Caution installing nodes that may replace your flows file

General
1

I learned it the hard way guys, so I am letting everyone know. I was experimenting with a flow idea and while browsing for additional nodes I came across https://github.com/Streampunk/node-red-contrib-dynamorse-core
looked like what I needed, so I read the docs and went ahead and installed the node the same way I usually do via Pallete Manager
While installing I received a message that the flows have changed on the server ! I never saw this message from NodeRed before..After installation, my whole flows have gone and I am left with a blank new flow. I thought something was just not refreshed and made it even worse and restarted node-red (hadn't I restarted node-red I could possibly recovered my flow.json file from the automatic backup, I dont know)
Only moments later I realised that my flow.json file was replaced with a blank new flow !! many months of work gone just like this! Unfortunately, this is a dev machine I was using for just few side hobby projects and I didnt have backups.
I am posting this to let you guys know some nodes might do things which are not documented or might replace your flows file, take precautions and either have separate instance where you install new nodes, if you using projects commit your changes or enable auto commit (Nick suggested).. most importantly backup your flow.json file

2

Have you looked in your node.red folder? there should be a ?????.json.backup file

Also, you might want to look into using projects & GIT or add this flow to do auto backups or at least do manual backups.

3

Its post-install script creates a flow - I'm guessing that has gone wrong.

You should be able to recover from the backup flow file.

4

the backup flow was zero bytes itself too.. as I mentioned I am guessing that when I restarted node-red the backup file got replaced with the new blank flow which was created by the node installation ... so I must have shot myself on the foot by restarting without checking the backup file :frowning:

5

yes surely a nightmare and sad I saw it.. I had no backups for this drive and doesn't look I could recover it ! happy days !!! :grimacing:

6

I didn't check the code before installing (and I am guessing I am not the only one) but if post-install script creates a flow , you would think it adds a new flow, not replace the whole flows

7

I came to know about the auto-commit feature with using projects, and the solution @Steve-Mcl mentioned to add a flow that does auto backups - I think it maybe worth it to include a built-in version control feature in node-red itself regardless of the projects feature .. keeping version history for a period of time would be very useful in this case of disaster

1 Like
8

I think that was probably the intent. I'm sure the author didn't set out to destroy people's flow files :frowning:

9

here is the offending script
https://raw.githubusercontent.com/Streampunk/node-red-contrib-dynamorse-core/master/scripts/dynamorse-setup.js
specifically the node-red api call.. i assume this is the one caused the whole flows to be overwritten

var dynamorseTabReq = http.request({
    host: 'localhost',
    port : properties.redPort,
    path : '/flows',
    method : 'POST',
    headers : {
      'Content-Type' : 'application/json',
      'Content-Length' : dynamorseTab.length
    }
  }, res => {
    res.setEncoding('utf8');
    res.on('data', (/*chunk*/) => {
    });
    res.on('end', () => {
      console.log(' - restart Node-RED to complete dynamorse configuration');
    });
  }).on('error', e => {
    console.log(` - problem with dynamorse tab request: ${e.message}`);
    console.log('   - run dynamorse-setup.exe once Node-RED is started to configure dynamorse');
  });

  dynamorseTabReq.write(dynamorseTab);
  dynamorseTabReq.end();

looks like he is posting to /flows endpoint and writing a flow. I dont know if this is the right way of doing it

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.