houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Logic function handler name hardened validation (#21956)

Browse Source 
# Introduction
Introduce centralized handlerName validation for the logic function
handlerName inside the flat logic function validator

Even if not safe by definition, avoid string interpolation inside the
local driver executor when retrieving the handler name from the parent
module

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21956?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
This commit is contained in:
Paul Rastoin
2026-06-23 00:55:42 +02:00
committed by GitHub
parent a884945aca
commit a5aac3c21e
6 changed files with 424 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/core-modules/logic-function/logic-function-drivers/drivers/lambda.driver.ts
+8
View File
@@ -27,6 +27,7 @@ import { LambdaLayerManagerService } from 'src/engine/core-modules/logic-functio
import { LambdaToolFunctionsService } from 'src/engine/core-modules/logic-function/logic-function-drivers/drivers/lambda/services/lambda-tool-functions.service';
import { buildLogicFunctionTimeoutResult } from 'src/engine/core-modules/logic-function/logic-function-drivers/drivers/lambda/utils/build-logic-function-timeout-result.util';
import { parseLambdaLogResult } from 'src/engine/core-modules/logic-function/logic-function-drivers/drivers/lambda/utils/parse-lambda-log-result.util';
import { HANDLER_NAME_REGEX } from 'src/engine/metadata-modules/logic-function/constants/handler.contant';
import { LogicFunctionExecutionStatus } from 'src/engine/metadata-modules/logic-function/dtos/logic-function-execution-result.dto';
import { LogicFunctionExecutionMode } from 'src/engine/metadata-modules/logic-function/logic-function.entity';
import {
@@ -158,6 +159,13 @@ export class LambdaDriver implements LogicFunctionDriver {
currentPhase = LambdaExecutionPhase.FETCH_CODE;
const invokeFlowStart = Date.now();
if (!HANDLER_NAME_REGEX.test(flatLogicFunction.handlerName)) {
throw new LogicFunctionException(
`Invalid handlerName "${flatLogicFunction.handlerName}": must be a valid JavaScript identifier or dotted path`,
LogicFunctionExceptionCode.INVALID_LOGIC_FUNCTION_INPUT,
);
}
const executorPayload: LambdaDriverExecutorPayload = {
params: payload,
env: env ?? {},
packages/twenty-server/src/engine/core-modules/logic-function/logic-function-drivers/drivers/local/services/local-child-process-runner.service.ts
+6 -4
View File
@@ -73,6 +73,7 @@ export class LocalChildProcessRunnerService {
}
const runnerPath = join(dir, '__runner.cjs');
const handlerAccessor = `mod?.${handlerName.split('.').join('?.')}`;
const code = `
// Auto-generated. Do not edit.
const { pathToFileURL } = require('node:url');
@@ -81,8 +82,9 @@ export class LocalChildProcessRunnerService {
try {
const builtUrl = pathToFileURL(${JSON.stringify(builtFileAbsPath)});
const mod = await import(builtUrl.href);
if (typeof mod.${handlerName} !== 'function') {
throw new Error('Export "${handlerName}" not found in function bundle');
const handlerFn = ${handlerAccessor};
if (typeof handlerFn !== 'function') {
throw new Error('Export "' + ${JSON.stringify(handlerName)} + '" not found in function bundle');
}
let payload = undefined;
@@ -90,7 +92,7 @@ export class LocalChildProcessRunnerService {
process.on('message', async (msg) => {
if (!msg || msg.type !== 'run') return;
try {
const out = await mod.${handlerName}(msg.payload);
const out = await handlerFn(msg.payload);
process.send && process.send({ ok: true, result: out });
process.exit(0);
} catch (err) {
@@ -102,7 +104,7 @@ export class LocalChildProcessRunnerService {
// Fallback: read payload from argv[2] (JSON) and print to stdout
const json = process.argv[2];
payload = json ? JSON.parse(json) : undefined;
const out = await mod.${handlerName}(payload);
const out = await handlerFn(payload);
process.stdout.write(JSON.stringify({ ok: true, result: out }));
process.exit(0);
}