langgenius/dify-sandbox
1
0
Fork 0
mirror of https://github.com/langgenius/dify-sandbox.git synced 2026-07-25 21:46:12 -04:00
Code Issues 103 Packages Projects Releases 10 Wiki Activity

[PR #140] [MERGED] feat: prevent nodejs code injection #178

New Issue
Closed
opened 2026-02-16 09:19:46 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 09:19:46 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langgenius/dify-sandbox/pull/140
Author: @Yeuoly
Created: 3/24/2025
Status: ✅ Merged
Merged: 3/24/2025
Merged by: @Yeuoly

Base: main ← Head: fix/nodejs-code-injection

📝 Commits (4)

  • 2ec2e26 feat: enhance Node.js runner security by encoding code in base64 to prevent code injection
  • 0489c65 chore: squash system dependencies installation steps
  • 7ddc12e bump koffi
  • bd3fd35 fix: tests logics

📊 Changes

66 files changed (+1362 additions, -1386 deletions)

View changed files

📝 docker/amd64-test/dockerfile (+4 -4)
📝 docker/amd64/dockerfile (+4 -4)
📝 docker/arm64-test/dockerfile (+4 -4)
📝 docker/arm64/dockerfile (+4 -4)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/.package-lock.json (+4 -4)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/CHANGELOG.md (+117 -40)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/README.md (+6 -0)
➖ internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_arm32hf/koffi.node (+0 -0)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_arm64/koffi.node (+0 -0)
➕ internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_armhf/koffi.node (+0 -0)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_ia32/koffi.node (+0 -0)
➕ internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_riscv64/koffi.node (+0 -0)
➖ internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_riscv64hf64/koffi.node (+0 -0)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_x64/koffi.node (+0 -0)
➕ internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/musl_x64/koffi.node (+0 -0)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/index.d.ts (+2 -1)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/index.js (+179 -136)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/indirect.js (+130 -118)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/package.json (+4 -2)
📝 internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/src/cnoke/assets/FindCNoke.cmake (+16 -3)

...and 46 more files

📄 Description

FIXES NODEJS CODE INJECTION

extra codes may be executed in nodejs runtime, as function could be re-implemented to hijack code flows and execute untrusted code before setup seccomp

PoC was placed at tests

FIX

ALL untrusted codes were encoded by base64 and executed by eval(Buffer.from(code, 'base64')) after seccomp was ready

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langgenius/dify-sandbox/pull/140 **Author:** [@Yeuoly](https://github.com/Yeuoly) **Created:** 3/24/2025 **Status:** ✅ Merged **Merged:** 3/24/2025 **Merged by:** [@Yeuoly](https://github.com/Yeuoly) **Base:** `main` ← **Head:** `fix/nodejs-code-injection` --- ### 📝 Commits (4) - [`2ec2e26`](https://github.com/langgenius/dify-sandbox/commit/2ec2e26d94dd388ca57a9c66752651826adae8fa) feat: enhance Node.js runner security by encoding code in base64 to prevent code injection - [`0489c65`](https://github.com/langgenius/dify-sandbox/commit/0489c6566082227a4a115ca24fea7752d5eeb85f) chore: squash system dependencies installation steps - [`7ddc12e`](https://github.com/langgenius/dify-sandbox/commit/7ddc12ecf715e54b7c6740d829f3edffe0afe24c) bump koffi - [`bd3fd35`](https://github.com/langgenius/dify-sandbox/commit/bd3fd35e0d16a1fd0edac12a828ab11a5b943988) fix: tests logics ### 📊 Changes **66 files changed** (+1362 additions, -1386 deletions) <details> <summary>View changed files</summary> 📝 `docker/amd64-test/dockerfile` (+4 -4) 📝 `docker/amd64/dockerfile` (+4 -4) 📝 `docker/arm64-test/dockerfile` (+4 -4) 📝 `docker/arm64/dockerfile` (+4 -4) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/.package-lock.json` (+4 -4) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/CHANGELOG.md` (+117 -40) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/README.md` (+6 -0) ➖ `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_arm32hf/koffi.node` (+0 -0) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_arm64/koffi.node` (+0 -0) ➕ `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_armhf/koffi.node` (+0 -0) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_ia32/koffi.node` (+0 -0) ➕ `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_riscv64/koffi.node` (+0 -0) ➖ `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_riscv64hf64/koffi.node` (+0 -0) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/linux_x64/koffi.node` (+0 -0) ➕ `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/build/koffi/musl_x64/koffi.node` (+0 -0) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/index.d.ts` (+2 -1) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/index.js` (+179 -136) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/indirect.js` (+130 -118) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/package.json` (+4 -2) 📝 `internal/core/runner/nodejs/dependens/node_temp/node_modules/koffi/src/cnoke/assets/FindCNoke.cmake` (+16 -3) _...and 46 more files_ </details> ### 📄 Description ## FIXES NODEJS CODE INJECTION extra codes may be executed in nodejs runtime, as function could be re-implemented to hijack code flows and execute untrusted code before setup seccomp PoC was placed at `tests` ## FIX ALL untrusted codes were encoded by base64 and executed by `eval(Buffer.from(code, 'base64'))` after seccomp was ready --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-16 09:19:46 -05:00
yindo closed this issue 2026-02-16 09:19:46 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify-sandbox#178
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?