github-mirror/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2026-05-12 16:10:30 +02:00
Code Issues Actions 15 Packages Projects Releases Wiki Activity

fix(core): Correct process.version in expression sandbox (#26550)

Browse Source 
Co-authored-by: manusjs <manusjs@users.noreply.github.com>
This commit is contained in:
manusjs 2026-03-24 16:00:31 +00:00 committed by GitHub
parent 9775f96f15
commit fc0f0712d8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
packages/workflow/src/expression.ts
View File

@ -474,7 +474,7 @@ export class Expression {
pid: process.pid,
ppid: process.ppid,
release: process.release,
version: process.pid,
version: process.version,
versions: process.versions,
}
: {};

7
packages/workflow/test/expression.test.ts
View File

@ -165,6 +165,13 @@ describe('Expression', () => {
expect(evaluate('={{Symbol(1).toString()}}')).toEqual(Symbol(1).toString());
});
it('should expose correct process properties in sandbox', () => {
expect(evaluate('={{process.version}}')).toMatch(/^v\d+\.\d+\.\d+/);
expect(evaluate('={{typeof process.pid}}')).toBe('number');
expect(evaluate('={{process.version}}')).not.toBe(process.pid);
expect(evaluate('={{process.version}}')).toBe(process.version);
});
it('should not able to do arbitrary code execution', () => {
const testFn = vi.fn();
Object.assign(global, { testFn });