在审计Node-RED的Projects功能时,我们发现了一处任意文件读取漏洞(CVE-2021-21298),位于/editor-api/lib/editor/projects.js内。如下代码片段中,opts.path的输入内容用户可控: 代码语言:html AI代码解释 app.get("/:id/files/:treeish/*", needsPermission("projects.read"), function(req,res) { var opts =...
当在Node-RED的projects功能中,当用户尝试切换git分支,/editor-client/src/js/red.js会调用Red.notify弹出消息提示气泡。如分支名存在Payload,就会触发XSS漏洞,该问题已由官方确认并修复(https://github.com/node-red/node-red/compare/1.2.9...master)。 2) DOMPurify富文本过滤策略被绕过。 主要涉及...
在审计Node-RED的Projects功能时,我们发现了一处任意文件读取漏洞(CVE-2021-21298),位于/editor-api/lib/editor/projects.js内。如下代码片段中,opts.path的输入内容用户可控: app.get("/:id/files/:treeish/*", needsPermission("projects.read"), function(req,res) { var opts = { user: req.user, id...
当在Node-RED的projects功能中,当用户尝试切换git分支,/editor-client/src/js/red.js会调用Red.notify弹出消息提示气泡。如分支名存在Payload,就会触发XSS漏洞,该问题已由官方确认并修复(https://github.com/node-red/node-red/compare/1.2.9...master)。 2) DOMPurify富文本过滤策略被绕过 主要涉及Markdown富文本...
官方文档(nodered.org/about/)指出,这个名字是一个简单的双关语,听起来像“Code Red”。这是一个死胡同,Node-RED 是对它在最初几天构思时的称呼的重大改进。 “Node”部分既反映了流/节点编程模型,也反映了底层的 Node.js 运行时。 Nick 和 Dave 从未就“RED”部分代表什么达成结论。“快速事件开发人员”是...
2.2kfollowers http://nodered.org @nodered Overview Repositories36 Projects1 Packages People10 More PinnedLoading node-rednode-redPublic Low-code programming for event-driven applications JavaScript20.7k3.5k node-red-nodesnode-red-nodesPublic
First, what these nodes donotdo: These nodes have no connection outside of Node-RED. They do not directly receive data, nor do they directly send data. This is an internal system that helps you better manage Node-RED projects, minimizing overhead and simplying flows. You provide outside ...
18Mar07:53:37-[warn]Projectsdisabled:editorTheme.projects.enabled=false 18Mar07:53:37-[info]Flowsfile:/data/flows.json 18Mar07:53:37-[info]Creatingnewflowfile 18Mar07:53:37-[warn] --- Yourflowcredentialsfileisencryptedusingasystem-generatedkey. Ifthesystem-generatedkeyislostforanyreason,your...
9 Jul 18:34:13 - [warn] Projects disabled : editorTheme.projects.enabled=false 9 Jul 18:34:13 - [info] Flows file : /root/.node-red/flows_Al-TERAFORM-CENTOS-1.json 9 Jul 18:34:13 - [info] Creating new flow file 9 Jul 18:34:13 - [warn] ...
4 May 06:34:41 - [warn] Projects disabled : editorTheme.projects.enabled=false 4 May 06:34:41 - [info] Flows file : /usrdata/nodejs/flows.json 4 May 06:34:41 - [info] Creating new flow file 4 May 06:34:41 - [warn]