Skip to content
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,9 @@
"*.{js,jsx,ts,tsx,json,md}": "eslint --fix"
},
"devDependencies": {
"@changesets/cli": "^2.27.0",
"@babel/preset-env": "^7.19.4",
"@babel/preset-typescript": "7.18.6",
"@changesets/cli": "^2.27.0",
"@types/express": "^4.17.13",
"@typescript-eslint/typescript-estree": "^7.13.1",
"eslint": "^8.24.0",
Expand All @@ -67,8 +67,26 @@
},
"pnpm": {
"onlyBuiltDependencies": [
"@swc/core",
"bufferutil",
"canvas",
"core-js",
"core-js-pure",
"couchbase",
"cpu-features",
"cypress",
"es5-ext",
"esbuild",
"faiss-node",
"sqlite3"
"grpc-tools",
"msgpackr-extract",
"protobufjs",
"puppeteer",
"sharp",
"sqlite3",
"ssh2",
"unrs-resolver",
"utf-8-validate"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The addition of a large number of packages to onlyBuiltDependencies is a significant change that bypasses the pnpm security sandbox for post-install scripts. This change is unrelated to the PRs objective of adding null checks and should be justified or moved to a separate PR. Furthermore, packages like core-js, core-js-pure, and es5-ext are pure JavaScript libraries that typically do not require native compilation and should not be in this list.

],
"overrides": {
"axios": "1.15.0",
Expand Down
24 changes: 23 additions & 1 deletion packages/server/src/services/documentstore/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -1583,6 +1583,9 @@ const _createEmbeddingsObject = async (
): Promise<any> => {
// prepare embedding node data
const embeddingComponent = componentNodes[data.embeddingName]
if (!embeddingComponent) {
throw new InternalFlowiseError(StatusCodes.INTERNAL_SERVER_ERROR, `Embedding "${data.embeddingName}" not found in component nodes`)
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To ensure consistency with the check implemented in _createVectorStoreObject and to prevent a potential crash during the dynamic import at line 1607, this check should also verify that embeddingComponent.filePath is defined. This promotes fail-fast behavior by throwing an error for invalid configurations.

    if (!embeddingComponent || !embeddingComponent.filePath) {
        throw new InternalFlowiseError(
            StatusCodes.INTERNAL_SERVER_ERROR,
            "Embedding " + data.embeddingName + " not found or filePath not configured in component nodes"
        )
    }
References
  1. When handling potentially invalid data from external sources (like an API response), prefer throwing an error for invalid input types rather than silently returning a default or empty value. This promotes fail-fast behavior.

const embeddingNodeData: any = {
inputs: { ...data.embeddingConfig },
outputs: { output: 'document' },
Expand Down Expand Up @@ -1618,6 +1621,12 @@ const _createRecordManagerObject = async (
) => {
// prepare record manager node data
const recordManagerComponent = componentNodes[data.recordManagerName]
if (!recordManagerComponent) {
throw new InternalFlowiseError(
StatusCodes.INTERNAL_SERVER_ERROR,
`Record Manager "${data.recordManagerName}" not found in component nodes`
)
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Similar to the embeddings check, verifying the existence of filePath here is important because it is used for the dynamic import at line 1647. Adding this check maintains consistency across the component creation functions and ensures that missing configurations are handled explicitly by throwing an error.

Suggested change
if (!recordManagerComponent) {
throw new InternalFlowiseError(
StatusCodes.INTERNAL_SERVER_ERROR,
`Record Manager "${data.recordManagerName}" not found in component nodes`
)
}
if (!recordManagerComponent || !recordManagerComponent.filePath) {
throw new InternalFlowiseError(
StatusCodes.INTERNAL_SERVER_ERROR,
"Record Manager " + data.recordManagerName + " not found or filePath not configured in component nodes"
)
}
References
  1. When a feature requires a specific configuration (e.g., an API key for a sandboxed environment), it is preferable to throw an error if the configuration is missing rather than silently falling back to a different implementation.

const rmNodeData: any = {
inputs: { ...data.recordManagerConfig },
id: `${recordManagerComponent.name}_0`,
Expand Down Expand Up @@ -1646,6 +1655,12 @@ const _createRecordManagerObject = async (

const _createVectorStoreNodeData = (componentNodes: IComponentNodes, data: ICommonObject, embeddingObj: any, recordManagerObj?: any) => {
const vectorStoreComponent = componentNodes[data.vectorStoreName]
if (!vectorStoreComponent) {
throw new InternalFlowiseError(
StatusCodes.INTERNAL_SERVER_ERROR,
`Vector Store "${data.vectorStoreName}" not found in component nodes`
)
}
const vStoreNodeData: any = {
id: `${vectorStoreComponent.name}_0`,
inputs: { ...data.vectorStoreConfig },
Expand Down Expand Up @@ -1679,7 +1694,14 @@ const _createVectorStoreObject = async (
vStoreNodeData: INodeData,
upsertHistory?: Record<string, any>
) => {
const vStoreNodeInstanceFilePath = componentNodes[data.vectorStoreName].filePath as string
const vectorStoreComponent = componentNodes[data.vectorStoreName]
if (!vectorStoreComponent || !vectorStoreComponent.filePath) {
throw new InternalFlowiseError(
StatusCodes.INTERNAL_SERVER_ERROR,
`Vector Store "${data.vectorStoreName}" not found or filePath not configured in component nodes`
)
}
const vStoreNodeInstanceFilePath = vectorStoreComponent.filePath as string
const vStoreNodeModule = await import(vStoreNodeInstanceFilePath)
const vStoreNodeInstance = new vStoreNodeModule.nodeClass()
if (upsertHistory) upsertHistory['flowData'] = saveUpsertFlowData(vStoreNodeData, upsertHistory)
Expand Down