bugfix:308 | remove ungated overrideConfig spread (#6279)

* fix(server): remove ungated overrideConfig spread into flowConfig/flowData

The spread allowed API callers to inject arbitrary keys into the $flow.*
template namespace — bypassing the per-parameter gating that
replaceInputsWithConfig() enforces. Properly gated override paths
(replaceInputsWithConfig, $vars) are unaffected.

Closes FLOWISE-308

* added chatflowId and apiMessageId into flowData in buildFlow

packages/server/src/utils/buildAgentflow.ts

@@ -1134,8 +1134,7 @@ const executeNode = async ({
             apiMessageId,
             chatHistory,
             runtimeChatHistoryLength: Math.max(0, runtimeChatHistory.length - 1),
-            state: updatedState,
-            ...overrideConfig
+            state: updatedState
         }
         if (
             iterationContext &&

packages/server/src/utils/buildChatflow.ts

@@ -562,8 +562,7 @@ export const executeFlow = async ({
         chatId,
         sessionId,
         chatHistory,
-        apiMessageId,
-        ...incomingInput.overrideConfig
+        apiMessageId
     }
 
     logger.debug(`[server]: [${orgId}]: Start building flow ${chatflowid}`)

packages/server/src/utils/index.ts

@@ -568,10 +568,11 @@ export const buildFlow = async ({
 
     const flowData: ICommonObject = {
         chatflowid,
+        chatflowId: chatflowid,
         chatId,
         sessionId,
         chatHistory,
-        ...overrideConfig
+        apiMessageId
     }
     while (nodeQueue.length) {
         const { nodeId, depth } = nodeQueue.shift() as INodeQueue