-
-
Notifications
You must be signed in to change notification settings - Fork 23.8k
Description
Describe the bug
I can't get the "Folder with Files" module to work. It doesn't matter which kind of path I enter
I use ./Path which exists in /root as /root/Path for the "Folder with Files" module and have ./ in the "Faiss" module which works without any issues and stores the information in root. (BTW: the docker file in docker runs FlowwiseAI still as root)
It looks like a merge concerning a security vulnerability changed the logic behind the isPathTraversal detection, which breaks the modul.
There is a discussion #5326 which might have a solution but the implementation of the isPathTraversal code is broken.
Especially if you allow other modules to NOT use it.. Flowise should either restrict access to anything outside the directory it is running in or don't bother at all. Relying on others to implement security is a bad approach.
Running this in a docker container, setup via die documention.. which is the reason I used the docker files from the docker directory.
To Reproduce
Add the "Folder with Files" module
Add a directory with files inside the root or "node?" folder
Configure the "Folder with Files" with ./directory
Try to run it
Expected behavior
It works without a pathtraversal error.
For more information see referenced discussion.
Screenshots
No response
Flow
No response
Use Method
Docker
Flowise Version
No response
Operating System
macOS
Browser
Chrome
Additional context
No response