Skip to content

Commit c2bf105

Browse files
christopherholland-workdaychristopherholland-workday
authored
Merge branch 'main' into alert-autofix-84
2 parents 1cdd15d + b44affd commit c2bf105

157 files changed

Lines changed: 8429 additions & 1206 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.eslintrc.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ module.exports = {
1414
}
1515
},
1616
parser: '@typescript-eslint/parser',
17-
ignorePatterns: ['**/node_modules', '**/dist', '**/build', '**/package-lock.json'],
17+
ignorePatterns: ['**/node_modules', '**/dist', '**/build', '**/coverage', '**/package-lock.json'],
1818
plugins: ['unused-imports'],
1919
rules: {
2020
'@typescript-eslint/explicit-module-boundary-types': 'off',
@@ -23,6 +23,7 @@ module.exports = {
2323
'unused-imports/no-unused-vars': ['warn', { vars: 'all', varsIgnorePattern: '^_', args: 'after-used', argsIgnorePattern: '^_' }],
2424
'no-undef': 'off',
2525
'no-console': [process.env.CI ? 'error' : 'warn', { allow: ['warn', 'error', 'info'] }],
26-
'prettier/prettier': 'error'
26+
'prettier/prettier': 'error',
27+
'no-control-regex': 0 // Used to match control regex's in user input
2728
}
2829
}

‎.github/workflows/docker-image-ecr.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ on:
2424
required: true
2525
default: 'latest'
2626

27+
permissions:
28+
contents: read # Required for checkout
29+
id-token: write # Required for AWS OIDC
30+
2731
jobs:
2832
docker:
2933
runs-on: ubuntu-latest
@@ -45,12 +49,22 @@ jobs:
4549
uses: docker/setup-buildx-action@v3.0.0
4650

4751
- name: Configure AWS Credentials
52+
if: ${{ inputs.environment != 'prod' }}
4853
uses: aws-actions/configure-aws-credentials@v3
4954
with:
5055
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
5156
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
5257
aws-region: ${{ secrets.AWS_REGION }}
5358

59+
- name: Configure AWS OIDC Credentials
60+
if: ${{ inputs.environment == 'prod' }}
61+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
62+
with:
63+
aws-region: ${{ secrets.AWS_REGION }}
64+
role-to-assume: ${{ secrets.AWS_OIDC_IAM_ROLE }}
65+
mask-aws-account-id: true
66+
unset-current-credentials: true
67+
5468
- name: Login to Amazon ECR
5569
uses: aws-actions/amazon-ecr-login@v1
5670

‎.github/workflows/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
cache-dependency-path: 'pnpm-lock.yaml'
3232
- run: pnpm install
3333
- run: pnpm lint
34+
- run: pnpm test:coverage
3435
- run: pnpm build
3536
env:
3637
NODE_OPTIONS: '--max_old_space_size=4096'

‎.husky/pre-commit‎

100644100755
File mode changed.

‎.npmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@ prefer-workspace-packages = true
44
link-workspace-packages = deep
55
hoist = true
66
shamefully-hoist = true
7+
engine-strict = false

‎.nvmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
v20.19.2

‎SECURITY.md‎

Lines changed: 61 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,37 +2,85 @@
22

33
At Flowise, we prioritize security and continuously work to safeguard our systems. However, vulnerabilities can still exist. If you identify a security issue, please report it to us so we can address it promptly. Your cooperation helps us better protect our platform and users.
44

5+
### Scope
6+
- Flowise Cloud: cloud.flowiseai.com
7+
- Public Flowise Repositories
8+
59
### Out of scope vulnerabilities
610

7-
- Clickjacking on pages without sensitive actions
8-
- CSRF on unauthenticated/logout/login pages
11+
- Hypothetical issues that do not have a demonstrable, practical impact
12+
- Vulnerabilities that affect out-of-date browsers
13+
- ClickjackingCSRF on unauthenticated/logout/login pages
14+
- Banner disclosure on common/public services
15+
- Disclosure of known public files or directories (e.g. robots.txt)
916
- Attacks requiring MITM (Man-in-the-Middle) or physical device access
1017
- Social engineering attacks
11-
- Activities that cause service disruption (DoS)
18+
- Denial service via bruteforce attack
1219
- Content spoofing and text injection without a valid attack vector
20+
- Username enumeration via Login Page error message
21+
- Username enumeration via Forgot password error message
22+
- Bruteforce attacks
1323
- Email spoofing
1424
- Absence of DNSSEC, CAA, CSP headers
1525
- Missing Secure or HTTP-only flag on non-sensitive cookies
1626
- Deadlinks
1727
- User enumeration
28+
- Social Engineering
29+
- Version Disclosure
30+
- Vulnerabilities that can only affect the attacker (e.g. self-XSS)
31+
- Known vulnerabilities in used libraries (unless exploitability can be proven)
32+
- Static application security testing findings
33+
1834

1935
### Reporting Guidelines
2036

2137
- Submit your findings to https://github.com/FlowiseAI/Flowise/security
2238
- Provide clear details to help us reproduce and fix the issue quickly.
2339

24-
### Disclosure Guidelines
40+
### Reporting Guidelines
41+
42+
- Submit your findings to https://github.com/FlowiseAI/Flowise/security
43+
- Ensure that the vulnerability is exploitable. Theoretical or static application security testing reports are subject to dismissal.
44+
- Submit the report with CVSS vector and calculated severity.
45+
- Provide a clear detailed report with proof of concept to help us reproduce and remediate the vulnerability.
46+
47+
### Disclosure Terms
48+
49+
The Flowise team believes that transparency is important and public bug bounty reports are a valuable source of knowledge for bug bounty researchers. However, the Flowise team may have legitimate reasons not to disclose vulnerabilities.
2550

26-
- Do not publicly disclose vulnerabilities until we have assessed, resolved, and notified affected users.
27-
- If you plan to present your research (e.g., at a conference or in a blog), share a draft with us at least **30 days in advance** for review.
28-
- Avoid including:
29-
- Data from any Flowise customer projects
30-
- Flowise user/customer information
31-
- Details about Flowise employees, contractors, or partners
51+
Do not discuss or disclose vulnerability information without prior written consent. If you plan on presenting your research, please share a draft with us at least 45 days in advance for review. Avoid including:
52+
- Data from any Flowise customer projects
53+
- Flowise user/customer information
54+
- Details about Flowise employees, contractors, or partners
3255

33-
### Response to Reports
56+
### Report Validation Times
3457

35-
- We will acknowledge your report within **5 business days** and provide an estimated resolution timeline.
36-
- Your report will be kept **confidential**, and your details will not be shared without your consent.
58+
We will validate submissions within the below timelines.
59+
| Vulnerability Severity | Time to Validate |
60+
| ---------------------- | ---------------- |
61+
| Critical | 5 business days |
62+
| High | 5 business days |
63+
| Medium | 15 business days |
64+
| Low | 15 business days |
3765

66+
Your report will be kept *confidential*, and your details will not be shared without your consent. The Flowise team will triage and adjust severity or CVSS score if necessary.
3867
We appreciate your efforts in helping us maintain a secure platform and look forward to working together to resolve any issues responsibly.
68+
69+
### Remediation
70+
71+
Once the report has been verified, the Flowise team will plan the remediation steps.
72+
Below is the estimated time to remediate the triaged security reports.
73+
74+
| Triaged Severity | Estimated Time to Remediate |
75+
| ---------------------- | ---------------- |
76+
| Critical | 30 business days |
77+
| High | 60 business days |
78+
| Medium | 90 business days |
79+
80+
### Public Disclosure Timeline
81+
82+
Public Disclosure occurs exactly 30 days after the next official release that includes the security patch. This period gives Flowise users a time to adopt the patched version before technical vulnerability details are made public, mitigating the risk of immediate post-disclosure exploitation.
83+
84+
#### Reaching out to the Security team
85+
To report a new vulnerability, please submit a Github security Security Advisory report.
86+
If you have any questions or concerns about the existing Security Advisory, please contact security-team@flowiseai.com.

‎docker/.env.example‎

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ PORT=3000
44
############################################## DATABASE ####################################################
55
############################################################################################################
66

7-
DATABASE_PATH=/root/.flowise
7+
# DATABASE_PATH=/your_database_path/.flowise
88
# DATABASE_TYPE=postgres
99
# DATABASE_PORT=5432
1010
# DATABASE_HOST=""
@@ -21,20 +21,22 @@ DATABASE_PATH=/root/.flowise
2121
############################################################################################################
2222

2323
# SECRETKEY_STORAGE_TYPE=local #(local | aws)
24-
SECRETKEY_PATH=/root/.flowise
24+
# SECRETKEY_PATH=/your_secret_path/.flowise
2525
# FLOWISE_SECRETKEY_OVERWRITE=myencryptionkey # (if you want to overwrite the secret key)
2626
# SECRETKEY_AWS_ACCESS_KEY=<your-access-key>
2727
# SECRETKEY_AWS_SECRET_KEY=<your-secret-key>
2828
# SECRETKEY_AWS_REGION=us-west-2
2929
# SECRETKEY_AWS_NAME=FlowiseEncryptionKey
30+
# SECRETKEY_AWS_AUTH_PREFIX=Flowise # (when SECRETKEY_STORAGE_TYPE=aws, prefix for auth secret names e.g. FlowiseTokenHashSecret)
31+
# Auth secrets (TOKEN_HASH_SECRET, EXPRESS_SESSION_SECRET, JWT_*) can be set here or left unset to use file/AWS storage
3032

3133

3234
############################################################################################################
3335
############################################## LOGGING #####################################################
3436
############################################################################################################
3537

3638
# DEBUG=true
37-
LOG_PATH=/root/.flowise/logs
39+
# LOG_PATH=/your_log_path/.flowise/logs
3840
# LOG_LEVEL=info #(error | warn | info | verbose | debug)
3941
# LOG_SANITIZE_BODY_FIELDS=password,pwd,pass,secret,token,apikey,api_key,accesstoken,access_token,refreshtoken,refresh_token,clientsecret,client_secret,privatekey,private_key,secretkey,secret_key,auth,authorization,credential,credentials
4042
# LOG_SANITIZE_HEADER_FIELDS=authorization,x-api-key,x-auth-token,cookie
@@ -48,7 +50,7 @@ LOG_PATH=/root/.flowise/logs
4850
############################################################################################################
4951

5052
# STORAGE_TYPE=local (local | s3 | gcs)
51-
BLOB_STORAGE_PATH=/root/.flowise/storage
53+
# BLOB_STORAGE_PATH=/your_storage_path/.flowise/storage
5254
# S3_STORAGE_BUCKET_NAME=flowise
5355
# S3_STORAGE_ACCESS_KEY_ID=<your-access-key>
5456
# S3_STORAGE_SECRET_ACCESS_KEY=<your-secret-key>
@@ -91,20 +93,29 @@ BLOB_STORAGE_PATH=/root/.flowise/storage
9193
# ALLOW_UNAUTHORIZED_CERTS=false
9294
# SENDER_EMAIL=team@example.com
9395

94-
JWT_AUTH_TOKEN_SECRET='AABBCCDDAABBCCDDAABBCCDDAABBCCDDAABBCCDD'
95-
JWT_REFRESH_TOKEN_SECRET='AABBCCDDAABBCCDDAABBCCDDAABBCCDDAABBCCDD'
96-
JWT_ISSUER='ISSUER'
97-
JWT_AUDIENCE='AUDIENCE'
96+
# Auth secrets: set via env (backwards compat) or leave unset to use file/AWS storage (SECRETKEY_PATH or SECRETKEY_STORAGE_TYPE=aws)
97+
# Generate a secure 32-byte secret using: openssl rand -hex 32
98+
# JWT_AUTH_TOKEN_SECRET=
99+
# JWT_REFRESH_TOKEN_SECRET=
100+
101+
JWT_ISSUER=Flowise
102+
JWT_AUDIENCE=Flowise
98103
JWT_TOKEN_EXPIRY_IN_MINUTES=360
99104
JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES=43200
105+
100106
# EXPIRE_AUTH_TOKENS_ON_RESTART=true # (if you need to expire all tokens on app restart)
101-
# EXPRESS_SESSION_SECRET=flowise
107+
108+
# Generate a secure 32-byte secret using: openssl rand -hex 32 (or leave unset for file/AWS storage)
109+
# EXPRESS_SESSION_SECRET=
110+
102111
# SECURE_COOKIES=
103112

104113
# INVITE_TOKEN_EXPIRY_IN_HOURS=24
105114
# PASSWORD_RESET_TOKEN_EXPIRY_IN_MINS=15
106115
# PASSWORD_SALT_HASH_ROUNDS=10
107-
# TOKEN_HASH_SECRET='popcorn'
116+
117+
# Generate a secure 32-byte secret using: openssl rand -hex 32 (or leave unset for file/AWS storage)
118+
# TOKEN_HASH_SECRET=
108119

109120
# WORKSPACE_INVITE_TEMPLATE_PATH=/path/to/custom/workspace_invite.hbs
110121

@@ -167,7 +178,6 @@ JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES=43200
167178
# REDIS_KEEP_ALIVE=
168179
# ENABLE_BULLMQ_DASHBOARD=
169180

170-
171181
############################################################################################################
172182
############################################## SECURITY ####################################################
173183
############################################################################################################
@@ -176,3 +186,11 @@ JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES=43200
176186
# CUSTOM_MCP_SECURITY_CHECK=true
177187
# CUSTOM_MCP_PROTOCOL=sse #(stdio | sse)
178188
# TRUST_PROXY=true #(true | false | 1 | loopback| linklocal | uniquelocal | IP addresses | loopback, IP addresses)
189+
190+
191+
############################################################################################################
192+
########################################### DOCUMENT LOADERS ###############################################
193+
############################################################################################################
194+
195+
# PUPPETEER_EXECUTABLE_FILE_PATH='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'
196+
# PLAYWRIGHT_EXECUTABLE_FILE_PATH='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'

‎docker/worker/.env.example‎

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ WORKER_PORT=5566
44
############################################## DATABASE ####################################################
55
############################################################################################################
66

7-
DATABASE_PATH=/root/.flowise
7+
# DATABASE_PATH=/your_database_path/.flowise
88
# DATABASE_TYPE=postgres
99
# DATABASE_PORT=5432
1010
# DATABASE_HOST=""
@@ -21,20 +21,22 @@ DATABASE_PATH=/root/.flowise
2121
############################################################################################################
2222

2323
# SECRETKEY_STORAGE_TYPE=local #(local | aws)
24-
SECRETKEY_PATH=/root/.flowise
24+
# SECRETKEY_PATH=/your_secret_path/.flowise
2525
# FLOWISE_SECRETKEY_OVERWRITE=myencryptionkey # (if you want to overwrite the secret key)
2626
# SECRETKEY_AWS_ACCESS_KEY=<your-access-key>
2727
# SECRETKEY_AWS_SECRET_KEY=<your-secret-key>
2828
# SECRETKEY_AWS_REGION=us-west-2
2929
# SECRETKEY_AWS_NAME=FlowiseEncryptionKey
30+
# SECRETKEY_AWS_AUTH_PREFIX=Flowise # (when SECRETKEY_STORAGE_TYPE=aws, prefix for auth secret names e.g. FlowiseTokenHashSecret)
31+
# Auth secrets (TOKEN_HASH_SECRET, EXPRESS_SESSION_SECRET, JWT_*) can be set here or left unset to use file/AWS storage
3032

3133

3234
############################################################################################################
3335
############################################## LOGGING #####################################################
3436
############################################################################################################
3537

3638
# DEBUG=true
37-
LOG_PATH=/root/.flowise/logs
39+
# LOG_PATH=/your_log_path/.flowise/logs
3840
# LOG_LEVEL=info #(error | warn | info | verbose | debug)
3941
# LOG_SANITIZE_BODY_FIELDS=password,pwd,pass,secret,token,apikey,api_key,accesstoken,access_token,refreshtoken,refresh_token,clientsecret,client_secret,privatekey,private_key,secretkey,secret_key,auth,authorization,credential,credentials
4042
# LOG_SANITIZE_HEADER_FIELDS=authorization,x-api-key,x-auth-token,cookie
@@ -48,7 +50,7 @@ LOG_PATH=/root/.flowise/logs
4850
############################################################################################################
4951

5052
# STORAGE_TYPE=local (local | s3 | gcs)
51-
BLOB_STORAGE_PATH=/root/.flowise/storage
53+
# BLOB_STORAGE_PATH=/your_storage_path/.flowise/storage
5254
# S3_STORAGE_BUCKET_NAME=flowise
5355
# S3_STORAGE_ACCESS_KEY_ID=<your-access-key>
5456
# S3_STORAGE_SECRET_ACCESS_KEY=<your-secret-key>
@@ -91,20 +93,29 @@ BLOB_STORAGE_PATH=/root/.flowise/storage
9193
# ALLOW_UNAUTHORIZED_CERTS=false
9294
# SENDER_EMAIL=team@example.com
9395

94-
JWT_AUTH_TOKEN_SECRET='AABBCCDDAABBCCDDAABBCCDDAABBCCDDAABBCCDD'
95-
JWT_REFRESH_TOKEN_SECRET='AABBCCDDAABBCCDDAABBCCDDAABBCCDDAABBCCDD'
96-
JWT_ISSUER='ISSUER'
97-
JWT_AUDIENCE='AUDIENCE'
96+
# Auth secrets: set via env (backwards compat) or leave unset to use file/AWS storage (SECRETKEY_PATH or SECRETKEY_STORAGE_TYPE=aws)
97+
# Generate a secure 32-byte secret using: openssl rand -hex 32
98+
# JWT_AUTH_TOKEN_SECRET=
99+
# JWT_REFRESH_TOKEN_SECRET=
100+
101+
JWT_ISSUER=Flowise
102+
JWT_AUDIENCE=Flowise
98103
JWT_TOKEN_EXPIRY_IN_MINUTES=360
99104
JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES=43200
105+
100106
# EXPIRE_AUTH_TOKENS_ON_RESTART=true # (if you need to expire all tokens on app restart)
101-
# EXPRESS_SESSION_SECRET=flowise
107+
108+
# Generate a secure 32-byte secret using: openssl rand -hex 32 (or leave unset for file/AWS storage)
109+
# EXPRESS_SESSION_SECRET=
110+
102111
# SECURE_COOKIES=
103112

104113
# INVITE_TOKEN_EXPIRY_IN_HOURS=24
105114
# PASSWORD_RESET_TOKEN_EXPIRY_IN_MINS=15
106115
# PASSWORD_SALT_HASH_ROUNDS=10
107-
# TOKEN_HASH_SECRET='popcorn'
116+
117+
# Generate a secure 32-byte secret using: openssl rand -hex 32 (or leave unset for file/AWS storage)
118+
# TOKEN_HASH_SECRET=
108119

109120
# WORKSPACE_INVITE_TEMPLATE_PATH=/path/to/custom/workspace_invite.hbs
110121

@@ -167,7 +178,6 @@ JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES=43200
167178
# REDIS_KEEP_ALIVE=
168179
# ENABLE_BULLMQ_DASHBOARD=
169180

170-
171181
############################################################################################################
172182
############################################## SECURITY ####################################################
173183
############################################################################################################
@@ -176,3 +186,11 @@ JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES=43200
176186
# CUSTOM_MCP_SECURITY_CHECK=true
177187
# CUSTOM_MCP_PROTOCOL=sse #(stdio | sse)
178188
# TRUST_PROXY=true #(true | false | 1 | loopback| linklocal | uniquelocal | IP addresses | loopback, IP addresses)
189+
190+
191+
############################################################################################################
192+
########################################### DOCUMENT LOADERS ###############################################
193+
############################################################################################################
194+
195+
# PUPPETEER_EXECUTABLE_FILE_PATH='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'
196+
# PLAYWRIGHT_EXECUTABLE_FILE_PATH='C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
"user:windows": "cd packages/server/bin && run user",
2525
"user:default": "cd packages/server/bin && ./run user",
2626
"test": "turbo run test",
27+
"test:coverage": "turbo run test:coverage",
2728
"clean": "pnpm --filter \"./packages/**\" clean",
2829
"nuke": "pnpm --filter \"./packages/**\" nuke && rimraf node_modules .turbo",
2930
"format": "prettier --write \"**/*.{ts,tsx,md}\"",

0 commit comments

Comments
 (0)