chore(core): Add DTOs for workflow create / update validation #23935
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This comment has been minimized.
This comment has been minimized.
|
E2E Tests: n8n tests passed after 9m 21.7s Run Details
Groups
This message was posted automatically by
currents.dev | Integration Settings
|
n8n-assistant
bot
added
core
guillaumejacquart
force-pushed
the
pay-4382-mass-assignment-in-workflow-creation-allows-tampering-with
branch
2 times, most recently
from
bafa852 to
7812c2f
Compare
This comment has been minimized.
This comment has been minimized.
guillaumejacquart
force-pushed
the
pay-4382-mass-assignment-in-workflow-creation-allows-tampering-with
branch
from
e4f16f2 to
902e434
Compare
guillaumejacquart
requested review from
geemanjs and
konstantintieber
and removed request for
geemanjs and
konstantintieber
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 7 files
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="packages/@n8n/api-types/src/dto/workflows/base-workflow.dto.ts">
<violation number="1" location="packages/@n8n/api-types/src/dto/workflows/base-workflow.dto.ts:21">
P2: Validator accepts arrays when it should only accept plain objects. In JavaScript, `typeof [] === 'object'` returns `true`, so arrays will pass this validation despite the message stating 'Connections must be an object'. Add `&& !Array.isArray(val)` to reject arrays.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
konstantintieber
approved these changes
Jan 7, 2026
| throw new BadRequestError('Invalid timeSavedMode'); | ||
| } | ||
|
|
||
| // Security: Object.assign is now safe because the DTO validates and filters all input |
Contributor
There was a problem hiding this comment.
Nit: I think it's good to remind other readers that Object.assign is only safe here because of the Dto schemas. I would consider shorting it to a single line comment like:
Object.assign is safe because the body provided by the user is validated against the UpdateWorkflowDto
in both methods mainly for readibility.
| expect(createdWorkflow?.activeVersionId).toBeNull(); | ||
| }); | ||
|
|
||
| test('should always create workflow as inactive regardless of active flag', async () => { |
Contributor
There was a problem hiding this comment.
Great job on these unit tests 👍
| description: 'billing bypass', | ||
| assertionType: 'exact' as const, | ||
| }, | ||
| { |
Contributor
There was a problem hiding this comment.
Nice us of parameterized tests 💅
guillaumejacquart
deleted the
pay-4382-mass-assignment-in-workflow-creation-allows-tampering-with
branch
Contributor
|
Got released with |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements new DTOs for workflow creation and update, to make sure that user cannot forge a request containing fields that should be updated only internally (like triggerCount, versionCounter, or shared fields)
Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/PAY-4382/mass-assignment-in-workflow-creation-allows-tampering-with-internal
Review / Merge checklist
release/backport(if the PR is an urgent fix that needs to be backported)