Problems with JSONata in Node-RED

General
1

Hi,

We shipped new maintenance releases of Node-RED earlier this week to update the JSONata dependency that has a critical CVE published against it.

Unfortunately, we have since discovered the fix for the CVE is now blocking behaviour we had relied on.

JSONata can no longer access properties on objects that are in the prototype chain, or defined via getter/setter properties. That's fine if you are dealing purely with JSON data (which is JSONata's focus) - but it is problematic when dealing with more general JavaScript objects.

Here are two examples that no longer work:

const url = new URL("https://example.com")
// Get `url.hostname`
console.log(await jsonata("hostname").evaluate(url))
// Old JSONata -> 'example.com'
// Latest JSONata -> undefined

More specifically, in Node-RED, we extend JSONata with the $moment() function. Previously, the expression $moment().hour() could be used to get the current hour of the day.

That no longer works in Node-RED 5.0.6.

There is an open issue against JSONata regarding this change in behaviour that was introduced - but it has gone unanswered for some time.

As it stands, we are stuck between a rock and a hardplace. With the JSONata CVE flagged as critical, it was blocking Node-RED from being used for some organisations due to security policies. The fix breaks behaviour we rely on.

Normally we'd just do the work to fix these things. But as it stands, I don't have a solution to this problem, so wanted to acknowledge it here.

An issue has been raised against 5.0.6 that covers it. If we're able to find a non-breaking way forward, we'll keep that issue updated.

2

So there was an issue in 5.0.5 so 5.0.6 was released but it has another problem. Is the recommended plan as of right now to stay on 5.0.4?

3

@gerry

  • 5.0.4 includes the older JSONata version with a critical CVE warning. As long as you aren't importing random flows from the internet, or letting strangers deploy flows, the CVE is not a risk for you.
  • 5.0.5 updated JSONata and some other dependencies as routine maintenance. One of the other dependencies turned out to be broken on Pi 4s.
  • 5.0.6 reverted that broken dependency - but at that time, we weren't aware of these new issues with JSONata

If you aren't using JSONata expressions in your flows, or only for basic things, then 5.0.6 is fine for you.

One option we do have is to ship 5.0.7 (and 4.1.15) with a reverted JSONata. But we know that will then block some users from installing due to the critical CVE that gets included.

Essentially, there is currently no good and obvious solution that doesn't break something for someone. Welcome to my Friday.