Skip to content

Chore/allow axios node fetch #5264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HenryHengZJ merged 6 commits into from
Sep 28, 2025
Merged

Chore/allow axios node fetch #5264

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
10aa58e
disable available dependencies by default, only allow when ALLOW_BUIL…
HenryHengZJ Sep 18, 2025
6a28167
Merge branch 'main' into chore/Allow-Built-In-Dep
HenryHengZJ Sep 28, 2025
7f93ab9
update contributing.md
HenryHengZJ Sep 28, 2025
8972cf8
update pnpm lock
HenryHengZJ Sep 28, 2025
db4eb05
Enhance security by adding secure wrappers for Axios and Node Fetch i…
HenryHengZJ Sep 28, 2025
9402ed3
Fix formatting in pnpm-lock.yaml
HenryHengZJ Sep 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 36 additions & 7 deletions packages/components/src/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ import { TextSplitter } from 'langchain/text_splitter'
import { DocumentLoader } from 'langchain/document_loaders/base'
import { NodeVM } from '@flowiseai/nodevm'
import { Sandbox } from '@e2b/code-interpreter'
import { secureFetch, checkDenyList } from './httpSecurity'
import { secureFetch, checkDenyList, secureAxiosRequest } from './httpSecurity'
import JSON5 from 'json5'

export const numberOrExpressionRegex = '^(\\d+\\.?\\d*|{{.*}})$' //return true if string consists only numbers OR expression {{}}
Expand Down Expand Up @@ -85,7 +85,6 @@ export const availableDependencies = [
'@upstash/redis',
'@zilliz/milvus2-sdk-node',
'apify-client',
'axios',
'cheerio',
'chromadb',
'cohere-ai',
Expand All @@ -103,10 +102,8 @@ export const availableDependencies = [
'linkifyjs',
'lunary',
'mammoth',
'moment',
'mongodb',
'mysql2',
'node-fetch',
'node-html-markdown',
'notion-to-md',
'openai',
Expand All @@ -122,6 +119,8 @@ export const availableDependencies = [
'weaviate-ts-client'
]

const defaultAllowExternalDependencies = ['axios', 'moment', 'node-fetch']

export const defaultAllowBuiltInDep = [
'assert',
'buffer',
Expand Down Expand Up @@ -1547,14 +1546,44 @@ export const executeJavaScriptCode = async (
? defaultAllowBuiltInDep.concat(process.env.TOOL_FUNCTION_BUILTIN_DEP.split(','))
: defaultAllowBuiltInDep
const externalDeps = process.env.TOOL_FUNCTION_EXTERNAL_DEP ? process.env.TOOL_FUNCTION_EXTERNAL_DEP.split(',') : []
const deps = process.env.ALLOW_BUILTIN_DEP === 'true' ? availableDependencies.concat(externalDeps) : externalDeps
let deps = process.env.ALLOW_BUILTIN_DEP === 'true' ? availableDependencies.concat(externalDeps) : externalDeps
deps.push(...defaultAllowExternalDependencies)
deps = [...new Set(deps)]

// Create secure wrappers for HTTP libraries
const secureWrappers: ICommonObject = {}

// Axios
const secureAxiosWrapper = async (config: any) => {
return await secureAxiosRequest(config)
}
secureAxiosWrapper.get = async (url: string, config: any = {}) => secureAxiosWrapper({ ...config, method: 'GET', url })
secureAxiosWrapper.post = async (url: string, data: any, config: any = {}) =>
secureAxiosWrapper({ ...config, method: 'POST', url, data })
secureAxiosWrapper.put = async (url: string, data: any, config: any = {}) =>
secureAxiosWrapper({ ...config, method: 'PUT', url, data })
secureAxiosWrapper.delete = async (url: string, config: any = {}) => secureAxiosWrapper({ ...config, method: 'DELETE', url })
secureAxiosWrapper.patch = async (url: string, data: any, config: any = {}) =>
secureAxiosWrapper({ ...config, method: 'PATCH', url, data })

secureWrappers['axios'] = secureAxiosWrapper

// Node Fetch
const secureNodeFetch = async (url: string, options: any = {}) => {
return await secureFetch(url, options)
}
secureWrappers['node-fetch'] = secureNodeFetch

const defaultNodeVMOptions: any = {
console: 'inherit',
sandbox,
require: {
external: { modules: deps },
builtin: builtinDeps
external: {
modules: deps,
transitive: false // Prevent transitive dependencies
},
builtin: builtinDeps,
mock: secureWrappers // Replace HTTP libraries with secure wrappers
},
eval: false,
wasm: false,
Expand Down