langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-22 12:36:14 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #23976] fix(workflow): correct secret variable handling on restore and edit #30461

New Issue
Open
opened 2026-02-21 20:47:32 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:47:32 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/23976

State: open
Merged: No

Important

  1. Make sure you have read our contribution guidelines
  2. Ensure there is an associated issue and you have been assigned to it
  3. Use the correct syntax to link this PR: Fixes #<issue number>.

fix #23975

Summary

This PR implements a robust and secure mechanism for managing secret type environment variables within the workflow, addressing several critical bugs related to version restoration and editing.

Motivation & Context:

Previously, handling of secret variables was flawed in two major ways:

  1. Version Restore Corruption: When restoring a historical workflow version, the API would provide a masked secret value. The frontend would then attempt to save this masked value back to the draft, leading to a corrupted and unusable secret.
  2. UI Plaintext Leak: When a user edited a secret, a UI race condition would cause the new plaintext value to be briefly displayed on the screen before being masked. This was a security concern.

This PR completely overhauls the logic to resolve these issues, ensuring a secure and intuitive user experience.

Key Changes:

  • Backend (/api):

    • The WorkflowDraftApi has been updated to accept a new from_version field for environment variables.
    • The WorkflowService now contains logic to securely retrieve the original encrypted secret from a specified historical version using the from_version and id references, completely bypassing the need to handle plaintext secrets during restoration.
    • All related Python linter errors (E501) and NameError/AttributeError bugs discovered during development have been fixed.

  • Frontend (/web):

    • A new state, restoredSecretsInfo, has been added to the workflowStore to track the origin of restored secrets.
    • The useNodesSyncDraft hook has been refactored. It now constructs a payload with the from_version instruction when a restored secret is saved.
    • The EnvPanel component's state management (handleSave) has been significantly improved to perform atomic updates, which resolves the plaintext UI leak and correctly handles the data flow for both restored and manually edited secrets.
    • All related frontend type errors and dependency issues have been resolved.

This comprehensive fix ensures that restoring and editing secret variables is now both secure (no plaintext exposure) and reliable.

Screenshots

| Before (Buggy Behavior) | After (Successful Restore & Edit) |
|iShot_2025-08-14_15 21 53|iShot_2025-08-14_15 19 19|

https://github.com/user-attachments/assets/57359c7e-fd87-4c74-aaf6-5a1eae7ca565

Checklist

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • [] I've updated the documentation accordingly.
  • [] I ran dev/reformat(backend) and cd web && npx lint-staged(frontend) to appease the lint gods
**Original Pull Request:** https://github.com/langgenius/dify/pull/23976 **State:** open **Merged:** No --- > [!IMPORTANT] > > 1. Make sure you have read our [contribution guidelines](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) > 2. Ensure there is an associated issue and you have been assigned to it > 3. Use the correct syntax to link this PR: `Fixes #<issue number>`. fix #23975 ## Summary This PR implements a robust and secure mechanism for managing `secret` type environment variables within the workflow, addressing several critical bugs related to version restoration and editing. **Motivation & Context:** Previously, handling of secret variables was flawed in two major ways: 1. **Version Restore Corruption**: When restoring a historical workflow version, the API would provide a masked secret value. The frontend would then attempt to save this masked value back to the draft, leading to a corrupted and unusable secret. 2. **UI Plaintext Leak**: When a user edited a secret, a UI race condition would cause the new plaintext value to be briefly displayed on the screen before being masked. This was a security concern. This PR completely overhauls the logic to resolve these issues, ensuring a secure and intuitive user experience. **Key Changes:** * **Backend (`/api`)**: * The `WorkflowDraftApi` has been updated to accept a new `from_version` field for environment variables. * The `WorkflowService` now contains logic to securely retrieve the original encrypted secret from a specified historical version using the `from_version` and `id` references, completely bypassing the need to handle plaintext secrets during restoration. * All related Python linter errors (`E501`) and `NameError`/`AttributeError` bugs discovered during development have been fixed. * **Frontend (`/web`)**: * A new state, `restoredSecretsInfo`, has been added to the `workflowStore` to track the origin of restored secrets. * The `useNodesSyncDraft` hook has been refactored. It now constructs a payload with the `from_version` instruction when a restored secret is saved. * The `EnvPanel` component's state management (`handleSave`) has been significantly improved to perform atomic updates, which resolves the plaintext UI leak and correctly handles the data flow for both restored and manually edited secrets. * All related frontend type errors and dependency issues have been resolved. This comprehensive fix ensures that restoring and editing secret variables is now both secure (no plaintext exposure) and reliable. ## Screenshots | Before (Buggy Behavior) | After (Successful Restore & Edit) | |<img width="421" height="626" alt="iShot_2025-08-14_15 21 53" src="https://github.com/user-attachments/assets/24e8bf07-19b0-4f9d-8b21-b6976ddb0589" />|<img width="440" height="693" alt="iShot_2025-08-14_15 19 19" src="https://github.com/user-attachments/assets/63bdb09a-4c34-4968-8746-902fd798b013" />| https://github.com/user-attachments/assets/57359c7e-fd87-4c74-aaf6-5a1eae7ca565 ## Checklist - [ ] This change requires a documentation update, included: [Dify Document](https://github.com/langgenius/dify-docs) - [x] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [] I've updated the documentation accordingly. - [] I ran `dev/reformat`(backend) and `cd web && npx lint-staged`(frontend) to appease the lint gods
yindo added the pull-request label 2026-02-21 20:47:32 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#30461
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?