github-mirror/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2026-10-17 05:29:44 +02:00
Code Issues Actions 14 Packages Projects Releases Wiki Activity Graph

Merge 4b4d4c0543 into ec074519d9

Browse Source
This commit is contained in:
beejak 2026-10-16 20:17:45 +02:00 committed by GitHub
commit b0c6e3a85d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
packages/frontend/editor-ui/src/features/settings/sso/provisioning/components/RuleMappingExpressionInput.vue
View File

@ -51,21 +51,18 @@ const dialogVisible = ref(false);
let editorView: EditorView | null = null;
let expandedEditorView: EditorView | null = null;
// Mock $claims: every property returns a real array so .includes() works but .includ() throws
const mockClaims = new Proxy(
{},
{ get: (_target, prop) => (typeof prop === 'symbol' ? undefined : ['mock']) },
);
function validateExpression(value: string): boolean {
if (!value.trim()) return true;
const match = value.match(/^\{\{(.+)\}\}$/s);
const jsContent = match ? match[1].trim() : value.trim();
if (!jsContent) return true;
try {
// Syntax-only validation: the Function constructor throws SyntaxError for
// invalid JS without executing the body. Do NOT call the returned function —
// calling it would execute user-provided code in the browser context where
// window, document, and fetch are all reachable.
// eslint-disable-next-line no-new-func, @typescript-eslint/no-implied-eval
const fn = new Function('$claims', '$oidc', '$saml', '$provider', `return (${jsContent})`);
fn(mockClaims, { idToken: {}, userInfo: {} }, { attributes: {} }, 'oidc');
new Function('$claims', '$oidc', '$saml', '$provider', `return (${jsContent})`);
return true;
} catch {
return false;