houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Logic function handler name hardened validation (#21956)

Browse Source 
# Introduction
Introduce centralized handlerName validation for the logic function
handlerName inside the flat logic function validator

Even if not safe by definition, avoid string interpolation inside the
local driver executor when retrieving the handler name from the parent
module

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21956?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
This commit is contained in:
Paul Rastoin
2026-06-23 00:55:42 +02:00
committed by GitHub
parent a884945aca
commit a5aac3c21e
6 changed files with 424 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/workspace-manager/workspace-migration/workspace-migration-builder/validators/services/flat-logic-function-validator.service.ts
+23
View File
@@ -7,6 +7,7 @@ import { isDefined } from 'twenty-shared/utils';
import { validateFilePath } from 'src/engine/core-modules/file-storage/utils/validate-file-path.util';
import { findFlatEntityByUniversalIdentifier } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-universal-identifier.util';
import { HANDLER_NAME_REGEX } from 'src/engine/metadata-modules/logic-function/constants/handler.contant';
import { LogicFunctionExecutionMode } from 'src/engine/metadata-modules/logic-function/logic-function.entity';
import { LogicFunctionExceptionCode } from 'src/engine/metadata-modules/logic-function/logic-function.exception';
import { isLogicFunctionReadyForPrebuiltInstall } from 'src/engine/metadata-modules/logic-function/utils/is-logic-function-ready-for-prebuilt-install.util';
@@ -81,6 +82,17 @@ export class FlatLogicFunctionValidatorService {
}
}
if (
isDefined(flatEntityUpdate.handlerName) &&
!HANDLER_NAME_REGEX.test(flatEntityUpdate.handlerName)
) {
validationResult.errors.push({
code: LogicFunctionExceptionCode.INVALID_LOGIC_FUNCTION_INPUT,
message: t`handlerName must be a valid JavaScript identifier or dotted path`,
userFriendlyMessage: msg`Handler name is invalid`,
});
}
const mergedPrebuiltState = {
executionMode:
flatEntityUpdate.executionMode ??
@@ -202,6 +214,17 @@ export class FlatLogicFunctionValidatorService {
}
}
if (
!isDefined(flatLogicFunctionToValidate.handlerName) ||
!HANDLER_NAME_REGEX.test(flatLogicFunctionToValidate.handlerName)
) {
validationResult.errors.push({
code: LogicFunctionExceptionCode.INVALID_LOGIC_FUNCTION_INPUT,
message: t`handlerName must be a valid JavaScript identifier or dotted path`,
userFriendlyMessage: msg`Handler name is invalid`,
});
}
if (
flatLogicFunctionToValidate.executionMode ===
LogicFunctionExecutionMode.PREBUILT &&