Problems with JSONata in Node-RED

General
1

Hi,

We shipped new maintenance releases of Node-RED earlier this week to update the JSONata dependency that has a critical CVE published against it.

Unfortunately, we have since discovered the fix for the CVE is now blocking behaviour we had relied on.

JSONata can no longer access properties on objects that are in the prototype chain, or defined via getter/setter properties. That's fine if you are dealing purely with JSON data (which is JSONata's focus) - but it is problematic when dealing with more general JavaScript objects.

Here are two examples that no longer work:

const url = new URL("https://example.com")
// Get `url.hostname`
console.log(await jsonata("hostname").evaluate(url))
// Old JSONata -> 'example.com'
// Latest JSONata -> undefined

More specifically, in Node-RED, we extend JSONata with the $moment() function. Previously, the expression $moment().hour() could be used to get the current hour of the day.

That no longer works in Node-RED 5.0.6.

There is an open issue against JSONata regarding this change in behaviour that was introduced - but it has gone unanswered for some time.

As it stands, we are stuck between a rock and a hardplace. With the JSONata CVE flagged as critical, it was blocking Node-RED from being used for some organisations due to security policies. The fix breaks behaviour we rely on.

Normally we'd just do the work to fix these things. But as it stands, I don't have a solution to this problem, so wanted to acknowledge it here.

An issue has been raised against 5.0.6 that covers it. If we're able to find a non-breaking way forward, we'll keep that issue updated.

2

So there was an issue in 5.0.5 so 5.0.6 was released but it has another problem. Is the recommended plan as of right now to stay on 5.0.4?

3

@gerry

  • 5.0.4 includes the older JSONata version with a critical CVE warning. As long as you aren't importing random flows from the internet, or letting strangers deploy flows, the CVE is not a risk for you.
  • 5.0.5 updated JSONata and some other dependencies as routine maintenance. One of the other dependencies turned out to be broken on Pi 4s.
  • 5.0.6 reverted that broken dependency - but at that time, we weren't aware of these new issues with JSONata

If you aren't using JSONata expressions in your flows, or only for basic things, then 5.0.6 is fine for you.

One option we do have is to ship 5.0.7 (and 4.1.15) with a reverted JSONata. But we know that will then block some users from installing due to the critical CVE that gets included.

Essentially, there is currently no good and obvious solution that doesn't break something for someone. Welcome to my Friday.

4

Sorry for any ruined Fridays... :innocent:

Does this (typical usage I use) imply that the following will not work? As example, in a change node:

  • access and changing properties of incoming messages?
  • access data in context (flow/global)?
  • setting or creating a new message property and using it in a later step?
  • setting a context variable and using it in a later step?

Examples as below

image
image1677Ă—846 101 KB

5

@krambriw I think those expressions are fine.

6

I had hoped that some magic solution would present itself over the weekend, it hasn't. Whilst discussion of other scripting language choices is good to have, we still need to address the immediate problem users are hitting.

Here is what we're going to do.

I am going to fork JSONata and apply a fix for the issue we're hitting and bundle that fork in Node-RED. This is hopefully a temporary measure but allows us to move forward - without the security CVE of older versions and without the changed behaviour of newer versions.

Maintaining a fork isn't certainly not my preferred choice, but given the lack of response from the JSONata maintainers there's not much else we can do. The goal will be to make the absolutely minimal set of changes so that we don't end up diverging too far.

Ideally the fork will be short-lived and we'll be able to shift back at some point in the future.

7

Thank you very much!!

8

Node-RED 5.0.7 has been published with the updated JSONata.

Docker images still building - will be ready within the hour.