Skip to content

Commit 1479aab

Browse files
Matsuuun8n-assistant[bot]tomiyehorkardashgeemanjs
authored
chore: Backport Bundle (#26218)
Signed-off-by: Oleg Ivaniv <me@olegivaniv.com> Co-authored-by: n8n-assistant[bot] <100856346+n8n-assistant[bot]@users.noreply.github.com> Co-authored-by: Tomi Turtiainen <10324676+tomi@users.noreply.github.com> Co-authored-by: yehorkardash <yehor.kardash@n8n.io> Co-authored-by: James Gee <1285296+geemanjs@users.noreply.github.com> Co-authored-by: Iván Ovejero <ivov.src@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Stephen Wright <sjw948@gmail.com> Co-authored-by: oleg <me@olegivaniv.com> Co-authored-by: Albert Alises <albert.alises@gmail.com> Co-authored-by: Danny Martini <danny@n8n.io>
1 parent 7762bef commit 1479aab

File tree

38 files changed

+2662
-291
lines changed

38 files changed

+2662
-291
lines changed

‎packages/@n8n/codemirror-lang-html/test/test-complete.js‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
import { EditorState } from '@codemirror/state';
2+
import { CompletionContext } from '@codemirror/autocomplete';
3+
import { html } from '../dist/index.js';
4+
import ist from 'ist';
5+
function get(doc, conf = {}) {
6+
let cur = doc.indexOf('|');
7+
doc = doc.slice(0, cur) + doc.slice(cur + 1);
8+
let state = EditorState.create({
9+
doc,
10+
selection: { anchor: cur },
11+
extensions: [html()],
12+
});
13+
let result = state.languageDataAt('autocomplete', cur)[0](
14+
new CompletionContext(state, cur, !!conf.explicit),
15+
);
16+
return result;
17+
}
18+
describe('HTML completion', () => {
19+
it('completes tag names', () => {
20+
let c = get('<|').options;
21+
ist(c.length, 100, '>');
22+
ist(!c.some((o) => /\W/.test(o.label)));
23+
});
24+
it("doesn't complete from nothing unless explicit", () => {
25+
ist(!get('|'));
26+
});
27+
it('completes at top level', () => {
28+
let c = get('|', { explicit: true }).options;
29+
ist(c.length, 100, '>');
30+
ist(c.every((o) => /^<\w+$/.test(o.label) && o.type == 'type'));
31+
});
32+
it('completes inside an element', () => {
33+
let c = get('<body>|', { explicit: true }).options;
34+
ist(c.length, 100, '>');
35+
ist(c.some((o) => o.label == '</body>'));
36+
ist(c.every((o) => /^<(\/body>|\w+)$/.test(o.label)));
37+
});
38+
it('completes attribute names', () => {
39+
let c = get('<body f|').options;
40+
ist(c.length);
41+
ist(c.every((o) => o.type == 'property'));
42+
});
43+
it('completes attribute names explicitly', () => {
44+
let c = get('<body |', { explicit: true }).options;
45+
ist(c.length);
46+
ist(c.every((o) => o.type == 'property'));
47+
});
48+
it('completes attribute values', () => {
49+
let c = get('<form method=|').options;
50+
ist(
51+
c
52+
.map((o) => o.label)
53+
.sort()
54+
.join(','),
55+
'delete,get,post,put',
56+
);
57+
});
58+
it("completes the 2nd attribute's values", () => {
59+
let c = get('<form lang=en method=|').options;
60+
ist(
61+
c
62+
.map((o) => o.label)
63+
.sort()
64+
.join(','),
65+
'delete,get,post,put',
66+
);
67+
});
68+
it('keeps quotes for attribute values', () => {
69+
let c = get('<form method="|').options;
70+
ist(
71+
c
72+
.map((o) => o.apply)
73+
.sort()
74+
.join(','),
75+
'delete",get",post",put"',
76+
);
77+
});
78+
it('omits already closed quotes', () => {
79+
let c = get('<form method="|"');
80+
ist(c.to, 14);
81+
ist(
82+
c.options
83+
.map((o) => o.apply)
84+
.sort()
85+
.join(','),
86+
'delete,get,post,put',
87+
);
88+
});
89+
it('can handle single quotes', () => {
90+
let c = get("<form method='|'");
91+
ist(c.to, 14);
92+
ist(
93+
c.options
94+
.map((o) => o.apply)
95+
.sort()
96+
.join(','),
97+
'delete,get,post,put',
98+
);
99+
});
100+
it('completes close tags', () => {
101+
let c = get('<body></|').options;
102+
ist(c.length, 1);
103+
ist(c[0].apply, 'body>');
104+
});
105+
it('completes partial close tags', () => {
106+
let c = get('<body></b|').options;
107+
ist(c.length, 1);
108+
ist(c[0].apply, 'body>');
109+
});
110+
it("only completes close tags that haven't already been closed", () => {
111+
let c = get('<html><body><div><p></|</body></html>').options;
112+
ist(c.length, 2);
113+
ist(c.map((o) => o.apply).join(','), 'p>,div>');
114+
});
115+
it('includes close tag in completion after less-than', () => {
116+
let c = get('<html><|').options;
117+
ist(c.some((o) => o.apply == '/html>'));
118+
});
119+
});

‎packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/GenericFunctions.ts‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,20 +34,27 @@ export async function validateAuth(context: IWebhookFunctions) {
3434
} else if (authentication === 'n8nUserAuth') {
3535
const webhookName = context.getWebhookName();
3636

37-
function getCookie(name: string) {
38-
const value = `; ${headers.cookie}`;
39-
const parts = value.split(`; ${name}=`);
37+
if (webhookName !== 'setup') {
38+
function getCookie(name: string) {
39+
const value = `; ${headers.cookie}`;
40+
const parts = value.split(`; ${name}=`);
41+
42+
if (parts.length === 2) {
43+
return parts.pop()?.split(';').shift();
44+
}
45+
return '';
46+
}
4047

41-
if (parts.length === 2) {
42-
return parts.pop()?.split(';').shift();
48+
const authCookie = getCookie('n8n-auth');
49+
if (!authCookie) {
50+
throw new ChatTriggerAuthorizationError(401, 'User not authenticated!');
4351
}
44-
return '';
45-
}
4652

47-
const authCookie = getCookie('n8n-auth');
48-
if (!authCookie && webhookName !== 'setup') {
49-
// Data is not defined on node so can not authenticate
50-
throw new ChatTriggerAuthorizationError(500, 'User not authenticated!');
53+
try {
54+
await context.validateCookieAuth(authCookie);
55+
} catch {
56+
throw new ChatTriggerAuthorizationError(401, 'Invalid authentication token');
57+
}
5158
}
5259
}
5360

‎packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/__test__/GenericFunctions.test.ts‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
import { mock } from 'jest-mock-extended';
2+
import type { ICredentialDataDecryptedObject, IWebhookFunctions } from 'n8n-workflow';
3+
4+
import { ChatTriggerAuthorizationError } from '../error';
5+
import { validateAuth } from '../GenericFunctions';
6+
7+
describe('validateAuth', () => {
8+
const mockContext = mock<IWebhookFunctions>();
9+
10+
beforeEach(() => {
11+
jest.clearAllMocks();
12+
});
13+
14+
describe('authentication = none', () => {
15+
it('should pass without error', async () => {
16+
mockContext.getNodeParameter.calledWith('authentication').mockReturnValue('none');
17+
18+
await expect(validateAuth(mockContext)).resolves.toBeUndefined();
19+
});
20+
});
21+
22+
describe('authentication = basicAuth', () => {
23+
beforeEach(() => {
24+
mockContext.getNodeParameter.calledWith('authentication').mockReturnValue('basicAuth');
25+
});
26+
27+
it('should throw 500 when credentials are not defined', async () => {
28+
mockContext.getCredentials.mockRejectedValue(new Error('No credentials'));
29+
30+
await expect(validateAuth(mockContext)).rejects.toThrow(ChatTriggerAuthorizationError);
31+
await expect(validateAuth(mockContext)).rejects.toMatchObject({
32+
responseCode: 500,
33+
});
34+
});
35+
36+
it('should throw 401 when no auth header is provided', async () => {
37+
mockContext.getCredentials.mockResolvedValue({
38+
user: 'admin',
39+
password: 'secret',
40+
} as ICredentialDataDecryptedObject);
41+
mockContext.getRequestObject.mockReturnValue({
42+
headers: {},
43+
} as never);
44+
45+
await expect(validateAuth(mockContext)).rejects.toThrow(ChatTriggerAuthorizationError);
46+
await expect(validateAuth(mockContext)).rejects.toMatchObject({
47+
responseCode: 401,
48+
});
49+
});
50+
51+
it('should throw 403 when credentials are wrong', async () => {
52+
mockContext.getCredentials.mockResolvedValue({
53+
user: 'admin',
54+
password: 'secret',
55+
} as ICredentialDataDecryptedObject);
56+
mockContext.getRequestObject.mockReturnValue({
57+
headers: {
58+
authorization: 'Basic ' + Buffer.from('admin:wrong').toString('base64'),
59+
},
60+
} as never);
61+
62+
await expect(validateAuth(mockContext)).rejects.toThrow(ChatTriggerAuthorizationError);
63+
await expect(validateAuth(mockContext)).rejects.toMatchObject({
64+
responseCode: 403,
65+
});
66+
});
67+
68+
it('should pass with correct credentials', async () => {
69+
mockContext.getCredentials.mockResolvedValue({
70+
user: 'admin',
71+
password: 'secret',
72+
} as ICredentialDataDecryptedObject);
73+
mockContext.getRequestObject.mockReturnValue({
74+
headers: {
75+
authorization: 'Basic ' + Buffer.from('admin:secret').toString('base64'),
76+
},
77+
} as never);
78+
79+
await expect(validateAuth(mockContext)).resolves.toBeUndefined();
80+
});
81+
});
82+
83+
describe('authentication = n8nUserAuth', () => {
84+
beforeEach(() => {
85+
mockContext.getNodeParameter.calledWith('authentication').mockReturnValue('n8nUserAuth');
86+
});
87+
88+
it('should skip validation for setup webhook', async () => {
89+
mockContext.getWebhookName.mockReturnValue('setup');
90+
mockContext.getHeaderData.mockReturnValue({});
91+
92+
await expect(validateAuth(mockContext)).resolves.toBeUndefined();
93+
});
94+
95+
it('should throw 401 when no n8n-auth cookie is present', async () => {
96+
mockContext.getWebhookName.mockReturnValue('default');
97+
mockContext.getHeaderData.mockReturnValue({});
98+
99+
await expect(validateAuth(mockContext)).rejects.toThrow(ChatTriggerAuthorizationError);
100+
await expect(validateAuth(mockContext)).rejects.toMatchObject({
101+
responseCode: 401,
102+
message: 'User not authenticated!',
103+
});
104+
});
105+
106+
it('should throw 401 when cookie has a fake/invalid token', async () => {
107+
mockContext.getWebhookName.mockReturnValue('default');
108+
mockContext.getHeaderData.mockReturnValue({
109+
cookie: 'n8n-auth=anything',
110+
});
111+
mockContext.validateCookieAuth.mockRejectedValue(new Error('Unauthorized'));
112+
113+
await expect(validateAuth(mockContext)).rejects.toThrow(ChatTriggerAuthorizationError);
114+
await expect(validateAuth(mockContext)).rejects.toMatchObject({
115+
responseCode: 401,
116+
message: 'Invalid authentication token',
117+
});
118+
});
119+
120+
it('should throw 401 when validateCookieAuth rejects (revoked token)', async () => {
121+
mockContext.getWebhookName.mockReturnValue('default');
122+
mockContext.getHeaderData.mockReturnValue({
123+
cookie: 'n8n-auth=some.revoked.token',
124+
});
125+
mockContext.validateCookieAuth.mockRejectedValue(new Error('Unauthorized'));
126+
127+
await expect(validateAuth(mockContext)).rejects.toThrow(ChatTriggerAuthorizationError);
128+
await expect(validateAuth(mockContext)).rejects.toMatchObject({
129+
responseCode: 401,
130+
message: 'Invalid authentication token',
131+
});
132+
});
133+
134+
it('should pass with a valid token', async () => {
135+
mockContext.getWebhookName.mockReturnValue('default');
136+
mockContext.getHeaderData.mockReturnValue({
137+
cookie: 'n8n-auth=valid.jwt.token',
138+
});
139+
mockContext.validateCookieAuth.mockResolvedValue(undefined);
140+
141+
await expect(validateAuth(mockContext)).resolves.toBeUndefined();
142+
expect(mockContext.validateCookieAuth).toHaveBeenCalledWith('valid.jwt.token');
143+
});
144+
145+
it('should pass when cookie has other cookies alongside n8n-auth', async () => {
146+
mockContext.getWebhookName.mockReturnValue('default');
147+
mockContext.getHeaderData.mockReturnValue({
148+
cookie: 'other=value; n8n-auth=valid.jwt.token; another=thing',
149+
});
150+
mockContext.validateCookieAuth.mockResolvedValue(undefined);
151+
152+
await expect(validateAuth(mockContext)).resolves.toBeUndefined();
153+
expect(mockContext.validateCookieAuth).toHaveBeenCalledWith('valid.jwt.token');
154+
});
155+
});
156+
});

‎packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/__test__/templates.test.ts‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ describe('ChatTrigger Templates Security', () => {
1515
allowedFilesMimeTypes: '',
1616
customCss: '',
1717
enableStreaming: false,
18+
initialMessages: '',
1819
};
1920

2021
describe('XSS Prevention in initialMessages', () => {
@@ -213,6 +214,54 @@ describe('ChatTrigger Templates Security', () => {
213214
});
214215
});
215216

217+
describe('XSS Prevention in allowedFilesMimeTypes', () => {
218+
it('should prevent script injection through allowedFilesMimeTypes', () => {
219+
const maliciousInput = '</script><script>alert(document.cookie)</script>';
220+
221+
const result = createPage({
222+
...defaultParams,
223+
allowFileUploads: true,
224+
allowedFilesMimeTypes: maliciousInput,
225+
});
226+
227+
expect(result).not.toContain('<script>alert(document.cookie)</script>');
228+
expect(result).not.toContain('</script><script>');
229+
expect(result).not.toContain('alert(document.cookie)');
230+
});
231+
232+
it('should sanitize common XSS payloads in allowedFilesMimeTypes', () => {
233+
const xssPayloads = [
234+
{ input: '<img src=x onerror=alert(1)>', dangerous: ['onerror=', '<img'] },
235+
{ input: '<svg onload=alert(1)>', dangerous: ['onload=', '<svg'] },
236+
{ input: 'javascript:alert(1)', dangerous: ['javascript:'] },
237+
];
238+
239+
xssPayloads.forEach(({ input, dangerous }) => {
240+
const result = createPage({
241+
...defaultParams,
242+
allowFileUploads: true,
243+
allowedFilesMimeTypes: input,
244+
});
245+
246+
dangerous.forEach((dangerousContent) => {
247+
expect(result).not.toContain(dangerousContent);
248+
});
249+
});
250+
});
251+
252+
it('should preserve legitimate MIME types', () => {
253+
const legitimateMimeTypes = 'image/*,text/plain,application/pdf';
254+
255+
const result = createPage({
256+
...defaultParams,
257+
allowFileUploads: true,
258+
allowedFilesMimeTypes: legitimateMimeTypes,
259+
});
260+
261+
expect(result).toContain(legitimateMimeTypes);
262+
});
263+
});
264+
216265
describe('getSanitizedInitialMessages function', () => {
217266
it('should sanitize XSS payloads', () => {
218267
const maliciousInput = '</script>"%09<script>alert(document.cookie)</script>';

‎packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/templates.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ export function createPage({
7777
: 'none';
7878
const sanitizedShowWelcomeScreen = !!showWelcomeScreen;
7979
const sanitizedAllowFileUploads = !!allowFileUploads;
80-
const sanitizedAllowedFilesMimeTypes = allowedFilesMimeTypes?.toString() ?? '';
80+
const sanitizedAllowedFilesMimeTypes = sanitizeUserInput(allowedFilesMimeTypes?.toString() ?? '');
8181
const sanitizedCustomCss = sanitizeHtml(`<style>${customCss?.toString() ?? ''}</style>`, {
8282
allowedTags: ['style'],
8383
allowedAttributes: false,

‎packages/@n8n/task-runner-python/src/constants.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@
156156
"obj",
157157
"__thisclass__",
158158
"__self_class__",
159+
"__objclass__",
159160
# introspection attributes
160161
"__base__",
161162
"__class__",

0 commit comments

Comments
 (0)