admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-18 10:31:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(n8n Form Node): Add html table tags to allowedTags, CSP headers on form completion, free text sanitization removed (#19446)

Browse Source
This commit is contained in:
Michael Kret
2025-09-16 10:31:23 +03:00
committed by GitHub
parent fe9af0b753
commit 7ea920dbe7
5 changed files with 296 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
packages/nodes-base/nodes/Form/utils/formCompletionUtils.ts
View File

@@ -10,6 +10,9 @@ import {
import { sanitizeCustomCss, sanitizeHtml } from './utils';
const SANDBOX_CSP =
'sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-presentation allow-scripts allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols';
const getBinaryDataFromNode = (context: IWebhookFunctions, nodeName: string): IDataObject => {
return context.evaluateExpression(`{{ $('${nodeName}').first().binary }}`) as IDataObject;
};
@@ -52,7 +55,7 @@ export const renderFormCompletion = async (
formTitle: string;
customCss?: string;
};
const responseText = context.getNodeParameter('responseText', '') as string;
const responseText = (context.getNodeParameter('responseText', '') as string) ?? '';
const binary =
context.getNodeParameter('respondWith', '') === 'returnBinary'
? await binaryResponse(context)
@@ -66,12 +69,13 @@ export const renderFormCompletion = async (
`{{ $('${trigger?.name}').params.options?.appendAttribution === false ? false : true }}`,
) as boolean;
res.setHeader('Content-Security-Policy', SANDBOX_CSP);
res.render('form-trigger-completion', {
title: completionTitle,
message: sanitizeHtml(completionMessage),
formTitle: title,
appendAttribution,
responseText: sanitizeHtml(responseText),
responseText,
responseBinary: encodeURIComponent(JSON.stringify(binary)),
dangerousCustomCss: sanitizeCustomCss(options.customCss),
redirectUrl,