fix(HTTP Request Node): Sanitize authorization headers #10607
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
n8n-assistant
bot
added
n8n team
ShireenMissi
added
the
release/backport
tomi
previously approved these changes
Aug 29, 2024
n8n
|
||||||||||||||||||||||||||||
| Project |
n8n
|
| Branch Review |
node-1661-obfuscate-cred-info-in-http-node-error-messages-regression
|
| Run status |
|
| Run duration | 04m 55s |
| Commit |
|
| Committer | Shireen Missi |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
Failures
|
0
|
Flaky
|
2
|
Pending
|
0
|
Skipped
|
0
|
Passing
|
421
|
| View all changes introduced in this branch ↗︎ | |
|
✅ All Cypress E2E specs passed |
elsmr
previously approved these changes
Aug 29, 2024
elsmr
reviewed
Aug 29, 2024
elsmr
approved these changes
Aug 29, 2024
|
✅ All Cypress E2E specs passed |
ShireenMissi
deleted the
node-1661-obfuscate-cred-info-in-http-node-error-messages-regression
branch
MiloradFilipovic
added a commit
that referenced
this pull request
Aug 30, 2024
* master: (21 commits) feat: Add queue mode setup to benchmarks (no-changelog) (#10608) feat: Add n8n postgres setup to benchmarks (no-changelog) (#10604) fix(API): Update express-openapi-validator to resolve AIKIDO-2024-10229 (#10612) fix: Fix edge case in log in (no-changelog) (#10610) feat: Add local orchestration of benchmarks (no-changelog) (#10589) ci: Run nightly benchmark against nightly n8n image (no-changelog) (#10588) fix: Reduce variability in benchmarks (no-changelog) (#10606) docs: Add missing changelog entry (#10609) refactor(editor): Convert ResourceLocator to composition API (no-changelog) (#10526) feat(editor): Update new canvas node handle label rendering mechanism and design (no-changelog) (#10611) refactor(editor): Convert credential related components to composition API (no-changelog) (#10530) fix(HTTP Request Node): Sanitize authorization headers (#10607) refactor: Use `NodeConnectionType` consistently across the code base (no-changelog) (#10595) fix(editor): Hide execution buttons in readonly mode in new canvas (no-changelog) (#10603) fix(editor): Prevent keyboard shortcuts when ndv is open in new canvas (no-changelog) (#10601) fix(editor): Add confirmation toast when changing user role (#10592) feat(editor): Add support for changing sticky notes color in new canvas (no-changelog) (#10593) ci: Fix `forceConsistentCasingInFileNames` for aliased paths (no-changelog) (#10598) feat(editor): Allow sticky notes alongside fallback nodes in new canvas (no-changelog) (#10583) ci: Push nightly images to ghcr (no-changelog) (#10580) ...
Merged
|
Got released with |
|
After upgrading, this MR broke many many API calls on workflows where I understand this is necessary for specific type of nodes (as stated in the description) where you expect crendentials to be set explicitely but why would you apply this logic to the generic HTTP Request node? What's the intention behind limiting usabilty? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
The following Credentials use Base64 encoded headers and therefore were missed from the sanitisation
This PR sanitise the headers based on seeing any of these keys ['authorization', 'x-api-key', 'x-auth-token', 'cookie', 'proxy-authorization', 'sslclientcert'] regardless if the credentials were encoded or not
Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/NODE-1661/obfuscate-cred-info-in-http-node-error-messages-regression
Review / Merge checklist
release/backport(if the PR is an urgent fix that needs to be backported)