fix(core): Upgrade crypto-js to address CVE-2023-46233 (#7519)

[GH Advisory](GHSA-xwcq-pm8m-c4vf)

packages/core/jest.config.js

@@ -2,4 +2,5 @@
 module.exports = {
 	...require('../../jest.config'),
 	globalSetup: '<rootDir>/test/setup.ts',
+	setupFilesAfterEnv: ['<rootDir>/test/setup-mocks.ts'],
 };

packages/core/package.json

@@ -54,7 +54,7 @@
     "axios": "^0.21.1",
     "concat-stream": "^2.0.0",
     "cron": "~1.7.2",
-    "crypto-js": "^4.1.1",
+    "crypto-js": "^4.2.0",
     "fast-glob": "^3.2.5",
     "file-type": "^16.5.4",
     "flatted": "^3.2.4",

packages/core/src/Cipher.ts

@@ -7,13 +7,15 @@ export class Cipher {
 	constructor(private readonly instanceSettings: InstanceSettings) {}
 
 	encrypt(data: string | object) {
+		const { encryptionKey } = this.instanceSettings;
 		return AES.encrypt(
 			typeof data === 'string' ? data : JSON.stringify(data),
-			this.instanceSettings.encryptionKey,
+			encryptionKey,
 		).toString();
 	}
 
 	decrypt(data: string) {
-		return AES.decrypt(data, this.instanceSettings.encryptionKey).toString(enc.Utf8);
+		const { encryptionKey } = this.instanceSettings;
+		return AES.decrypt(data, encryptionKey).toString(enc.Utf8);
 	}
 }

packages/core/test/Cipher.test.ts

@@ -0,0 +1,30 @@
+import Container from 'typedi';
+import { InstanceSettings } from '@/InstanceSettings';
+import { Cipher } from '@/Cipher';
+import { mockInstance } from './utils';
+
+describe('Cipher', () => {
+	mockInstance(InstanceSettings, { encryptionKey: 'test_key' });
+	const cipher = Container.get(Cipher);
+
+	describe('encrypt', () => {
+		it('should encrypt strings', () => {
+			const encrypted = cipher.encrypt('random-string');
+			const decrypted = cipher.decrypt(encrypted);
+			expect(decrypted).toEqual('random-string');
+		});
+
+		it('should encrypt objects', () => {
+			const encrypted = cipher.encrypt({ key: 'value' });
+			const decrypted = cipher.decrypt(encrypted);
+			expect(decrypted).toEqual('{"key":"value"}');
+		});
+	});
+
+	describe('decrypt', () => {
+		it('should decrypt string', () => {
+			const decrypted = cipher.decrypt('U2FsdGVkX194VEoX27o3+y5jUd1JTTmVwkOKjVhB6Jg=');
+			expect(decrypted).toEqual('random-string');
+		});
+	});
+});

packages/core/test/setup-mocks.ts

@@ -0,0 +1 @@
+import 'reflect-metadata';

packages/workflow/package.json

@@ -51,7 +51,7 @@
     "@n8n/tournament": "^1.0.2",
     "@n8n_io/riot-tmpl": "^4.0.0",
     "ast-types": "0.15.2",
-    "crypto-js": "^4.1.1",
+    "crypto-js": "^4.2.0",
     "deep-equal": "^2.2.0",
     "esprima-next": "5.8.4",
     "form-data": "^4.0.0",