,aAAa,CAAC,wBAAwB,CAAC;oBACvC,4JAA4J;iBAC5J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,kFAAkF;gBACnF,QAAQ,EAAE,wBAAwB;aAClC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,mBAAmB;gBACnD,WAAW,EAAE;oBACZ,aAAa,CAAC,iBAAiB,CAAC;oBAChC,8IAA8I;iBAC9I,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,gGAAgG,oCAAwB,EAAE;gBAC1I,QAAQ,EAAE,iBAAiB;aAC3B,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,SAAqB;QACtC,OAAO,SAAS,CAAC,MAAM,CACtB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;YACjB,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC/B,IAAI,CAAC,0BAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAC3C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;oBAAE,OAAO;gBAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,cAAc;oBAAE,OAAO;gBAEzD,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxF,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;gBAED,IAAI,CAAC,4CAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAE7D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;oBACvC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,QAAQ;oBAAE,OAAO;gBACjE,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,IAAI;oBAAE,OAAO;gBAEtD,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,IACC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB;oBACjD,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,KAAK,QAAQ;oBAChE,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAC3D,CAAC;oBACF,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACtE,CAAC;YACF,CAAC,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC;QACZ,CAAC,EACD,EAAE,oBAAoB,EAAE,EAAE,EAAE,wBAAwB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CACjF,CAAC;IACH,CAAC;CACD,CAAA;AAjGY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,gBAAO,GAAE;GACG,oBAAoB,CAiGhC"}

package/dist/security-audit/risk-reporters/filesystem-risk-reporter.d.ts

@@ -0,0 +1,5 @@
+import type { WorkflowEntity } from '../../databases/entities/workflow-entity';
+import type { RiskReporter, Risk } from '../../security-audit/types';
+export declare class FilesystemRiskReporter implements RiskReporter {
+    report(workflows: WorkflowEntity[]): Promise<Risk.StandardReport | null>;
+}

package/dist/security-audit/risk-reporters/filesystem-risk-reporter.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FilesystemRiskReporter = void 0;
+const utils_1 = require("../../security-audit/utils");
+const constants_1 = require("../../security-audit/constants");
+const typedi_1 = require("typedi");
+let FilesystemRiskReporter = class FilesystemRiskReporter {
+    async report(workflows) {
+        const fsInteractionNodeTypes = (0, utils_1.getNodeTypes)(workflows, (node) => constants_1.FILESYSTEM_INTERACTION_NODE_TYPES.has(node.type));
+        if (fsInteractionNodeTypes.length === 0)
+            return null;
+        const report = {
+            risk: constants_1.FILESYSTEM_REPORT.RISK,
+            sections: [],
+        };
+        const sentenceStart = ({ length }) => length > 1 ? 'These nodes read from and write to' : 'This node reads from and writes to';
+        if (fsInteractionNodeTypes.length > 0) {
+            report.sections.push({
+                title: constants_1.FILESYSTEM_REPORT.SECTIONS.FILESYSTEM_INTERACTION_NODES,
+                description: [
+                    sentenceStart(fsInteractionNodeTypes),
+                    'any accessible file in the host filesystem. Sensitive file content may be manipulated through a node operation.',
+                ].join(' '),
+                recommendation: 'Consider protecting any sensitive files in the host filesystem, or refactoring the workflow so that it does not require host filesystem interaction.',
+                location: fsInteractionNodeTypes,
+            });
+        }
+        return report;
+    }
+};
+exports.FilesystemRiskReporter = FilesystemRiskReporter;
+exports.FilesystemRiskReporter = FilesystemRiskReporter = __decorate([
+    (0, typedi_1.Service)()
+], FilesystemRiskReporter);
+//# sourceMappingURL=filesystem-risk-reporter.js.map

package/dist/security-audit/risk-reporters/filesystem-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/filesystem-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,kDAAsD;AACtD,0DAAkG;AAGlG,mCAAiC;AAG1B,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAClC,KAAK,CAAC,MAAM,CAAC,SAA2B;QACvC,MAAM,sBAAsB,GAAG,IAAA,oBAAY,EAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAC/D,6CAAiC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAChD,CAAC;QAEF,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,6BAAiB,CAAC,IAAI;YAC5B,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE,CACxD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,oCAAoC,CAAC;QAE1F,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,6BAAiB,CAAC,QAAQ,CAAC,4BAA4B;gBAC9D,WAAW,EAAE;oBACZ,aAAa,CAAC,sBAAsB,CAAC;oBACrC,iHAAiH;iBACjH,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,sJAAsJ;gBACvJ,QAAQ,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAA;AA/BY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,gBAAO,GAAE;GACG,sBAAsB,CA+BlC"}

package/dist/security-audit/risk-reporters/instance-risk-reporter.d.ts

@@ -0,0 +1,19 @@
+import { InstanceSettings } from 'n8n-core';
+import type { WorkflowEntity } from '../../databases/entities/workflow-entity';
+import type { RiskReporter, Risk } from '../../security-audit/types';
+import { Logger } from '../../logger';
+import { GlobalConfig } from '@n8n/config';
+export declare class InstanceRiskReporter implements RiskReporter {
+    private readonly instanceSettings;
+    private readonly logger;
+    private readonly globalConfig;
+    constructor(instanceSettings: InstanceSettings, logger: Logger, globalConfig: GlobalConfig);
+    report(workflows: WorkflowEntity[]): Promise<Risk.InstanceReport | null>;
+    private getSecuritySettings;
+    private hasValidatorChild;
+    private getUnprotectedWebhookNodes;
+    private getNextVersions;
+    private removeIconData;
+    private classify;
+    private getOutdatedState;
+}

package/dist/security-audit/risk-reporters/instance-risk-reporter.js

@@ -0,0 +1,173 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstanceRiskReporter = void 0;
+const axios_1 = __importDefault(require("axios"));
+const typedi_1 = require("typedi");
+const n8n_core_1 = require("n8n-core");
+const config_1 = __importDefault(require("../../config"));
+const utils_1 = require("../../security-audit/utils");
+const utils_2 = require("../../utils");
+const constants_1 = require("../../security-audit/constants");
+const constants_2 = require("../../constants");
+const PublicApi_1 = require("../../PublicApi");
+const logger_1 = require("../../logger");
+const config_2 = require("@n8n/config");
+let InstanceRiskReporter = class InstanceRiskReporter {
+    constructor(instanceSettings, logger, globalConfig) {
+        this.instanceSettings = instanceSettings;
+        this.logger = logger;
+        this.globalConfig = globalConfig;
+    }
+    async report(workflows) {
+        const unprotectedWebhooks = this.getUnprotectedWebhookNodes(workflows);
+        const outdatedState = await this.getOutdatedState();
+        const securitySettings = this.getSecuritySettings();
+        if (unprotectedWebhooks.length === 0 && outdatedState === null && securitySettings === null) {
+            return null;
+        }
+        const report = {
+            risk: constants_1.INSTANCE_REPORT.RISK,
+            sections: [],
+        };
+        if (unprotectedWebhooks.length > 0) {
+            const sentenceStart = ({ length }) => length > 1 ? 'These webhook nodes have' : 'This webhook node has';
+            const recommendedValidators = [...constants_1.WEBHOOK_VALIDATOR_NODE_TYPES]
+                .filter((nodeType) => !nodeType.endsWith('function') || !nodeType.endsWith('functionItem'))
+                .join(',');
+            report.sections.push({
+                title: constants_1.INSTANCE_REPORT.SECTIONS.UNPROTECTED_WEBHOOKS,
+                description: [
+                    sentenceStart(unprotectedWebhooks),
+                    `the "Authentication" field set to "None" and ${unprotectedWebhooks.length > 1 ? 'are' : 'is'} not directly connected to a node to validate the payload. Every unprotected webhook allows your workflow to be called by any third party who knows the webhook URL.`,
+                ].join(' '),
+                recommendation: `Consider setting the "Authentication" field to an option other than "None", or validating the payload with one of the following nodes: ${recommendedValidators}.`,
+                location: unprotectedWebhooks,
+            });
+        }
+        if (outdatedState !== null) {
+            report.sections.push({
+                title: constants_1.INSTANCE_REPORT.SECTIONS.OUTDATED_INSTANCE,
+                description: outdatedState.description,
+                recommendation: 'Consider updating this n8n instance to the latest version to prevent security vulnerabilities.',
+                nextVersions: outdatedState.nextVersions,
+            });
+        }
+        if (securitySettings !== null) {
+            report.sections.push({
+                title: constants_1.INSTANCE_REPORT.SECTIONS.SECURITY_SETTINGS,
+                description: 'This n8n instance has the following security settings.',
+                recommendation: `Consider adjusting the security settings for your n8n instance based on your needs. See: ${constants_1.ENV_VARS_DOCS_URL}`,
+                settings: securitySettings,
+            });
+        }
+        return report;
+    }
+    getSecuritySettings() {
+        if (config_1.default.getEnv('deployment.type') === 'cloud')
+            return null;
+        const settings = {};
+        settings.features = {
+            communityPackagesEnabled: this.globalConfig.nodes.communityPackages.enabled,
+            versionNotificationsEnabled: this.globalConfig.versionNotifications.enabled,
+            templatesEnabled: this.globalConfig.templates.enabled,
+            publicApiEnabled: (0, PublicApi_1.isApiEnabled)(),
+        };
+        const { exclude, include } = this.globalConfig.nodes;
+        settings.nodes = {
+            nodesExclude: exclude.length === 0 ? 'none' : exclude.join(', '),
+            nodesInclude: include.length === 0 ? 'none' : include.join(', '),
+        };
+        settings.telemetry = {
+            diagnosticsEnabled: config_1.default.getEnv('diagnostics.enabled'),
+        };
+        return settings;
+    }
+    hasValidatorChild({ node, workflow, }) {
+        var _a;
+        const childNodeNames = (_a = workflow.connections[node.name]) === null || _a === void 0 ? void 0 : _a.main[0].map((i) => i.node);
+        if (!childNodeNames)
+            return false;
+        return childNodeNames.some((name) => workflow.nodes.find((n) => n.name === name && constants_1.WEBHOOK_VALIDATOR_NODE_TYPES.has(n.type)));
+    }
+    getUnprotectedWebhookNodes(workflows) {
+        return workflows.reduce((acc, workflow) => {
+            if (!workflow.active)
+                return acc;
+            workflow.nodes.forEach((node) => {
+                if (node.type === constants_1.WEBHOOK_NODE_TYPE &&
+                    node.parameters.authentication === undefined &&
+                    !this.hasValidatorChild({ node, workflow })) {
+                    acc.push((0, utils_1.toFlaggedNode)({ node, workflow }));
+                }
+            });
+            return acc;
+        }, []);
+    }
+    async getNextVersions(currentVersionName) {
+        const BASE_URL = this.globalConfig.versionNotifications.endpoint;
+        const { instanceId } = this.instanceSettings;
+        const response = await axios_1.default.get(BASE_URL + currentVersionName, {
+            headers: { 'n8n-instance-id': instanceId },
+        });
+        return response.data;
+    }
+    removeIconData(versions) {
+        return versions.map((version) => {
+            if (version.nodes.length === 0)
+                return version;
+            version.nodes.forEach((node) => delete node.iconData);
+            return version;
+        });
+    }
+    classify(versions, currentVersionName) {
+        const [pass, fail] = (0, utils_2.separate)(versions, (v) => v.name === currentVersionName);
+        return { currentVersion: pass[0], nextVersions: fail };
+    }
+    async getOutdatedState() {
+        let versions = [];
+        const localVersion = (0, constants_2.getN8nPackageJson)().version;
+        try {
+            versions = await this.getNextVersions(localVersion).then((v) => this.removeIconData(v));
+        }
+        catch (error) {
+            if (constants_2.inDevelopment) {
+                this.logger.error('Failed to fetch n8n versions. Skipping outdated instance report...');
+            }
+            return null;
+        }
+        const { currentVersion, nextVersions } = this.classify(versions, localVersion);
+        const nextVersionsNumber = nextVersions.length;
+        if (nextVersionsNumber === 0)
+            return null;
+        const description = [
+            `This n8n instance is outdated. Currently at version ${currentVersion.name}, missing ${nextVersionsNumber} ${nextVersionsNumber > 1 ? 'updates' : 'update'}.`,
+        ];
+        const upcomingSecurityUpdates = nextVersions.some((v) => v.hasSecurityIssue || v.hasSecurityFix);
+        if (upcomingSecurityUpdates)
+            description.push('Newer versions contain security updates.');
+        return {
+            description: description.join(' '),
+            nextVersions,
+        };
+    }
+};
+exports.InstanceRiskReporter = InstanceRiskReporter;
+exports.InstanceRiskReporter = InstanceRiskReporter = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [n8n_core_1.InstanceSettings,
+        logger_1.Logger,
+        config_2.GlobalConfig])
+], InstanceRiskReporter);
+//# sourceMappingURL=instance-risk-reporter.js.map

package/dist/security-audit/risk-reporters/instance-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/instance-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,kDAA0B;AAC1B,mCAAiC;AACjC,uCAA4C;AAC5C,sDAA8B;AAC9B,kDAAuD;AACvD,mCAAmC;AACnC,0DAKoC;AACpC,2CAA+D;AAG/D,2CAA2C;AAC3C,qCAAkC;AAClC,wCAA2C;AAGpC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,YACkB,gBAAkC,EAClC,MAAc,EACd,YAA0B;QAF1B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,WAAM,GAAN,MAAM,CAAQ;QACd,iBAAY,GAAZ,YAAY,CAAc;IACzC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,SAA2B;QACvC,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEpD,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,KAAK,IAAI,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAgB;YAC3B,IAAI,EAAE,2BAAe,CAAC,IAAI;YAC1B,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE,CACxD,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAEnE,MAAM,qBAAqB,GAAG,CAAC,GAAG,wCAA4B,CAAC;iBAC7D,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;iBAC1F,IAAI,CAAC,GAAG,CAAC,CAAC;YAEZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,oBAAoB;gBACpD,WAAW,EAAE;oBACZ,aAAa,CAAC,mBAAmB,CAAC;oBAClC,gDACC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAC1C,sKAAsK;iBACtK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,0IAA0I,qBAAqB,GAAG;gBAClL,QAAQ,EAAE,mBAAmB;aAC7B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,iBAAiB;gBACjD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,cAAc,EACb,gGAAgG;gBACjG,YAAY,EAAE,aAAa,CAAC,YAAY;aACxC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,2BAAe,CAAC,QAAQ,CAAC,iBAAiB;gBACjD,WAAW,EAAE,wDAAwD;gBACrE,cAAc,EAAE,4FAA4F,6BAAiB,EAAE;gBAC/H,QAAQ,EAAE,gBAAgB;aAC1B,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,mBAAmB;QAC1B,IAAI,gBAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAE9D,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAE7C,QAAQ,CAAC,QAAQ,GAAG;YACnB,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO;YAC3E,2BAA2B,EAAE,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,OAAO;YAC3E,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO;YACrD,gBAAgB,EAAE,IAAA,wBAAY,GAAE;SAChC,CAAC;QAEF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAErD,QAAQ,CAAC,KAAK,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAChE,YAAY,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;SAChE,CAAC;QAEF,QAAQ,CAAC,SAAS,GAAG;YACpB,kBAAkB,EAAE,gBAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;SACxD,CAAC;QAEF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAKO,iBAAiB,CAAC,EACzB,IAAI,EACJ,QAAQ,GAIR;;QACA,MAAM,cAAc,GAAG,MAAA,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,0CAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEnF,IAAI,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAElC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,wCAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACvF,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,SAA2B;QAC7D,OAAO,SAAS,CAAC,MAAM,CAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;YAC9D,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAC;YAEjC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC/B,IACC,IAAI,CAAC,IAAI,KAAK,6BAAiB;oBAC/B,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;oBAC5C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC1C,CAAC;oBACF,GAAG,CAAC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACF,CAAC,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,kBAA0B;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QACjE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAE7C,MAAM,QAAQ,GAAG,MAAM,eAAK,CAAC,GAAG,CAAgB,QAAQ,GAAG,kBAAkB,EAAE;YAC9E,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE;SAC1C,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACtB,CAAC;IAEO,cAAc,CAAC,QAAuB;QAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YAE/C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEtD,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,QAAQ,CAAC,QAAuB,EAAE,kBAA0B;QACnE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAA,gBAAQ,EAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;QAE9E,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;QAElB,MAAM,YAAY,GAAG,IAAA,6BAAiB,GAAE,CAAC,OAAO,CAAC;QAEjD,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,yBAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE/E,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC;QAE/C,IAAI,kBAAkB,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,WAAW,GAAG;YACnB,uDACC,cAAc,CAAC,IAChB,aAAa,kBAAkB,IAAI,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG;SACnF,CAAC;QAEF,MAAM,uBAAuB,GAAG,YAAY,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,cAAc,CAC7C,CAAC;QAEF,IAAI,uBAAuB;YAAE,WAAW,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAE1F,OAAO;YACN,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,YAAY;SACZ,CAAC;IACH,CAAC;CACD,CAAA;AA/LY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,gBAAO,GAAE;qCAG2B,2BAAgB;QAC1B,eAAM;QACA,qBAAY;GAJhC,oBAAoB,CA+LhC"}

package/dist/security-audit/risk-reporters/nodes-risk-reporter.d.ts

@@ -0,0 +1,14 @@
+import { LoadNodesAndCredentials } from '../../load-nodes-and-credentials';
+import type { WorkflowEntity } from '../../databases/entities/workflow-entity';
+import type { Risk, RiskReporter } from '../../security-audit/types';
+import { CommunityPackagesService } from '../../services/communityPackages.service';
+import { GlobalConfig } from '@n8n/config';
+export declare class NodesRiskReporter implements RiskReporter {
+    private readonly loadNodesAndCredentials;
+    private readonly communityPackagesService;
+    private readonly globalConfig;
+    constructor(loadNodesAndCredentials: LoadNodesAndCredentials, communityPackagesService: CommunityPackagesService, globalConfig: GlobalConfig);
+    report(workflows: WorkflowEntity[]): Promise<Risk.StandardReport | null>;
+    private getCommunityNodeDetails;
+    private getCustomNodeDetails;
+}

package/dist/security-audit/risk-reporters/nodes-risk-reporter.js

@@ -0,0 +1,138 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodesRiskReporter = void 0;
+const path = __importStar(require("path"));
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const typedi_1 = require("typedi");
+const load_nodes_and_credentials_1 = require("../../load-nodes-and-credentials");
+const utils_1 = require("../../security-audit/utils");
+const constants_1 = require("../../security-audit/constants");
+const communityPackages_service_1 = require("../../services/communityPackages.service");
+const config_1 = require("@n8n/config");
+let NodesRiskReporter = class NodesRiskReporter {
+    constructor(loadNodesAndCredentials, communityPackagesService, globalConfig) {
+        this.loadNodesAndCredentials = loadNodesAndCredentials;
+        this.communityPackagesService = communityPackagesService;
+        this.globalConfig = globalConfig;
+    }
+    async report(workflows) {
+        const officialRiskyNodes = (0, utils_1.getNodeTypes)(workflows, (node) => constants_1.OFFICIAL_RISKY_NODE_TYPES.has(node.type));
+        const [communityNodes, customNodes] = await Promise.all([
+            this.getCommunityNodeDetails(),
+            this.getCustomNodeDetails(),
+        ]);
+        const issues = [officialRiskyNodes, communityNodes, customNodes];
+        if (issues.every((i) => i.length === 0))
+            return null;
+        const report = {
+            risk: constants_1.NODES_REPORT.RISK,
+            sections: [],
+        };
+        const sentenceStart = (length) => (length > 1 ? 'These nodes are' : 'This node is');
+        if (officialRiskyNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.OFFICIAL_RISKY_NODES,
+                description: [
+                    sentenceStart(officialRiskyNodes.length),
+                    "part of n8n's official nodes and may be used to fetch and run any arbitrary code in the host system. This may lead to exploits such as remote code execution.",
+                ].join(' '),
+                recommendation: `Consider reviewing the parameters in these nodes, replacing them with app nodes where possible, and not loading unneeded node types with the NODES_EXCLUDE environment variable. See: ${constants_1.ENV_VARS_DOCS_URL}`,
+                location: officialRiskyNodes,
+            });
+        }
+        if (communityNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.COMMUNITY_NODES,
+                description: [
+                    sentenceStart(communityNodes.length),
+                    `sourced from the n8n community. Community nodes are not vetted by the n8n team and have full access to the host system. See: ${constants_1.COMMUNITY_NODES_RISKS_URL}`,
+                ].join(' '),
+                recommendation: 'Consider reviewing the source code in any community nodes installed in this n8n instance, and uninstalling any community nodes no longer in use.',
+                location: communityNodes,
+            });
+        }
+        if (customNodes.length > 0) {
+            report.sections.push({
+                title: constants_1.NODES_REPORT.SECTIONS.CUSTOM_NODES,
+                description: [
+                    sentenceStart(communityNodes.length),
+                    'unpublished and located in the host system. Custom nodes are not vetted by the n8n team and have full access to the host system.',
+                ].join(' '),
+                recommendation: 'Consider reviewing the source code in any custom node installed in this n8n instance, and removing any custom nodes no longer in use.',
+                location: customNodes,
+            });
+        }
+        return report;
+    }
+    async getCommunityNodeDetails() {
+        if (!this.globalConfig.nodes.communityPackages.enabled)
+            return [];
+        const installedPackages = await this.communityPackagesService.getAllInstalledPackages();
+        return installedPackages.reduce((acc, pkg) => {
+            pkg.installedNodes.forEach((node) => acc.push({
+                kind: 'community',
+                nodeType: node.type,
+                packageUrl: [constants_1.NPM_PACKAGE_URL, pkg.packageName].join('/'),
+            }));
+            return acc;
+        }, []);
+    }
+    async getCustomNodeDetails() {
+        const customNodeTypes = [];
+        for (const customDir of this.loadNodesAndCredentials.getCustomDirectories()) {
+            const customNodeFiles = await (0, fast_glob_1.default)('**/*.node.js', { cwd: customDir, absolute: true });
+            for (const nodeFile of customNodeFiles) {
+                const [fileName] = path.parse(nodeFile).name.split('.');
+                customNodeTypes.push({
+                    kind: 'custom',
+                    nodeType: ['CUSTOM', fileName].join('.'),
+                    filePath: nodeFile,
+                });
+            }
+        }
+        return customNodeTypes;
+    }
+};
+exports.NodesRiskReporter = NodesRiskReporter;
+exports.NodesRiskReporter = NodesRiskReporter = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [load_nodes_and_credentials_1.LoadNodesAndCredentials,
+        communityPackages_service_1.CommunityPackagesService,
+        config_1.GlobalConfig])
+], NodesRiskReporter);
+//# sourceMappingURL=nodes-risk-reporter.js.map

package/dist/security-audit/risk-reporters/nodes-risk-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodes-risk-reporter.js","sourceRoot":"","sources":["../../../src/security-audit/risk-reporters/nodes-risk-reporter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,0DAA6B;AAC7B,mCAAiC;AACjC,6EAAuE;AACvE,kDAAsD;AACtD,0DAMoC;AAGpC,oFAAgF;AAChF,wCAA2C;AAGpC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC7B,YACkB,uBAAgD,EAChD,wBAAkD,EAClD,YAA0B;QAF1B,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,iBAAY,GAAZ,YAAY,CAAc;IACzC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,SAA2B;QACvC,MAAM,kBAAkB,GAAG,IAAA,oBAAY,EAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,qCAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CACxC,CAAC;QAEF,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,uBAAuB,EAAE;YAC9B,IAAI,CAAC,oBAAoB,EAAE;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,MAAM,GAAwB;YACnC,IAAI,EAAE,wBAAY,CAAC,IAAI;YACvB,QAAQ,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAE5F,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,oBAAoB;gBACjD,WAAW,EAAE;oBACZ,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBACxC,+JAA+J;iBAC/J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EAAE,yLAAyL,6BAAiB,EAAE;gBAC5N,QAAQ,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,eAAe;gBAC5C,WAAW,EAAE;oBACZ,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC;oBACpC,gIAAgI,qCAAyB,EAAE;iBAC3J,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,kJAAkJ;gBACnJ,QAAQ,EAAE,cAAc;aACxB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,wBAAY,CAAC,QAAQ,CAAC,YAAY;gBACzC,WAAW,EAAE;oBACZ,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC;oBACpC,kIAAkI;iBAClI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACX,cAAc,EACb,uIAAuI;gBACxI,QAAQ,EAAE,WAAW;aACrB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACpC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAElE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,CAAC;QAExF,OAAO,iBAAiB,CAAC,MAAM,CAA8B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACzE,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,GAAG,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,UAAU,EAAE,CAAC,2BAAe,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACxD,CAAC,CACF,CAAC;YAEF,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,CAAC;IAEO,KAAK,CAAC,oBAAoB;QACjC,MAAM,eAAe,GAA6B,EAAE,CAAC;QAErD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,uBAAuB,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC7E,MAAM,eAAe,GAAG,MAAM,IAAA,mBAAI,EAAC,cAAc,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAEvF,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;gBACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxD,eAAe,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACxC,QAAQ,EAAE,QAAQ;iBAClB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,OAAO,eAAe,CAAC;IACxB,CAAC;CACD,CAAA;AAzGY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,gBAAO,GAAE;qCAGkC,oDAAuB;QACtB,oDAAwB;QACpC,qBAAY;GAJhC,iBAAiB,CAyG7B"}

package/dist/security-audit/security-audit.service.js

@@ -0,0 +1,93 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityAuditService = void 0;
+const typedi_1 = __importStar(require("typedi"));
+const config_1 = __importDefault(require("../config"));
+const workflow_repository_1 = require("../databases/repositories/workflow.repository");
+const constants_1 = require("../security-audit/constants");
+const utils_1 = require("../security-audit/utils");
+let SecurityAuditService = class SecurityAuditService {
+    constructor(workflowRepository) {
+        this.workflowRepository = workflowRepository;
+        this.reporters = {};
+    }
+    async run(categories = constants_1.RISK_CATEGORIES, daysAbandonedWorkflow) {
+        if (categories.length === 0)
+            categories = constants_1.RISK_CATEGORIES;
+        await this.initReporters(categories);
+        const daysFromEnv = config_1.default.getEnv('security.audit.daysAbandonedWorkflow');
+        if (daysAbandonedWorkflow) {
+            config_1.default.set('security.audit.daysAbandonedWorkflow', daysAbandonedWorkflow);
+        }
+        const workflows = await this.workflowRepository.find({
+            select: ['id', 'name', 'active', 'nodes', 'connections'],
+        });
+        const promises = categories.map(async (c) => await this.reporters[c].report(workflows));
+        const reports = (await Promise.all(promises)).filter((r) => r !== null);
+        if (daysAbandonedWorkflow) {
+            config_1.default.set('security.audit.daysAbandonedWorkflow', daysFromEnv);
+        }
+        if (reports.length === 0)
+            return [];
+        return reports.reduce((acc, cur) => {
+            acc[(0, utils_1.toReportTitle)(cur.risk)] = cur;
+            return acc;
+        }, {});
+    }
+    async initReporters(categories) {
+        for (const category of categories) {
+            const className = category.charAt(0).toUpperCase() + category.slice(1) + 'RiskReporter';
+            const toFilename = {
+                CredentialsRiskReporter: 'credentials-risk-reporter',
+                DatabaseRiskReporter: 'database-risk-reporter',
+                FilesystemRiskReporter: 'filesystem-risk-reporter',
+                InstanceRiskReporter: 'instance-risk-reporter',
+                NodesRiskReporter: 'nodes-risk-reporter',
+            };
+            const RiskReporterModule = await Promise.resolve(`${`./risk-reporters/${toFilename[className]}`}`).then(s => __importStar(require(s)));
+            const RiskReporterClass = RiskReporterModule[className];
+            this.reporters[category] = typedi_1.default.get(RiskReporterClass);
+        }
+    }
+};
+exports.SecurityAuditService = SecurityAuditService;
+exports.SecurityAuditService = SecurityAuditService = __decorate([
+    (0, typedi_1.Service)(),
+    __metadata("design:paramtypes", [workflow_repository_1.WorkflowRepository])
+], SecurityAuditService);
+//# sourceMappingURL=security-audit.service.js.map

package/dist/security-audit/security-audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.service.js","sourceRoot":"","sources":["../../src/security-audit/security-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAA4C;AAE5C,sDAA8B;AAC9B,sFAAkF;AAElF,0DAA6D;AAC7D,kDAAuD;AAIhD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAChC,YAA6B,kBAAsC;QAAtC,uBAAkB,GAAlB,kBAAkB,CAAoB;QAE3D,cAAS,GAEb,EAAE,CAAC;IAJ+D,CAAC;IAMvE,KAAK,CAAC,GAAG,CAAC,aAA8B,2BAAe,EAAE,qBAA8B;QACtF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,UAAU,GAAG,2BAAe,CAAC;QAE1D,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAErC,MAAM,WAAW,GAAG,gBAAM,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QAE1E,IAAI,qBAAqB,EAAE,CAAC;YAC3B,gBAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;SACxD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExF,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAE1F,IAAI,qBAAqB,EAAE,CAAC;YAC3B,gBAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,WAAW,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,OAAO,OAAO,CAAC,MAAM,CAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9C,GAAG,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;YAEnC,OAAO,GAAG,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IACR,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAA2B;QAC9C,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC;YAExF,MAAM,UAAU,GAA2B;gBAC1C,uBAAuB,EAAE,2BAA2B;gBACpD,oBAAoB,EAAE,wBAAwB;gBAC9C,sBAAsB,EAAE,0BAA0B;gBAClD,oBAAoB,EAAE,wBAAwB;gBAC9C,iBAAiB,EAAE,qBAAqB;aACxC,CAAC;YAGF,MAAM,kBAAkB,GAAG,yBAAa,oBAAoB,UAAU,CAAC,SAAS,CAAC,EAAE,uCAAC,CAAC;YAGrF,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,SAAS,CAA6B,CAAC;YAEpF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,gBAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;CACD,CAAA;AA5DY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,gBAAO,GAAE;qCAEwC,wCAAkB;GADvD,oBAAoB,CA4DhC"}

package/dist/security-audit/types.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowEntity as Workflow } from '../databases/entities/WorkflowEntity';
+import type { WorkflowEntity as Workflow } from '../databases/entities/workflow-entity';
 export declare namespace Risk {
     export type Category = 'database' | 'credentials' | 'nodes' | 'instance' | 'filesystem';
     type CredLocation = {

package/dist/security-audit/utils.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowEntity as Workflow } from '../databases/entities/WorkflowEntity';
+import type { WorkflowEntity as Workflow } from '../databases/entities/workflow-entity';
 import type { Risk } from '../security-audit/types';
 type Node = Workflow['nodes'][number];
 export declare const toFlaggedNode: ({ node, workflow }: {

package/dist/server.d.ts

@@ -0,0 +1,47 @@
+import { LoadNodesAndCredentials } from './load-nodes-and-credentials';
+import { AbstractServer } from './abstract-server';
+import { PostHogClient } from './posthog';
+import { OrchestrationService } from './services/orchestration.service';
+import './controllers/active-workflows.controller';
+import './controllers/auth.controller';
+import './controllers/binary-data.controller';
+import './controllers/curl.controller';
+import './controllers/ai-assistant.controller';
+import './controllers/dynamic-node-parameters.controller';
+import './controllers/invitation.controller';
+import './controllers/me.controller';
+import './controllers/node-types.controller';
+import './controllers/oauth/oauth1-credential.controller';
+import './controllers/oauth/oauth2-credential.controller';
+import './controllers/orchestration.controller';
+import './controllers/owner.controller';
+import './controllers/password-reset.controller';
+import './controllers/project.controller';
+import './controllers/role.controller';
+import './controllers/tags.controller';
+import './controllers/translation.controller';
+import './controllers/users.controller';
+import './controllers/user-settings.controller';
+import './controllers/workflow-statistics.controller';
+import './credentials/credentials.controller';
+import './eventbus/eventBus.controller';
+import './executions/executions.controller';
+import './external-secrets/external-secrets.controller.ee';
+import './license/license.controller';
+import './workflows/workflow-history/workflow-history.controller.ee';
+import './workflows/workflows.controller';
+import { EventService } from './events/event.service';
+export declare class Server extends AbstractServer {
+    private readonly loadNodesAndCredentials;
+    private readonly orchestrationService;
+    private readonly postHogClient;
+    private readonly eventService;
+    private endpointPresetCredentials;
+    private presetCredentialsLoaded;
+    private frontendService?;
+    constructor(loadNodesAndCredentials: LoadNodesAndCredentials, orchestrationService: OrchestrationService, postHogClient: PostHogClient, eventService: EventService);
+    start(): Promise<void>;
+    private registerAdditionalControllers;
+    configure(): Promise<void>;
+    protected setupPushServer(): void;
+}