diff --git a/packages/workflow/src/expression.ts b/packages/workflow/src/expression.ts index 63f09629d22..5d81b7dc80b 100644 --- a/packages/workflow/src/expression.ts +++ b/packages/workflow/src/expression.ts @@ -474,7 +474,7 @@ export class Expression { pid: process.pid, ppid: process.ppid, release: process.release, - version: process.pid, + version: process.version, versions: process.versions, } : {}; diff --git a/packages/workflow/test/expression.test.ts b/packages/workflow/test/expression.test.ts index 58fe16e2034..e7b12a334ae 100644 --- a/packages/workflow/test/expression.test.ts +++ b/packages/workflow/test/expression.test.ts @@ -165,6 +165,13 @@ describe('Expression', () => { expect(evaluate('={{Symbol(1).toString()}}')).toEqual(Symbol(1).toString()); }); + it('should expose correct process properties in sandbox', () => { + expect(evaluate('={{process.version}}')).toMatch(/^v\d+\.\d+\.\d+/); + expect(evaluate('={{typeof process.pid}}')).toBe('number'); + expect(evaluate('={{process.version}}')).not.toBe(process.pid); + expect(evaluate('={{process.version}}')).toBe(process.version); + }); + it('should not able to do arbitrary code execution', () => { const testFn = vi.fn(); Object.assign(global, { testFn });