Executer v2 by sudhir-raut · Pull Request #32 · iauroSystems/io-flow-core

sudhir-raut · 2025-03-03T12:00:36Z

New version of executor added.
Resolved module injection issue.

src/common/middlewares/test/http-request-headers.middleware.spec.ts

+    const request: any = {
+      headers: {
+        'x-tenant-id': 'some-tenant-id',
+        'authorization': 'Bearer some-token',


src/common/middlewares/test/http-request-headers.middleware.spec.ts

+    const request: any = {
+      headers: {
+        'x-tenant-id': 'some-tenant-id',
+        'authorization': 'Bearer some-token',


src/models/connectors/repository/connectors.repository.impl.ts

+  }
+
+  update(condition: any, object: UpdateConnectorBodyDto): Promise<ConnectorDocument> {
+    return this.ConnectorModel.findOneAndUpdate(condition, object, { new: true }).exec();


To fix the problem, we need to ensure that the user-controlled data is properly sanitized before being used in the database query. For NoSQL databases like MongoDB, we can use the $eq operator to ensure that the data is interpreted as a literal value. Alternatively, we can validate the data to ensure it is of the expected type and format before using it in the query.

The best way to fix this issue without changing existing functionality is to modify the update method in ConnectorRepositoryImpl to use the $eq operator for the condition and validate the object parameter before using it in the query.

src/models/validations/repository/validations.repository.impl.ts

+  }
+
+  updateOne(condition: any, object: any): Promise<ValidationsDocument> {
+    return this.ValidationsModel.findOneAndUpdate(condition, object, { new: true }).exec();


To fix the problem, we need to ensure that the user-provided data is properly sanitized or validated before being used in the database query. In this case, we can use the $set operator to ensure that the user input is interpreted as a literal value and not as a query object. This will prevent any potential NoSQL injection attacks.

Modify the updateOne method in validations.repository.impl.ts to use the $set operator.

Ensure that the object parameter is properly sanitized or validated before being used in the query.

src/modules/connectors/connectors.service.ts

+        for ( let key in search ) {
+          if ( search.hasOwnProperty( key ) ) {
+            let obj = {};
+            obj[ key ] = { $regex: new RegExp( search[ key ], 'i' ) };


To fix the problem, we need to sanitize the user input before using it to construct a regular expression. The best way to do this is by using a sanitization function such as _.escapeRegExp from the lodash library. This function escapes special characters in the input that have special meaning in regular expressions, thus preventing injection attacks.

We will need to:

Import the lodash library.

Use the _.escapeRegExp function to sanitize search[key] before using it in the RegExp constructor.

src/modules/executor/providers/data-transformer.ts

+    private escapeSlashes(data) {
+        if (typeof data === "string") {
+            data = data.replace(/\\(?![nrtbf"'\\])/g, '\\\\');
+            data = data.replace(/"/g,'\\"')


To fix the problem, we need to ensure that all backslashes in the input string are properly escaped. This can be achieved by using a regular expression with the global flag to replace all occurrences of backslashes with double backslashes. Additionally, we should ensure that other characters are also escaped correctly.

The best way to fix the problem without changing existing functionality is to update the escapeSlashes method to use a regular expression that matches all backslashes and replaces them with double backslashes. We should also ensure that the other replacements are performed correctly.

src/modules/executor/providers/data-transformer.ts

+        if (typeof data === "string") {
+            data = data.replace(/\\(?![nrtbf"'\\])/g, '\\\\');
+            data = data.replace(/"/g,'\\"')
+            data = data.replace(/'/g, "\\'");


To fix the problem, we need to ensure that all backslashes are properly escaped in the escapeSlashes method. This can be achieved by adding a line to replace all backslashes with double backslashes before handling other characters. This ensures that any backslashes in the input string are correctly escaped.

src/modules/process-definitions/process-definitions.service.ts

  async uploadBPMNFile(headers: CommonHeadersDto, file) {
-    const filename = sanitize(file.originalname);
-    const xml = require('fs').readFileSync(`${Paths.BPMN_XML}/${filename}`, 'utf8');
+    const xml = require('fs').readFileSync(file.path, 'utf8');


To fix the problem, we need to ensure that the file path is validated and sanitized before it is used. This can be done by resolving the path to remove any potentially harmful segments and then checking that the resolved path is within a designated safe directory.

Use path.resolve to normalize the file path.

Check that the resolved path starts with the root directory to ensure it is within the intended directory.

If the path is not valid, return an error response.

src/modules/webhooks/webhooks.service.ts

+        for (let key in search) {
+          if (search.hasOwnProperty(key)) {
+            let obj = {};
+            obj[key] = { $regex: new RegExp(search[key], 'i') }


To fix the problem, we need to sanitize the user input before using it to construct a regular expression. The best way to do this is by using a sanitization function such as _.escapeRegExp from the lodash library. This function escapes special characters in the input that have special meaning in regular expressions, thus preventing injection attacks.

We will:

Import the lodash library.

Use the _.escapeRegExp function to sanitize search[key] before constructing the regular expression.

src/shared/connectors/soap.connector.ts

+                if (err) {
+                    reject(err);
+                } else {
+                    client[soapConnectorConfig.method](soapConnectorConfig.data, (err, result) => {


To fix the problem, we need to validate that the method name provided in soapConnectorConfig.method is a valid function on the client object before invoking it. This can be achieved by checking if the method exists and is of type function. If the method is not valid, we should handle the error appropriately.

Check if client.hasOwnProperty(soapConnectorConfig.method) to ensure the method exists on the client object.

Check if typeof client[soapConnectorConfig.method] === 'function' to ensure the method is a function.

If both checks pass, invoke the method; otherwise, reject the promise with an appropriate error message.

sudhir-raut added 3 commits November 1, 2023 17:16

Add HOW_TO_USE.md file, Update README.md

58e2444

Merge branch 'master' of https://github.com/iauroSystems/io-flow-core

36c7951

WIP: Executor V2 -> Add module for executor

536234d

github-advanced-security bot found potential problems Mar 3, 2025

View reviewed changes

@@ -20,3 +20,9 @@
               update(condition: any, object: UpdateConnectorBodyDto): Promise<ConnectorDocument> {
-                return this.ConnectorModel.findOneAndUpdate(condition, object, { new: true }).exec();
+                // Ensure the condition uses the $eq operator
+                const sanitizedCondition = { _id: { $eq: condition._id } };
+                // Validate the object parameter (example: ensure it's an object and has expected properties)
+                if (typeof object !== 'object' || !object) {
+                  throw new Error('Invalid update object');
+                }
+                return this.ConnectorModel.findOneAndUpdate(sanitizedCondition, object, { new: true }).exec();
               }

@@ -1,2 +1,3 @@
             import { HttpStatus, Injectable } from "@nestjs/common";
+            import * as _ from 'lodash';
             import { CreateConnectorBodyDto, UpdateConnectorBodyDto, GetConnectorQueryDto } from "./dtos";
@@ -58,3 +59,3 @@
                         let obj = {};
-                        obj[ key ] = { $regex: new RegExp( search[ key ], 'i' ) };
+                        obj[ key ] = { $regex: new RegExp( _.escapeRegExp( search[ key ] ), 'i' ) };
                         condition[ '$or' ].push( obj );

@@ -305,3 +305,10 @@
               async uploadBPMNFile(headers: CommonHeadersDto, file) {
-                const xml = require('fs').readFileSync(file.path, 'utf8');
+                const path = require('path');
+                const fs = require('fs');
+                const ROOT = '/src/shared/public/';
+                const resolvedPath = path.resolve(ROOT, file.path);
+                if (!resolvedPath.startsWith(ROOT)) {
+                  throw new CustomError(HttpStatus.FORBIDDEN, CustomMessages.INVALID_FILE_PATH);
+                }
+                const xml = fs.readFileSync(resolvedPath, 'utf8');
                 const options = { ignoreComment: true, alwaysChildren: true };

@@ -6,2 +6,3 @@
             import { WebhookRepositoryImpl } from "src/models/webhooks/repository/webhooks.repository.impl";
+            import * as _ from 'lodash';
@@ -13,3 +14,2 @@
               async create(createWebhookDto: CreateWebhookBodyDto): Promise<CustomResponse | CustomError> {
@@ -46,3 +46,3 @@
                         let obj = {};
-                        obj[key] = { $regex: new RegExp(search[key], 'i') }
+                        obj[key] = { $regex: new RegExp(_.escapeRegExp(search[key]), 'i') }
                         condition['$or'].push(obj);

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Executer v2#32

Executer v2#32
sudhir-raut wants to merge 3 commits intomasterfrom
executer-v2

sudhir-raut commented Mar 3, 2025

Uh oh!

Check failure

Check failure

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sudhir-raut commented Mar 3, 2025

Uh oh!

Check failure

Uh oh!

Check failure

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant