@node-red/runtime - npm Package Compare versions

Comparing version 2.0.6 to 2.1.0-beta.1

lib/api/flows.js

@@ -236,3 +236,5 @@ /**
         var cred;
-        if (/^subflow(:|$)/.test(opts.type)) {
+        if (/^subflow(:|$)/.test(opts.type) ||
+            (opts.type === "tab") ||
+            (opts.type === "group")) {
             for (cred in credentials) {
@@ -239,0 +241,0 @@ if (credentials.hasOwnProperty(cred)) {

lib/flows/Flow.js

@@ -23,2 +23,3 @@ /**
 const hooks = require("@node-red/util").hooks;
+const credentials = require("../nodes/credentials");
 
@@ -400,3 +401,14 @@ var Subflow;
 
+
     /**
+     * Get a group node instance
+     * @param  {String} id
+     * @return {Node}   group node
+     */
+    getGroupNode(id) {
+        const groups = this.global.groups;
+        return groups[id];
+    }
+
+    /**
      * Get all of the nodes instantiated within this flow
@@ -409,2 +421,78 @@ * @return {[type]} [description]
 
+    /*!
+     * Get value of environment variable defined in group node.
+     * @param {String} group - group node
+     * @param {String} name - name of variable
+     * @return {Object} object containing the value in val property or null if not defined
+     */
+    getGroupEnvSetting(node, group, name) {
+        if (group) {
+            if (group.credentials === undefined) {
+                group.credentials = credentials.get(group.id) || {};
+            }
+            if (!name.startsWith("$parent.")) {
+                if (group.env) {
+                    if (!group._env) {
+                        const envs = group.env;
+                        const entries = envs.map((env) => {
+                            if (env.type === "cred") {
+                                const cred = group.credentials;
+                                if (cred.hasOwnProperty(env.name)) {
+                                    env.value = cred[env.name];
+                                }
+                            }
+                            return [env.name, env];
+                            
+                            return [env.name, env];
+                        });
+                        group._env = Object.fromEntries(entries);
+                    }
+                    const env = group._env[name];
+                    if (env) {
+                        let value = env.value;
+                        const type = env.type;
+                        if ((type !== "env") ||
+                            (value !== name)) {
+                            if (type === "env") {
+                                value = value.replace(new RegExp("\\${"+name+"}","g"),"${$parent."+name+"}");
+                            }
+                            if (type === "bool") {
+                                const val
+                                      = ((value === "true") ||
+                                         (value === true));
+                                return {
+                                    val: val
+                                };
+                            }
+                            if (type === "cred") {
+                                return {
+                                    val: value
+                                };
+                            }
+                            try {
+                                var val = redUtil.evaluateNodeProperty(value, type, node, null, null);
+                                return {
+                                    val: val
+                                };
+                            }
+                            catch (e) {
+                                this.error(e);
+                                return null;
+                            }
+                        }
+                    }
+                }
+            }
+            else {
+                name = name.substring(8);
+            }
+            if (group.g) {
+                const parent = this.getGroupNode(group.g);
+                return this.getGroupEnvSetting(node, parent, name);
+            }
+        }
+        return null;
+    }
+
+
     /**
@@ -418,2 +506,48 @@ * Get a flow setting value. This currently automatically defers to the parent
     getSetting(key) {
+        const flow = this.flow; 
+        if (flow.credentials === undefined) {
+            flow.credentials = credentials.get(flow.id) || {};
+        }
+        if (flow.env) {
+            if (!key.startsWith("$parent.")) {
+                if (!flow._env) {
+                    const envs = flow.env;
+                    const entries = envs.map((env) => {
+                        if (env.type === "cred") {
+                            const cred = flow.credentials;
+                            if (cred.hasOwnProperty(env.name)) {
+                                env.value = cred[env.name];
+                            }
+                        }
+                        return [env.name, env]
+                    });
+                    flow._env = Object.fromEntries(entries);
+                }
+                const env = flow._env[key];
+                if (env) {
+                    let value = env.value;
+                    const type = env.type;
+                    if ((type !== "env") || (value !== key)) {
+                        if (type === "env") {
+                            value = value.replace(new RegExp("\\${"+key+"}","g"),"${$parent."+key+"}");
+                        }
+                        try {
+                            if (type === "bool") {
+                                const val = ((value === "true") ||
+                                             (value === true));
+                                return val;
+                            }
+                            if (type === "cred") {
+                                return value;
+                            }
+                            var val = redUtil.evaluateNodeProperty(value, type, null, null, null);
+                            return val;
+                        }
+                        catch (e) {
+                            this.error(e);
+                        }
+                    }
+                }
+            }
+        }
         return this.parent.getSetting(key);
@@ -420,0 +554,0 @@ }

lib/flows/index.js

@@ -542,2 +542,5 @@ /**
     }
+    if (flow.hasOwnProperty('env')) {
+        tabNode.env = flow.env;
+    }
 
@@ -603,2 +606,5 @@ var nodes = [tabNode];
     }
+    if (flow.hasOwnProperty('env')) {
+        result.env = flow.env;
+    }
     if (id !== 'global') {
@@ -699,2 +705,8 @@ result.nodes = [];
         }
+        if (newFlow.hasOwnProperty('env')) {
+            tabNode.env = newFlow.env;
+        }
+        if (newFlow.hasOwnProperty('credentials')) {
+            tabNode.credentials = newFlow.credentials;
+        }
 
@@ -701,0 +713,0 @@ nodes = [tabNode].concat(newFlow.nodes||[]).concat(newFlow.configs||[]);

lib/flows/Subflow.js

@@ -373,2 +373,12 @@ /**
         }
+        const node = this.subflowInstance;
+        if (node.g) {
+            const group = this.getGroupNode(node.g);
+            const result = this.getGroupEnvSetting(node, group, name);
+            if (result) {
+                return result.val;
+            }
+        }
+        
+
         var parent = this.parent;
@@ -375,0 +385,0 @@ if (parent) {

lib/flows/util.js

@@ -47,3 +47,4 @@ /**
 
-function mapEnvVarProperties(obj,prop,flow) {
+
+function mapEnvVarProperties(obj,prop,flow,config) {
     var v = obj[prop];
@@ -54,3 +55,3 @@ if (Buffer.isBuffer(v)) {
         for (var i=0;i<v.length;i++) {
-            mapEnvVarProperties(v,i,flow);
+            mapEnvVarProperties(v,i,flow,config);
         }
@@ -60,4 +61,4 @@ } else if (typeof obj[prop] === 'string') {
             var envVar = v.substring(2,v.length-1);
-            var r = flow.getSetting(envVar);
-            obj[prop] = r!==undefined?r:obj[prop];
+            var r = redUtil.getSetting(config, envVar, flow);
+            obj[prop] = r ? r : obj[prop];
         }
@@ -67,3 +68,3 @@ } else {
             if (v.hasOwnProperty(p)) {
-                mapEnvVarProperties(v,p,flow);
+                mapEnvVarProperties(v,p,flow,config);
             }
@@ -85,3 +86,3 @@ }
                 if (conf.hasOwnProperty(p)) {
-                    mapEnvVarProperties(conf,p,flow);
+                    mapEnvVarProperties(conf,p,flow,conf);
                 }
@@ -88,0 +89,0 @@ }

lib/nodes/index.js

@@ -106,3 +106,3 @@ /**
             if (creds.hasOwnProperty(p)) {
-                flowUtil.mapEnvVarProperties(creds,p,node._flow);
+                flowUtil.mapEnvVarProperties(creds,p,node._flow,node);
             }
@@ -109,0 +109,0 @@ }

lib/nodes/Node.js

@@ -41,2 +41,3 @@ /**
     this.z = n.z;
+    this.g = n.g;
     this._closeCallbacks = [];
@@ -43,0 +44,0 @@ this._inputCallback = null;

package.json

 {
     "name": "@node-red/runtime",
-    "version": "2.0.6",
+    "version": "2.1.0-beta.1",
     "license": "Apache-2.0",
@@ -19,4 +19,4 @@ "main": "./lib/index.js",
     "dependencies": {
-        "@node-red/registry": "2.0.6",
-        "@node-red/util": "2.0.6",
+        "@node-red/registry": "2.1.0-beta.1",
+        "@node-red/util": "2.1.0-beta.1",
         "async-mutex": "0.3.2",
@@ -23,0 +23,0 @@ "clone": "2.1.2",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

542001

increased by1.14%

Lines of code

12682

increased by1.21%

Worsened metrics

Number of low quality alerts

2

increased by100%

Number of low supply chain risk alerts

45

increased by7.14%

Dependency changes

• + Added@node-red/registry@2.1.0-beta.1(transitive)

• + Added@node-red/util@2.1.0-beta.1(transitive)

• + Addedi18next@21.2.4(transitive)

• + Addeduglify-js@3.14.2(transitive)

• - Removed@node-red/registry@2.0.6(transitive)

• - Removed@node-red/util@2.0.6(transitive)

• - Removedi18next@20.3.2(transitive)

• - Removeduglify-js@3.14.1(transitive)

• Updated@node-red/registry@2.1.0-beta.1

• Updated@node-red/util@2.1.0-beta.1