admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-17 10:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): Restrict read/write file paths access (#6582)

Browse Source
This commit is contained in:
Michael Kret
2023-07-31 15:20:39 +03:00
committed by GitHub
parent 7cd45885bf
commit f6bf9e9887
8 changed files with 141 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
packages/nodes-base/nodes/WriteBinaryFile/WriteBinaryFile.node.ts
View File

@@ -1,13 +1,12 @@
import type { Readable } from 'stream';
import { BINARY_ENCODING } from 'n8n-workflow';
import type {
IExecuteFunctions,
INodeExecutionData,
INodeType,
INodeTypeDescription,
} from 'n8n-workflow';
import { BINARY_ENCODING } from 'n8n-workflow';
import { writeFile as fsWriteFile } from 'fs/promises';
import type { Readable } from 'stream';
export class WriteBinaryFile implements INodeType {
description: INodeTypeDescription = {
@@ -73,9 +72,10 @@ export class WriteBinaryFile implements INodeType {
const dataPropertyName = this.getNodeParameter('dataPropertyName', itemIndex);
const fileName = this.getNodeParameter('fileName', itemIndex) as string;
const options = this.getNodeParameter('options', 0, {});
const flag = options.append ? 'a' : 'w';
const flag: string = options.append ? 'a' : 'w';
item = items[itemIndex];
@@ -97,7 +97,8 @@ export class WriteBinaryFile implements INodeType {
}
// Write the file to disk
await fsWriteFile(fileName, fileContent, { encoding: 'binary', flag });
// eslint-disable-next-line @typescript-eslint/no-unsafe-call
await this.helpers.writeContentToFile(fileName, fileContent, flag);
if (item.binary !== undefined) {
// Create a shallow copy of the binary data so that the old
@@ -116,7 +117,7 @@ export class WriteBinaryFile implements INodeType {
if (this.continueOnFail()) {
returnData.push({
json: {
error: error.message,
error: (error as Error).message,
},
pairedItem: {
item: itemIndex,