mirror of
https://github.com/n8n-io/n8n.git
synced 2026-10-17 05:29:44 +02:00
ff8bc0aa7b
Some checks failed
CI: Python / Checks (push) Has been cancelled
On managed deployments the import allowlist is not the user's to change, so an agent that names `N8N_RUNNERS_STDLIB_ALLOW` or tells them their setting is invalid only produces a support request about something nobody will change for them. Cloud also runs task runners in external mode, where n8n cannot see the runner's configuration at all, so that guidance was doubly unfounded there. Every agent- and user-facing surface now states the capability and stops: assume no imports, write import-free Python, or use JavaScript. Environment variables survive only in code comments and the config class, where operators read them. The external-mode and rejected-allowlist cases now share one message. They led to the same action already, and the separate wording existed only to name the setting behind each. Tests pin the rule across every policy shape rather than the phrasing, so a future edit cannot quietly reintroduce a config recommendation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
55 lines
2.6 KiB
TypeScript
55 lines
2.6 KiB
TypeScript
import type { INodeProperties } from 'n8n-workflow';
|
|
|
|
const commonDescription: INodeProperties = {
|
|
displayName: 'Python',
|
|
name: 'pythonCode',
|
|
type: 'string',
|
|
typeOptions: {
|
|
editor: 'codeNodeEditor',
|
|
editorLanguage: 'python',
|
|
},
|
|
default: '',
|
|
description:
|
|
'Python code to execute. Runs in a sandbox with no network access, and imports only work if your instance allowlists them: read the input items from <code>_items</code> (all-items mode) or <code>_item</code> (per-item mode). <a href="https://docs.n8n.io/code/builtin/">Learn more</a>.',
|
|
noDataExpression: true,
|
|
builderHint: {
|
|
propertyHint:
|
|
'Runs in a locked-down native Python sandbox. IMPORTS ARE OPT-IN PER DEPLOYMENT and off by default, so on a stock instance `import re`, `import json`, `import math`, `import datetime`, `import pandas` and relative imports all FAIL at runtime with "Import of ... is disallowed". Assume nothing is importable unless you have been told this instance\'s allowlist — write import-free Python using builtins and str/list/dict methods, or set language to javaScript when the task genuinely needs a library. Never tell the user to change the allowlist: on managed deployments they cannot. NO network access whatever the allowlist says: requests, urllib, httpx and other HTTP libraries are unavailable — use the HTTP Request node and process its output in this node instead. The ONLY globals are _items (runOnceForAllItems mode ONLY), _item (runOnceForEachItem mode ONLY) and print(); reading the accessor belonging to the other mode raises NameError. There are no cross-node helpers either — _("Node Name"), _input, _json, _today and _jmespath are all undefined, so read data from the connected upstream node only.',
|
|
},
|
|
};
|
|
|
|
const PRINT_INSTRUCTION =
|
|
'Debug by using <code>print()</code> statements and viewing their output in the browser console.';
|
|
|
|
export const pythonCodeDescription: INodeProperties[] = [
|
|
{
|
|
...commonDescription,
|
|
displayOptions: {
|
|
show: {
|
|
language: ['python', 'pythonNative'],
|
|
mode: ['runOnceForAllItems'],
|
|
},
|
|
},
|
|
},
|
|
{
|
|
...commonDescription,
|
|
displayOptions: {
|
|
show: {
|
|
language: ['python', 'pythonNative'],
|
|
mode: ['runOnceForEachItem'],
|
|
},
|
|
},
|
|
},
|
|
{
|
|
displayName: `${PRINT_INSTRUCTION}<br><br>The Python option does not support <code>_</code> syntax and helpers, except for <code>_items</code> in all-items mode and <code>_item</code> in per-item mode.<br><br>Imports are disabled unless your instance allows them.`,
|
|
name: 'notice',
|
|
type: 'notice',
|
|
displayOptions: {
|
|
show: {
|
|
language: ['python', 'pythonNative'],
|
|
},
|
|
},
|
|
default: '',
|
|
},
|
|
];
|