mirror of
https://github.com/n8n-io/n8n.git
synced 2026-06-03 10:17:00 +02:00
e383f0f903
Completes the CAT-2844 backport of Expression Isolation to 1.x. Phases 1–3 landed via #31186/#31383/#31384; this squashes the remaining phases (whose per-phase PRs #31385/#31387/#31388/#31389/#31390/#31474 were merged into the stacked branches rather than 1.x): - 4A — dispatch Expression.evaluate() to the VM evaluator (#31385) - 4B — init/dispose VM engine in cli base command (#31387) - 4C — acquire/release isolate at production callsites (#31388) - 5 — ExpressionObservabilityProvider (#31389) - 7 — workflow engine-parity test workspace (#31390) - 8 — rebuild isolated-vm in Docker image for musl libc (#31474) - test: make 1.x jmespath/array-proxy tests engine-aware Engine remains opt-in via N8N_EXPRESSION_ENGINE=vm (default legacy); v1 behaviour unchanged unless enabled. Refs https://linear.app/n8n/issue/CAT-2844
71 lines
2.5 KiB
TypeScript
71 lines
2.5 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import * as Helpers from './helpers';
|
|
import type { INodeExecutionData } from '../src/interfaces';
|
|
import { Workflow } from '../src/workflow';
|
|
|
|
// Engine-parity tests for behaviour of `$json` arrays beyond plain indexed access.
|
|
|
|
describe('Expression — array proxy semantics (engine parity)', () => {
|
|
const workflow = new Workflow({
|
|
id: '1',
|
|
nodes: [
|
|
{
|
|
name: 'node',
|
|
typeVersion: 1,
|
|
type: 'test.set',
|
|
id: 'uuid-1234',
|
|
position: [0, 0],
|
|
parameters: {},
|
|
},
|
|
],
|
|
connections: {},
|
|
active: false,
|
|
nodeTypes: Helpers.NodeTypes(),
|
|
});
|
|
const expression = workflow.expression;
|
|
|
|
// acquireIsolate/releaseIsolate are no-ops for the legacy engine, so these
|
|
// hooks are safe to register unconditionally; under the vm engine they
|
|
// reserve the isolate this suite's expressions evaluate against.
|
|
beforeAll(async () => {
|
|
await expression.acquireIsolate();
|
|
});
|
|
afterAll(async () => {
|
|
await expression.releaseIsolate();
|
|
});
|
|
|
|
const evaluate = (value: string, json: unknown) => {
|
|
const data: INodeExecutionData[] = [{ json: json as INodeExecutionData['json'] }];
|
|
return expression.getParameterValue(value, null, 0, 0, 'node', data, 'manual', {});
|
|
};
|
|
|
|
// Both engines reject property-descriptor access from inside an expression:
|
|
// `getOwnPropertyDescriptor` is on the sanitizer's blocklist, so the
|
|
// expression is rejected before evaluation. Documented so a future
|
|
// divergence is caught; neither engine intends to expose the data this way.
|
|
it('Object.getOwnPropertyDescriptor on $json properties is not exposed via expressions', () => {
|
|
expect(() =>
|
|
evaluate('={{ Object.getOwnPropertyDescriptor($json.arr, "0") }}', { arr: [10, 20, 30] }),
|
|
).toThrow(/due to security concerns/);
|
|
});
|
|
|
|
it('spread syntax materialises the array via Symbol.iterator', () => {
|
|
expect(evaluate('={{ [...$json.arr] }}', { arr: [10, 20, 30] })).toEqual([10, 20, 30]);
|
|
});
|
|
|
|
it('for…of iterates the array elements', () => {
|
|
const expr =
|
|
'={{ (() => { const out = []; for (const x of $json.arr) out.push(x); return out; })() }}';
|
|
expect(evaluate(expr, { arr: [10, 20, 30] })).toEqual([10, 20, 30]);
|
|
});
|
|
|
|
it('toString returns the canonical comma-joined string (matches native Array)', () => {
|
|
expect(evaluate('={{ $json.arr.toString() }}', { arr: [10, 20, 30] })).toBe('10,20,30');
|
|
});
|
|
|
|
it('implicit string coercion uses Array.prototype.toString', () => {
|
|
expect(evaluate('={{ "items: " + $json.arr }}', { arr: [1, 2, 3] })).toBe('items: 1,2,3');
|
|
});
|
|
});
|