fix(workflow): sanitize newlines in HTTP node key-value fields - #39650
Open
SpiliosDimakopoulos wants to merge 10 commits into
Open
fix(workflow): sanitize newlines in HTTP node key-value fields#39650SpiliosDimakopoulos wants to merge 10 commits into
SpiliosDimakopoulos wants to merge 10 commits into
Conversation
…ΘΜΟ>) 'Runing docker container' -> 'Running docker container'.
…ΘΜΟΣ>) ar-SA: unescape the quick-start-guide link and point it at the real heading slug (#البداية-السريعة). hi-IN: point the community link at the real bilingual heading slug (#समुदाय-और-संपर्क-community--contact). Verified both slugs with github-slugger.
validate_credentials() -> _get_request() called httpx.get() with no explicit timeout, unlike the Jina/Firecrawl/Nacos/Marketplace auth providers which were recently hardened with bounded httpx.Timeout values. A slow or hanging WaterCrawl endpoint could block the worker indefinitely during credential validation. Updated the existing unit test to assert the new timeout kwarg.
The HTTP node's header/param editor reuses PromptEditor, the same rich multi-line component used for prompt templates, so nothing stops a literal newline from being typed or pasted into a value. But rows are serialized as a single newline-delimited string in use-key-value-list.ts (stringifyList joins with '\n', strToKeyValueList splits on '\n'), so an embedded newline gets mistaken for a row separator and corrupts the list on the next parse. Added sanitizeKeyValueField, which collapses any \r\n sequences to a single space before the value reaches storage. Newlines aren't valid in HTTP header/param values regardless. fixes #<ISSUE_NUMBER>
SpiliosDimakopoulos
requested review from
QuantumGhost,
crazywoola,
iamjoel,
laipz8200 and
zxhlyh
as code owners
July 27, 2026 11:06
dosubot
Bot
added
the
size:M
Contributor
Pyrefly Type Coverage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The HTTP request node's header/param editor uses PromptEditor — the same rich multi-line component used for prompt templates — so nothing prevents a literal newline from being typed (Enter) or pasted into a header/param value.
However, rows are serialized internally as a single newline-delimited string (
hooks/use-key-value-list.ts:stringifyListjoins rows with\n,strToKeyValueListsplits on\n). An embedded newline inside a value gets mistaken for a row separator on the next parse, splitting/corrupting that row.Added
sanitizeKeyValueField(innodes/http/utils.ts) to collapse any\r\nsequences to a single space before the value reaches storage — newlines aren't valid in HTTP header/param values anyway. Applied at the point of change inkey-value-edit/item.tsx. Added unit tests covering plain values, embedded\n, CRLF, repeated newlines, all-newline input, and empty string.