FlowiseAI/Flowise
1
0
Fork 0
mirror of https://github.com/FlowiseAI/Flowise.git synced 2026-10-12 02:02:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: flowise-766 (#6709)

Browse Source
This commit is contained in:
Ilango
2026-08-07 10:37:30 +05:30
committed by GitHub
parent 269a493712
commit f20d0941da
4 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/.env.example
+4 -1
View File
@@ -41,7 +41,10 @@ PORT=3000
# LOG_SANITIZE_BODY_FIELDS=password,pwd,pass,secret,token,apikey,api_key,accesstoken,access_token,refreshtoken,refresh_token,clientsecret,client_secret,privatekey,private_key,secretkey,secret_key,auth,authorization,credential,credentials
# LOG_SANITIZE_HEADER_FIELDS=authorization,x-api-key,x-auth-token,cookie
# TOOL_FUNCTION_BUILTIN_DEP=crypto,fs
# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash,pg,mysql2,mongodb,ioredis,redis,typeorm,puppeteer,playwright,@zilliz/milvus2-sdk-node
# WARNING: never add puppeteer or playwright here (or to ALLOW_BUILTIN_DEP) - their launch() APIs pass
# caller-controlled executablePath/args straight into child_process.spawn, giving sandboxed JS full OS
# command execution, and their file:// page navigation allows arbitrary host file read.
# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash,pg,mysql2,mongodb,ioredis,redis,typeorm,@zilliz/milvus2-sdk-node
# ALLOW_BUILTIN_DEP=false
docker/worker/.env.example
+4 -1
View File
@@ -41,7 +41,10 @@ WORKER_PORT=5566
# LOG_SANITIZE_BODY_FIELDS=password,pwd,pass,secret,token,apikey,api_key,accesstoken,access_token,refreshtoken,refresh_token,clientsecret,client_secret,privatekey,private_key,secretkey,secret_key,auth,authorization,credential,credentials
# LOG_SANITIZE_HEADER_FIELDS=authorization,x-api-key,x-auth-token,cookie
# TOOL_FUNCTION_BUILTIN_DEP=crypto,fs
# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash,pg,mysql2,mongodb,ioredis,redis,typeorm,puppeteer,playwright,@zilliz/milvus2-sdk-node
# WARNING: never add puppeteer or playwright here (or to ALLOW_BUILTIN_DEP) - their launch() APIs pass
# caller-controlled executablePath/args straight into child_process.spawn, giving sandboxed JS full OS
# command execution, and their file:// page navigation allows arbitrary host file read.
# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash,pg,mysql2,mongodb,ioredis,redis,typeorm,@zilliz/milvus2-sdk-node
# ALLOW_BUILTIN_DEP=false
packages/components/src/utils.ts
+3
View File
@@ -51,6 +51,9 @@ if (USE_AWS_SECRETS_MANAGER) {
/*
* List of dependencies allowed to be import in @flowiseai/nodevm
*
* Do NOT add 'puppeteer' or 'playwright' here (or via TOOL_FUNCTION_EXTERNAL_DEP): their launch()
* APIs forward executablePath/args to child_process.spawn, which is a sandbox escape.
*/
export const availableDependencies = [
'@aws-sdk/client-bedrock-runtime',
packages/server/.env.example
+4 -1
View File
@@ -41,7 +41,10 @@ PORT=3000
# LOG_SANITIZE_BODY_FIELDS=password,pwd,pass,secret,token,apikey,api_key,accesstoken,access_token,refreshtoken,refresh_token,clientsecret,client_secret,privatekey,private_key,secretkey,secret_key,auth,authorization,credential,credentials
# LOG_SANITIZE_HEADER_FIELDS=authorization,x-api-key,x-auth-token,cookie
# TOOL_FUNCTION_BUILTIN_DEP=crypto,fs
# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash,pg,mysql2,mongodb,ioredis,redis,typeorm,puppeteer,playwright,@zilliz/milvus2-sdk-node
# WARNING: never add puppeteer or playwright here (or to ALLOW_BUILTIN_DEP) - their launch() APIs pass
# caller-controlled executablePath/args straight into child_process.spawn, giving sandboxed JS full OS
# command execution, and their file:// page navigation allows arbitrary host file read.
# TOOL_FUNCTION_EXTERNAL_DEP=moment,lodash,pg,mysql2,mongodb,ioredis,redis,typeorm,@zilliz/milvus2-sdk-node
# ALLOW_BUILTIN_DEP=false