langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Dangerous code，This doesn't seem to have been intercepted? #7123

New Issue
Closed
opened 2026-02-21 18:19:01 -05:00 by yindo · 7 comments
yindo commented 2026-02-21 18:19:01 -05:00
Owner
Copy Link
Copy Source

Originally created by @wwh-coder on GitHub (Dec 9, 2024).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

0.13.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

I executed the dangerous code and did not intercept it
test

✔️ Expected Behavior

image

❌ Actual Behavior

test
Originally created by @wwh-coder on GitHub (Dec 9, 2024). ### Self Checks - [X] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [X] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [X] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [X] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [X] Please do not modify this template :) and fill in all the required fields. ### Dify version 0.13.0 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce I executed the dangerous code and did not intercept it <img width="808" alt="test" src="https://github.com/user-attachments/assets/1c4065a0-8692-4507-b483-e17784f9a397"> ### ✔️ Expected Behavior ![image](https://github.com/user-attachments/assets/025ee358-e4e9-48cd-9a2e-b08600ff71d3) ### ❌ Actual Behavior <img width="808" alt="test" src="https://github.com/user-attachments/assets/23a70dd0-300b-4640-ab97-d80368993027">
yindo closed this issue 2026-02-21 18:19:02 -05:00
yindo commented 2026-02-21 18:19:02 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 9, 2024):

Hello @wwh-coder! I'm here to help you with any bugs, questions, or contributions. Let's tackle this issue together!

It seems that the security measures in Dify did not intercept the execution of a Python script that accessed the /etc/passwd file, which is a known security risk. Dify is designed to prevent such unauthorized file access through its sandboxing mechanisms and Cloudflare WAF, which should block dangerous code execution attempts [1][2].

Here are a few steps you can take to address this issue:

  1. Verify Sandbox Configuration: Ensure that the sandbox environment is correctly set up and configured. The sandbox should isolate the execution environment and prevent access to sensitive files.

  2. Check Docker Setup: Make sure that the Docker setup for your self-hosted instance is correctly configured, including the sandbox and SSRF proxy services. This setup is crucial for maintaining security [3].

  3. Review Security Rules: Double-check the security rules and filters in place, especially those related to file access permissions. Ensure that the system call whitelists are correctly implemented to block unauthorized access [1].

  4. Cloudflare WAF Configuration: Review the Cloudflare WAF settings to ensure that it is properly configured to intercept and block dangerous operations.

If the issue persists, it might be necessary to further investigate the specific configurations and logs to identify any potential gaps in the security setup.

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other

@dosubot[bot] commented on GitHub (Dec 9, 2024): <!-- Greeting --> Hello @wwh-coder! I'm here to help you with any bugs, questions, or contributions. Let's tackle this issue together! <!-- Answer --> It seems that the security measures in Dify did not intercept the execution of a Python script that accessed the `/etc/passwd` file, which is a known security risk. Dify is designed to prevent such unauthorized file access through its sandboxing mechanisms and Cloudflare WAF, which should block dangerous code execution attempts <sup>[[1]](https://github.com/langgenius/dify-docs/blob/main/en/guides/workflow/node/code.md)</sup><sup>[[2]](https://github.com/langgenius/dify-docs/blob/main/en/development/backend/sandbox/README.md)</sup>. Here are a few steps you can take to address this issue: 1. **Verify Sandbox Configuration**: Ensure that the sandbox environment is correctly set up and configured. The sandbox should isolate the execution environment and prevent access to sensitive files. 2. **Check Docker Setup**: Make sure that the Docker setup for your self-hosted instance is correctly configured, including the sandbox and SSRF proxy services. This setup is crucial for maintaining security <sup>[[3]](https://github.com/langgenius/dify/blob/main/docker/docker-compose.yaml)</sup>. 3. **Review Security Rules**: Double-check the security rules and filters in place, especially those related to file access permissions. Ensure that the system call whitelists are correctly implemented to block unauthorized access <sup>[[1]](https://github.com/langgenius/dify-docs/blob/main/en/guides/workflow/node/code.md)</sup>. 4. **Cloudflare WAF Configuration**: Review the Cloudflare WAF settings to ensure that it is properly configured to intercept and block dangerous operations. If the issue persists, it might be necessary to further investigate the specific configurations and logs to identify any potential gaps in the security setup. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/1a8c66f8-3ea5-4709-bac3-f3c936988215?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/1a8c66f8-3ea5-4709-bac3-f3c936988215?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/1a8c66f8-3ea5-4709-bac3-f3c936988215?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/1a8c66f8-3ea5-4709-bac3-f3c936988215?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/1a8c66f8-3ea5-4709-bac3-f3c936988215?feedback_type=hallucination) | [Other](https://app.dosu.dev/response-feedback/1a8c66f8-3ea5-4709-bac3-f3c936988215?feedback_type=other)</sup>
yindo commented 2026-02-21 18:19:02 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Dec 9, 2024):

Well, you see, you have been blocked by the cloudflare.

@crazywoola commented on GitHub (Dec 9, 2024): Well, you see, you have been blocked by the cloudflare.
yindo commented 2026-02-21 18:19:02 -05:00
Author
Owner
Copy Link
Copy Source

@wwh-coder commented on GitHub (Dec 10, 2024):

thank you! I just started it according to the steps in the document

  1. Prerequisites: Ensure Docker and Docker Compose are installed on your system.
  2. Environment Setup:
  • Navigate to the docker directory.
  • Copy the .env.example file to a new file named .env by running cp .env.example .env.
  • Customize the .env file as needed. Refer to the .env.example file for detailed configuration options.
  1. Running the Services:
  • Execute docker compose up from the docker directory to start the services.
    What do I need to do if I want this effect? Which configuration needs to be modified? Do we still need to achieve it ourselves?
@wwh-coder commented on GitHub (Dec 10, 2024): thank you! I just started it according to the steps in the document 1. **Prerequisites**: Ensure Docker and Docker Compose are installed on your system. 2. **Environment Setup**: - Navigate to the `docker` directory. - Copy the `.env.example` file to a new file named `.env` by running `cp .env.example .env`. - Customize the `.env` file as needed. Refer to the `.env.example` file for detailed configuration options. 3. **Running the Services**: - Execute `docker compose up` from the `docker` directory to start the services. What do I need to do if I want this effect? Which configuration needs to be modified? Do we still need to achieve it ourselves?
yindo commented 2026-02-21 18:19:02 -05:00
Author
Owner
Copy Link
Copy Source

@wwh-coder commented on GitHub (Dec 10, 2024):

@dosu

@wwh-coder commented on GitHub (Dec 10, 2024): @dosu
yindo commented 2026-02-21 18:19:02 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 10, 2024):

To block dangerous code execution, you need to ensure that the code execution environments for Python and JavaScript are strictly isolated (sandboxed). This is already implemented as part of Dify's security policies. The CodeExecutionSandboxConfig class in the configuration file specifies parameters for the code execution sandbox environment, such as maximum allowed numeric values, string lengths, and array lengths, which help prevent dangerous code execution. These environments restrict functions that could consume large system resources or pose security risks, such as accessing the file system, making network requests, or executing OS-level commands. Therefore, you do not need to implement this yourself, as it is already part of the system's security measures [1][2].

If you are deploying locally, ensure that you start a sandbox service using Docker to prevent malicious code execution. You can find specific information about the Sandbox service in the docker-compose.middleware.yaml file and start the service using Docker Compose. This setup ensures that both Python and JavaScript code executors are strictly sandboxed, preventing unauthorized file access, network requests, and execution of OS-level commands [1].

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other

@dosubot[bot] commented on GitHub (Dec 10, 2024): <!-- Answer --> To block dangerous code execution, you need to ensure that the code execution environments for Python and JavaScript are strictly isolated (sandboxed). This is already implemented as part of Dify's security policies. The `CodeExecutionSandboxConfig` class in the configuration file specifies parameters for the code execution sandbox environment, such as maximum allowed numeric values, string lengths, and array lengths, which help prevent dangerous code execution. These environments restrict functions that could consume large system resources or pose security risks, such as accessing the file system, making network requests, or executing OS-level commands. Therefore, you do not need to implement this yourself, as it is already part of the system's security measures <sup>[[1]](https://github.com/langgenius/dify-docs/blob/main/en/guides/workflow/node/code.md)</sup><sup>[[2]](https://github.com/langgenius/dify/blob/main/api/configs/feature/__init__.py)</sup>. If you are deploying locally, ensure that you start a sandbox service using Docker to prevent malicious code execution. You can find specific information about the Sandbox service in the `docker-compose.middleware.yaml` file and start the service using Docker Compose. This setup ensures that both Python and JavaScript code executors are strictly sandboxed, preventing unauthorized file access, network requests, and execution of OS-level commands <sup>[[1]](https://github.com/langgenius/dify-docs/blob/main/en/guides/workflow/node/code.md)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/598e2387-076d-4896-8d4d-579e45dccb61?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/598e2387-076d-4896-8d4d-579e45dccb61?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/598e2387-076d-4896-8d4d-579e45dccb61?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/598e2387-076d-4896-8d4d-579e45dccb61?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/598e2387-076d-4896-8d4d-579e45dccb61?feedback_type=hallucination) | [Other](https://app.dosu.dev/response-feedback/598e2387-076d-4896-8d4d-579e45dccb61?feedback_type=other)</sup>
yindo commented 2026-02-21 18:19:02 -05:00
Author
Owner
Copy Link
Copy Source

@wwh-coder commented on GitHub (Dec 10, 2024):

@dosu Thank you very much!

@wwh-coder commented on GitHub (Dec 10, 2024): @dosu Thank you very much!
yindo commented 2026-02-21 18:19:02 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 10, 2024):

You're welcome! If you have any more questions or need further assistance, feel free to reach out. Happy coding!

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other

@dosubot[bot] commented on GitHub (Dec 10, 2024): <!-- Answer --> You're welcome! If you have any more questions or need further assistance, feel free to reach out. Happy coding! <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/20ef63a3-1096-4410-9b09-cdb28167d741?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/20ef63a3-1096-4410-9b09-cdb28167d741?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/20ef63a3-1096-4410-9b09-cdb28167d741?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/20ef63a3-1096-4410-9b09-cdb28167d741?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/20ef63a3-1096-4410-9b09-cdb28167d741?feedback_type=hallucination) | [Other](https://app.dosu.dev/response-feedback/20ef63a3-1096-4410-9b09-cdb28167d741?feedback_type=other)</sup>
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#7123
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?