mirror of
https://github.com/farcasclaudiu/Flowise.git
synced 2026-06-28 17:01:00 +03:00
Refractor/SecureZodSchemaParser (#4898)
* refactor: Implement SecureZodSchemaParser for safe Zod schema handling and add FilterParser for Supabase filters * Replaced direct Zod schema evaluation with SecureZodSchemaParser in StructuredOutputParserAdvanced and CustomTool. * Introduced FilterParser to safely handle Supabase filter strings, preventing arbitrary code execution. * Added new filterParser.ts file to encapsulate filter parsing logic. * Updated Supabase vector store to utilize the new FilterParser for RPC filters. * Created secureZodParser.ts for secure parsing of Zod schemas. * remove console log
This commit is contained in:
@@ -3,6 +3,7 @@ import { convertSchemaToZod, getBaseClasses, getVars } from '../../../src/utils'
|
||||
import { DynamicStructuredTool } from './core'
|
||||
import { z } from 'zod'
|
||||
import { DataSource } from 'typeorm'
|
||||
import { SecureZodSchemaParser } from '../../../src/secureZodParser'
|
||||
|
||||
class CustomTool_Tools implements INode {
|
||||
label: string
|
||||
@@ -119,8 +120,7 @@ class CustomTool_Tools implements INode {
|
||||
if (customToolName) obj.name = customToolName
|
||||
if (customToolDesc) obj.description = customToolDesc
|
||||
if (customToolSchema) {
|
||||
const zodSchemaFunction = new Function('z', `return ${customToolSchema}`)
|
||||
obj.schema = zodSchemaFunction(z)
|
||||
obj.schema = SecureZodSchemaParser.parseZodSchema(customToolSchema) as z.ZodObject<ICommonObject, 'strip', z.ZodTypeAny>
|
||||
}
|
||||
|
||||
const variables = await getVars(appDataSource, databaseEntities, nodeData, options)
|
||||
|
||||
Reference in New Issue
Block a user