Skip to content

fix: flowise-317 #6168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HenryHengZJ merged 3 commits into from
Apr 9, 2026
Merged

fix: flowise-317 #6168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a77bc2e
fix: flowise-317
0xi4o Apr 7, 2026
f7478c1
fix: review feedback
0xi4o Apr 7, 2026
1d915d3
fix: add permission check to execute button in custom function node
0xi4o Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions packages/components/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,32 +31,31 @@
"@aws-sdk/client-secrets-manager": "^3.699.0",
"@aws-sdk/client-sns": "^3.699.0",
"@aws-sdk/client-sts": "^3.699.0",
"@azure/storage-blob": "^12.29.0",
"@datastax/astra-db-ts": "1.5.0",
"@dqbd/tiktoken": "^1.0.21",
"@e2b/code-interpreter": "^1.5.1",
"@elastic/elasticsearch": "^8.9.0",
"@elevenlabs/elevenlabs-js": "^2.8.0",
"@flowiseai/nodevm": "^3.9.25",
"@getzep/zep-cloud": "~1.0.7",
"@getzep/zep-js": "^0.9.0",
"@gomomento/sdk": "^1.51.1",
"@gomomento/sdk-core": "^1.51.1",
"@google-ai/generativelanguage": "^2.5.0",
"@google-cloud/storage": "^7.15.2",
"@azure/storage-blob": "^12.29.0",
"@google/generative-ai": "^0.24.0",
"@grpc/grpc-js": "^1.10.10",
"@huggingface/inference": "^4.13.2",
"@ibm-cloud/watsonx-ai": "1.7.7",
"@langchain/anthropic": "1.3.20",
"@langchain/aws": "1.2.2",
"@langchain/baidu-qianfan": "1.0.1",
"@langchain/deepseek": "1.0.9",
"@langchain/classic": "1.0.15",
"@langchain/cloudflare": "1.0.1",
"@langchain/cohere": "1.0.2",
"@langchain/community": "1.1.12",
"@langchain/core": "1.1.20",
"@langchain/deepseek": "1.0.9",
"@langchain/exa": "1.0.1",
"@langchain/google-genai": "2.1.15",
"@langchain/google-vertexai": "2.1.15",
Expand Down Expand Up @@ -171,6 +170,7 @@
"supergateway": "3.0.1",
"typeorm": "^0.3.6",
"uuid": "^10.0.0",
"vm2": "^3.10.5",
Comment thread
0xi4o marked this conversation as resolved.
"weaviate-client": "3.12.0",
"winston": "^3.9.0",
"ws": "^8.18.0",
Expand Down
11 changes: 8 additions & 3 deletions packages/components/src/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ import { GetSecretValueCommand, SecretsManagerClient, SecretsManagerClientConfig
import { customGet } from '../nodes/sequentialagents/commonUtils'
import { TextSplitter } from '@langchain/textsplitters'
import { DocumentLoader } from '@langchain/classic/document_loaders/base'
import { NodeVM } from '@flowiseai/nodevm'
import { NodeVM } from 'vm2'
import { Sandbox } from '@e2b/code-interpreter'
import { secureFetch, checkDenyList, secureAxiosRequest } from './httpSecurity'
import JSON5 from 'json5'
Expand Down Expand Up @@ -1608,13 +1608,18 @@ export const executeJavaScriptCode = async (
} = {}
): Promise<any> => {
const { timeout = 300000, useSandbox = true, streamOutput, libraries = [], nodeVMOptions = {} } = options
const shouldUseSandbox = useSandbox && process.env.E2B_APIKEY
if (useSandbox && !process.env.E2B_APIKEY) {
throw new Error(
'Sandboxed code execution requires E2B_APIKEY to be configured. ' +
'Set E2B_APIKEY in your environment or contact your administrator.'
)
}
Comment thread
0xi4o marked this conversation as resolved.
let timeoutMs = timeout
if (process.env.SANDBOX_TIMEOUT) {
timeoutMs = parseInt(process.env.SANDBOX_TIMEOUT, 10)
}

if (shouldUseSandbox) {
if (useSandbox) {
try {
const variableDeclarations = []

Expand Down
7 changes: 6 additions & 1 deletion packages/server/src/routes/node-custom-functions/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,16 @@
import express from 'express'
import nodesRouter from '../../controllers/nodes'
import { checkAnyPermission } from '../../enterprise/rbac/PermissionCheck'
const router = express.Router()

// CREATE

// READ
router.post('/', nodesRouter.executeCustomFunction)
router.post(
'/',
checkAnyPermission('chatflows:create,chatflows:update,agentflows:create,agentflows:update'),
nodesRouter.executeCustomFunction
)

// UPDATE

Expand Down
12 changes: 12 additions & 0 deletions packages/ui/src/ui-component/button/RBACButtons.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import * as PropTypes from 'prop-types'
import { useAuth } from '@/hooks/useAuth'
import { StyledButton, StyledToggleButton } from '@/ui-component/button/StyledButton'
import { Button, IconButton, ListItemButton, MenuItem, Tab } from '@mui/material'
import { LoadingButton } from '@mui/lab'

export const StyledPermissionButton = ({ permissionId, display, ...props }) => {
const { hasPermission, hasDisplay } = useAuth()
Expand Down Expand Up @@ -73,10 +74,21 @@ export const PermissionListItemButton = ({ permissionId, display, ...props }) =>
return <ListItemButton {...props} />
}

export const PermissionLoadingButton = ({ permissionId, display, ...props }) => {
const { hasPermission, hasDisplay } = useAuth()

if (!hasPermission(permissionId) || !hasDisplay(display)) {
return null
}

return <LoadingButton {...props} />
}

StyledPermissionButton.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
StyledPermissionToggleButton.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
PermissionIconButton.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
PermissionButton.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
PermissionTab.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
PermissionMenuItem.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
PermissionListItemButton.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
PermissionLoadingButton.propTypes = { permissionId: PropTypes.string, display: PropTypes.array }
7 changes: 4 additions & 3 deletions packages/ui/src/ui-component/dialog/ExpandTextDialog.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@ import PerfectScrollbar from 'react-perfect-scrollbar'
// MUI
import { Button, Dialog, DialogActions, DialogContent, Typography } from '@mui/material'
import { useTheme } from '@mui/material/styles'
import { LoadingButton } from '@mui/lab'

// Project Import
import { StyledButton } from '@/ui-component/button/StyledButton'
import { PermissionLoadingButton } from '@/ui-component/button/RBACButtons'
import { CodeEditor } from '@/ui-component/editor/CodeEditor'

// Store
Expand Down Expand Up @@ -147,7 +147,8 @@ const ExpandTextDialog = ({ show, dialogProps, onCancel, onInputHintDialogClicke
)}
</div>
{languageType === 'js' && !inputParam.hideCodeExecute && (
<LoadingButton
<PermissionLoadingButton
permissionId='chatflows:create,chatflows:update,agentflows:create,agentflows:update'
sx={{
mt: 2,
'&:hover': {
Expand All @@ -169,7 +170,7 @@ const ExpandTextDialog = ({ show, dialogProps, onCancel, onInputHintDialogClicke
}}
>
Execute
</LoadingButton>
</PermissionLoadingButton>
)}
{codeExecutedResult && (
<div style={{ marginTop: '15px' }}>
Expand Down
Loading
Loading