first commit

packages/cli/test/integration/security-audit/credentials-risk-reporter.test.ts

@@ -0,0 +1,258 @@
+import { createActiveWorkflow, createWorkflowWithHistory, testDb } from '@n8n/backend-test-utils';
+import type { SecurityConfig } from '@n8n/config';
+import {
+	generateNanoId,
+	CredentialsRepository,
+	ExecutionDataRepository,
+	ExecutionRepository,
+	WorkflowRepository,
+} from '@n8n/db';
+import { Container } from '@n8n/di';
+import { mock } from 'jest-mock-extended';
+import { v4 as uuid } from 'uuid';
+
+import { CREDENTIALS_REPORT } from '@/security-audit/constants';
+import { SecurityAuditService } from '@/security-audit/security-audit.service';
+
+import { getRiskSection } from './utils';
+
+let securityAuditService: SecurityAuditService;
+
+const securityConfig = mock<SecurityConfig>({ daysAbandonedWorkflow: 90 });
+
+beforeAll(async () => {
+	await testDb.init();
+
+	securityAuditService = new SecurityAuditService(
+		Container.get(WorkflowRepository),
+		securityConfig,
+	);
+});
+
+beforeEach(async () => {
+	await testDb.truncate([
+		'WorkflowEntity',
+		'CredentialsEntity',
+		'ExecutionEntity',
+		'WorkflowHistory',
+		'WorkflowPublishHistory',
+	]);
+});
+
+afterAll(async () => {
+	await testDb.terminate();
+});
+
+test('should report credentials not in any use', async () => {
+	const credentialDetails = {
+		id: generateNanoId(),
+		name: 'My Slack Credential',
+		data: 'U2FsdGVkX18WjITBG4IDqrGB1xE/uzVNjtwDAG3lP7E=',
+		type: 'slackApi',
+	};
+
+	const workflowDetails = {
+		name: 'My Test Workflow',
+		connections: {},
+		nodeTypes: {},
+		nodes: [
+			{
+				id: uuid(),
+				name: 'My Node',
+				type: 'n8n-nodes-base.slack',
+				typeVersion: 1,
+				position: [0, 0] as [number, number],
+				parameters: {},
+			},
+		],
+	};
+
+	await Promise.all([
+		Container.get(CredentialsRepository).save(credentialDetails),
+		createWorkflowWithHistory(workflowDetails),
+	]);
+
+	const testAudit = await securityAuditService.run(['credentials']);
+
+	const section = getRiskSection(
+		testAudit,
+		CREDENTIALS_REPORT.RISK,
+		CREDENTIALS_REPORT.SECTIONS.CREDS_NOT_IN_ANY_USE,
+	);
+
+	expect(section.location).toHaveLength(1);
+	expect(section.location[0]).toMatchObject({
+		id: credentialDetails.id,
+		name: 'My Slack Credential',
+	});
+});
+
+test('should report credentials not in active use', async () => {
+	const credentialDetails = {
+		id: generateNanoId(),
+		name: 'My Slack Credential',
+		data: 'U2FsdGVkX18WjITBG4IDqrGB1xE/uzVNjtwDAG3lP7E=',
+		type: 'slackApi',
+	};
+
+	const credential = await Container.get(CredentialsRepository).save(credentialDetails);
+
+	const workflowDetails = {
+		name: 'My Test Workflow',
+		connections: {},
+		nodeTypes: {},
+		nodes: [
+			{
+				id: uuid(),
+				name: 'My Node',
+				type: 'n8n-nodes-base.slack',
+				typeVersion: 1,
+				position: [0, 0] as [number, number],
+				parameters: {},
+			},
+		],
+	};
+
+	await createWorkflowWithHistory(workflowDetails);
+
+	const testAudit = await securityAuditService.run(['credentials']);
+
+	const section = getRiskSection(
+		testAudit,
+		CREDENTIALS_REPORT.RISK,
+		CREDENTIALS_REPORT.SECTIONS.CREDS_NOT_IN_ACTIVE_USE,
+	);
+
+	expect(section.location).toHaveLength(1);
+	expect(section.location[0]).toMatchObject({
+		id: credential.id,
+		name: 'My Slack Credential',
+	});
+});
+
+test('should report credential in not recently executed workflow', async () => {
+	const credentialDetails = {
+		id: generateNanoId(),
+		name: 'My Slack Credential',
+		data: 'U2FsdGVkX18WjITBG4IDqrGB1xE/uzVNjtwDAG3lP7E=',
+		type: 'slackApi',
+	};
+
+	const credential = await Container.get(CredentialsRepository).save(credentialDetails);
+
+	const workflowDetails = {
+		name: 'My Test Workflow',
+		connections: {},
+		nodeTypes: {},
+		nodes: [
+			{
+				id: uuid(),
+				name: 'My Node',
+				type: 'n8n-nodes-base.slack',
+				typeVersion: 1,
+				position: [0, 0] as [number, number],
+				credentials: {
+					slackApi: {
+						id: credential.id,
+						name: credential.name,
+					},
+				},
+				parameters: {},
+			},
+		],
+	};
+
+	const workflow = await createWorkflowWithHistory(workflowDetails);
+
+	const date = new Date();
+	date.setDate(date.getDate() - securityConfig.daysAbandonedWorkflow - 1);
+
+	const savedExecution = await Container.get(ExecutionRepository).save({
+		finished: true,
+		mode: 'manual',
+		createdAt: date,
+		startedAt: date,
+		stoppedAt: date,
+		workflowId: workflow.id,
+		waitTill: null,
+		status: 'success',
+	});
+	await Container.get(ExecutionDataRepository).save({
+		execution: savedExecution,
+		data: '[]',
+		workflowData: workflow,
+	});
+
+	const testAudit = await securityAuditService.run(['credentials']);
+
+	const section = getRiskSection(
+		testAudit,
+		CREDENTIALS_REPORT.RISK,
+		CREDENTIALS_REPORT.SECTIONS.CREDS_NOT_RECENTLY_EXECUTED,
+	);
+
+	expect(section.location).toHaveLength(1);
+	expect(section.location[0]).toMatchObject({
+		id: credential.id,
+		name: credential.name,
+	});
+});
+
+test('should not report credentials in recently executed workflow', async () => {
+	const credentialDetails = {
+		id: generateNanoId(),
+		name: 'My Slack Credential',
+		data: 'U2FsdGVkX18WjITBG4IDqrGB1xE/uzVNjtwDAG3lP7E=',
+		type: 'slackApi',
+	};
+
+	const credential = await Container.get(CredentialsRepository).save(credentialDetails);
+
+	const workflowDetails = {
+		name: 'My Test Workflow',
+		connections: {},
+		nodeTypes: {},
+		nodes: [
+			{
+				id: uuid(),
+				name: 'My Node',
+				type: 'n8n-nodes-base.slack',
+				typeVersion: 1,
+				position: [0, 0] as [number, number],
+				credentials: {
+					slackApi: {
+						id: credential.id,
+						name: credential.name,
+					},
+				},
+				parameters: {},
+			},
+		],
+	};
+
+	const workflow = await createActiveWorkflow(workflowDetails);
+
+	const date = new Date();
+	date.setDate(date.getDate() - securityConfig.daysAbandonedWorkflow + 1);
+
+	const savedExecution = await Container.get(ExecutionRepository).save({
+		finished: true,
+		mode: 'manual',
+		createdAt: date,
+		startedAt: date,
+		stoppedAt: date,
+		workflowId: workflow.id,
+		waitTill: null,
+		status: 'success',
+	});
+
+	await Container.get(ExecutionDataRepository).save({
+		execution: savedExecution,
+		data: '[]',
+		workflowData: workflow,
+	});
+
+	const testAudit = await securityAuditService.run(['credentials']);
+
+	expect(testAudit).toBeEmptyArray();
+});

packages/cli/test/integration/security-audit/database-risk-reporter.test.ts

@@ -0,0 +1,198 @@
+import { testDb } from '@n8n/backend-test-utils';
+import { generateNanoId, WorkflowRepository } from '@n8n/db';
+import { Container } from '@n8n/di';
+import { mock } from 'jest-mock-extended';
+import { v4 as uuid } from 'uuid';
+
+import {
+	DATABASE_REPORT,
+	SQL_NODE_TYPES,
+	SQL_NODE_TYPES_WITH_QUERY_PARAMS,
+} from '@/security-audit/constants';
+import { SecurityAuditService } from '@/security-audit/security-audit.service';
+
+import { getRiskSection, saveManualTriggerWorkflow } from './utils';
+
+let securityAuditService: SecurityAuditService;
+
+beforeAll(async () => {
+	await testDb.init();
+
+	securityAuditService = new SecurityAuditService(Container.get(WorkflowRepository), mock());
+});
+
+beforeEach(async () => {
+	await testDb.truncate(['WorkflowEntity']);
+});
+
+afterAll(async () => {
+	await testDb.terminate();
+});
+
+test('should report expressions in queries', async () => {
+	const map = [...SQL_NODE_TYPES].reduce<{ [nodeType: string]: string }>((acc, cur) => {
+		return (acc[cur] = uuid()), acc;
+	}, {});
+
+	const promises = Object.entries(map).map(async ([nodeType, nodeId]) => {
+		const details = {
+			id: generateNanoId(),
+			name: 'My Test Workflow',
+			active: false,
+			connections: {},
+			nodeTypes: {},
+			versionId: uuid(),
+			nodes: [
+				{
+					id: nodeId,
+					name: 'My Node',
+					type: nodeType,
+					parameters: {
+						operation: 'executeQuery',
+						query: '=SELECT * FROM {{ $json.table }}',
+						additionalFields: {},
+					},
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+				},
+			],
+		};
+
+		return await Container.get(WorkflowRepository).save(details);
+	});
+
+	await Promise.all(promises);
+
+	const testAudit = await securityAuditService.run(['database']);
+
+	const section = getRiskSection(
+		testAudit,
+		DATABASE_REPORT.RISK,
+		DATABASE_REPORT.SECTIONS.EXPRESSIONS_IN_QUERIES,
+	);
+
+	expect(section.location).toHaveLength(SQL_NODE_TYPES.size);
+
+	for (const loc of section.location) {
+		if (loc.kind === 'node') {
+			expect(loc.nodeId).toBe(map[loc.nodeType]);
+		}
+	}
+});
+
+test('should report expressions in query params', async () => {
+	const map = [...SQL_NODE_TYPES_WITH_QUERY_PARAMS].reduce<{ [nodeType: string]: string }>(
+		(acc, cur) => {
+			return (acc[cur] = uuid()), acc;
+		},
+		{},
+	);
+
+	const promises = Object.entries(map).map(async ([nodeType, nodeId]) => {
+		const details = {
+			id: generateNanoId(),
+			name: 'My Test Workflow',
+			active: false,
+			connections: {},
+			nodeTypes: {},
+			versionId: uuid(),
+			nodes: [
+				{
+					id: nodeId,
+					name: 'My Node',
+					type: nodeType,
+					parameters: {
+						operation: 'executeQuery',
+						query: 'SELECT * FROM users WHERE id = $1;',
+						additionalFields: {
+							queryParams: '={{ $json.userId }}',
+						},
+					},
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+				},
+			],
+		};
+
+		return await Container.get(WorkflowRepository).save(details);
+	});
+
+	await Promise.all(promises);
+
+	const testAudit = await securityAuditService.run(['database']);
+
+	const section = getRiskSection(
+		testAudit,
+		DATABASE_REPORT.RISK,
+		DATABASE_REPORT.SECTIONS.EXPRESSIONS_IN_QUERY_PARAMS,
+	);
+
+	expect(section.location).toHaveLength(SQL_NODE_TYPES_WITH_QUERY_PARAMS.size);
+
+	for (const loc of section.location) {
+		if (loc.kind === 'node') {
+			expect(loc.nodeId).toBe(map[loc.nodeType]);
+		}
+	}
+});
+
+test('should report unused query params', async () => {
+	const map = [...SQL_NODE_TYPES_WITH_QUERY_PARAMS].reduce<{ [nodeType: string]: string }>(
+		(acc, cur) => {
+			return (acc[cur] = uuid()), acc;
+		},
+		{},
+	);
+
+	const promises = Object.entries(map).map(async ([nodeType, nodeId]) => {
+		const details = {
+			id: generateNanoId(),
+			name: 'My Test Workflow',
+			active: false,
+			connections: {},
+			nodeTypes: {},
+			versionId: uuid(),
+			nodes: [
+				{
+					id: nodeId,
+					name: 'My Node',
+					type: nodeType,
+					parameters: {
+						operation: 'executeQuery',
+						query: 'SELECT * FROM users WHERE id = 123;',
+					},
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+				},
+			],
+		};
+
+		return await Container.get(WorkflowRepository).save(details);
+	});
+
+	await Promise.all(promises);
+
+	const testAudit = await securityAuditService.run(['database']);
+
+	const section = getRiskSection(
+		testAudit,
+		DATABASE_REPORT.RISK,
+		DATABASE_REPORT.SECTIONS.UNUSED_QUERY_PARAMS,
+	);
+
+	expect(section.location).toHaveLength(SQL_NODE_TYPES_WITH_QUERY_PARAMS.size);
+
+	for (const loc of section.location) {
+		if (loc.kind === 'node') {
+			expect(loc.nodeId).toBe(map[loc.nodeType]);
+		}
+	}
+});
+
+test('should not report non-database node', async () => {
+	await saveManualTriggerWorkflow();
+
+	const testAudit = await securityAuditService.run(['database']);
+
+	expect(testAudit).toBeEmptyArray();
+});

packages/cli/test/integration/security-audit/filesystem-risk-reporter.test.ts

@@ -0,0 +1,82 @@
+import { testDb } from '@n8n/backend-test-utils';
+import { WorkflowRepository } from '@n8n/db';
+import { Container } from '@n8n/di';
+import { mock } from 'jest-mock-extended';
+import { v4 as uuid } from 'uuid';
+
+import { FILESYSTEM_INTERACTION_NODE_TYPES, FILESYSTEM_REPORT } from '@/security-audit/constants';
+import { SecurityAuditService } from '@/security-audit/security-audit.service';
+
+import { getRiskSection, saveManualTriggerWorkflow } from './utils';
+
+let securityAuditService: SecurityAuditService;
+
+beforeAll(async () => {
+	await testDb.init();
+
+	securityAuditService = new SecurityAuditService(Container.get(WorkflowRepository), mock());
+});
+
+beforeEach(async () => {
+	await testDb.truncate(['WorkflowEntity']);
+});
+
+afterAll(async () => {
+	await testDb.terminate();
+});
+
+test('should report filesystem interaction nodes', async () => {
+	const map = [...FILESYSTEM_INTERACTION_NODE_TYPES].reduce<{ [nodeType: string]: string }>(
+		(acc, cur) => {
+			return (acc[cur] = uuid()), acc;
+		},
+		{},
+	);
+
+	const promises = Object.entries(map).map(async ([nodeType, nodeId]) => {
+		const details = Container.get(WorkflowRepository).create({
+			name: 'My Test Workflow',
+			active: false,
+			connections: {},
+			versionId: uuid(),
+			nodes: [
+				{
+					id: nodeId,
+					name: 'My Node',
+					type: nodeType,
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+					parameters: {},
+				},
+			],
+		});
+
+		return await Container.get(WorkflowRepository).save(details);
+	});
+
+	await Promise.all(promises);
+
+	const testAudit = await securityAuditService.run(['filesystem']);
+
+	const section = getRiskSection(
+		testAudit,
+		FILESYSTEM_REPORT.RISK,
+		FILESYSTEM_REPORT.SECTIONS.FILESYSTEM_INTERACTION_NODES,
+	);
+
+	expect(section.location).toHaveLength(FILESYSTEM_INTERACTION_NODE_TYPES.size);
+
+	for (const loc of section.location) {
+		if (loc.kind === 'node') {
+			expect(loc.nodeId).toBe(map[loc.nodeType]);
+		}
+	}
+});
+
+test('should not report non-filesystem-interaction node', async () => {
+	await saveManualTriggerWorkflow();
+
+	const testAudit = await securityAuditService.run(['filesystem']);
+
+	expect(testAudit).toBeEmptyArray();
+});

packages/cli/test/integration/security-audit/instance-risk-reporter.test.ts

@@ -0,0 +1,250 @@
+import { createActiveWorkflow, testDb } from '@n8n/backend-test-utils';
+import { GlobalConfig } from '@n8n/config';
+import { WorkflowRepository } from '@n8n/db';
+import { Container } from '@n8n/di';
+import { mock } from 'jest-mock-extended';
+import { NodeConnectionTypes } from 'n8n-workflow';
+import { v4 as uuid } from 'uuid';
+
+import { INSTANCE_REPORT, WEBHOOK_VALIDATOR_NODE_TYPES } from '@/security-audit/constants';
+import { SecurityAuditService } from '@/security-audit/security-audit.service';
+import { toReportTitle } from '@/security-audit/utils';
+
+import {
+	getRiskSection,
+	saveManualTriggerWorkflow,
+	MOCK_09990_N8N_VERSION,
+	simulateOutdatedInstanceOnce,
+	simulateUpToDateInstance,
+} from './utils';
+
+let securityAuditService: SecurityAuditService;
+
+beforeAll(async () => {
+	await testDb.init();
+
+	securityAuditService = new SecurityAuditService(Container.get(WorkflowRepository), mock());
+
+	simulateUpToDateInstance();
+});
+
+beforeEach(async () => {
+	await testDb.truncate(['WorkflowEntity', 'WorkflowHistory', 'WorkflowPublishHistory']);
+});
+
+afterAll(async () => {
+	await testDb.terminate();
+});
+
+test('should report webhook lacking authentication', async () => {
+	const targetNodeId = uuid();
+
+	await createActiveWorkflow({
+		name: 'My Test Workflow',
+		connections: {},
+		nodes: [
+			{
+				parameters: {
+					path: uuid(),
+					options: {},
+				},
+				id: targetNodeId,
+				name: 'Webhook',
+				type: 'n8n-nodes-base.webhook',
+				typeVersion: 1,
+				position: [0, 0] as [number, number],
+				webhookId: uuid(),
+			},
+		],
+	});
+
+	const testAudit = await securityAuditService.run(['instance']);
+
+	const section = getRiskSection(
+		testAudit,
+		INSTANCE_REPORT.RISK,
+		INSTANCE_REPORT.SECTIONS.UNPROTECTED_WEBHOOKS,
+	);
+
+	if (!section.location) {
+		fail('Expected section to have locations');
+	}
+
+	expect(section.location).toHaveLength(1);
+
+	expect(section.location[0].nodeId).toBe(targetNodeId);
+});
+
+test('should not report webhooks having basic or header auth', async () => {
+	const promises = ['basicAuth', 'headerAuth'].map(async (authType) => {
+		return await createActiveWorkflow({
+			name: 'My Test Workflow',
+			connections: {},
+			nodes: [
+				{
+					parameters: {
+						path: uuid(),
+						authentication: authType,
+						options: {},
+					},
+					id: uuid(),
+					name: 'Webhook',
+					type: 'n8n-nodes-base.webhook',
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+					webhookId: uuid(),
+				},
+			],
+		});
+	});
+
+	await Promise.all(promises);
+
+	const testAudit = await securityAuditService.run(['instance']);
+
+	if (Array.isArray(testAudit)) fail('Audit is empty');
+
+	const report = testAudit[toReportTitle('instance')];
+
+	if (!report) {
+		fail('Expected test audit to have instance risk report');
+	}
+
+	for (const section of report.sections) {
+		expect(section.title).not.toBe(INSTANCE_REPORT.SECTIONS.UNPROTECTED_WEBHOOKS);
+	}
+});
+
+test('should not report webhooks validated by direct children', async () => {
+	const promises = [...WEBHOOK_VALIDATOR_NODE_TYPES].map(async (nodeType) => {
+		return await createActiveWorkflow({
+			name: 'My Test Workflow',
+			nodes: [
+				{
+					parameters: {
+						path: uuid(),
+						options: {},
+					},
+					id: uuid(),
+					name: 'Webhook',
+					type: 'n8n-nodes-base.webhook',
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+					webhookId: uuid(),
+				},
+				{
+					id: uuid(),
+					name: 'My Node',
+					type: nodeType,
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+					parameters: {},
+				},
+			],
+			connections: {
+				Webhook: {
+					main: [
+						[
+							{
+								node: 'My Node',
+								type: NodeConnectionTypes.Main,
+								index: 0,
+							},
+						],
+					],
+				},
+			},
+		});
+	});
+
+	await Promise.all(promises);
+
+	const testAudit = await securityAuditService.run(['instance']);
+	if (Array.isArray(testAudit)) fail('audit is empty');
+
+	const report = testAudit[toReportTitle('instance')];
+	if (!report) {
+		fail('Expected test audit to have instance risk report');
+	}
+
+	for (const section of report.sections) {
+		expect(section.title).not.toBe(INSTANCE_REPORT.SECTIONS.UNPROTECTED_WEBHOOKS);
+	}
+});
+
+test('should not report non-webhook node', async () => {
+	await saveManualTriggerWorkflow();
+
+	const testAudit = await securityAuditService.run(['instance']);
+	if (Array.isArray(testAudit)) fail('audit is empty');
+
+	const report = testAudit[toReportTitle('instance')];
+
+	if (!report) {
+		fail('Expected test audit to have instance risk report');
+	}
+
+	for (const section of report.sections) {
+		expect(section.title).not.toBe(INSTANCE_REPORT.SECTIONS.UNPROTECTED_WEBHOOKS);
+	}
+});
+
+test('should report outdated instance when outdated', async () => {
+	simulateOutdatedInstanceOnce();
+
+	const testAudit = await securityAuditService.run(['instance']);
+
+	const section = getRiskSection(
+		testAudit,
+		INSTANCE_REPORT.RISK,
+		INSTANCE_REPORT.SECTIONS.OUTDATED_INSTANCE,
+	);
+
+	if (!section.nextVersions) {
+		fail('Expected section to have next versions');
+	}
+
+	expect(section.nextVersions).toHaveLength(1);
+
+	expect(section.nextVersions[0].name).toBe(MOCK_09990_N8N_VERSION.name);
+});
+
+test('should not report outdated instance when up to date', async () => {
+	const testAudit = await securityAuditService.run(['instance']);
+	if (Array.isArray(testAudit)) fail('audit is empty');
+
+	const report = testAudit[toReportTitle('instance')];
+	if (!report) {
+		fail('Expected test audit to have instance risk report');
+	}
+
+	for (const section of report.sections) {
+		expect(section.title).not.toBe(INSTANCE_REPORT.SECTIONS.OUTDATED_INSTANCE);
+	}
+});
+
+test('should report security settings', async () => {
+	Container.get(GlobalConfig).diagnostics.enabled = true;
+
+	const testAudit = await securityAuditService.run(['instance']);
+
+	const section = getRiskSection(
+		testAudit,
+		INSTANCE_REPORT.RISK,
+		INSTANCE_REPORT.SECTIONS.SECURITY_SETTINGS,
+	);
+
+	expect(section.settings).toMatchObject({
+		features: {
+			communityPackagesEnabled: true,
+			versionNotificationsEnabled: true,
+			templatesEnabled: true,
+			publicApiEnabled: false,
+		},
+		nodes: {
+			nodesExclude: 'n8n-nodes-base.executeCommand, n8n-nodes-base.localFileTrigger',
+			nodesInclude: 'none',
+		},
+		telemetry: { diagnosticsEnabled: true },
+	});
+});

packages/cli/test/integration/security-audit/nodes-risk-reporter.test.ts

@@ -0,0 +1,120 @@
+import { testDb, mockInstance } from '@n8n/backend-test-utils';
+import { WorkflowRepository } from '@n8n/db';
+import { Container } from '@n8n/di';
+import { mock } from 'jest-mock-extended';
+import { v4 as uuid } from 'uuid';
+
+import { LoadNodesAndCredentials } from '@/load-nodes-and-credentials';
+import { CommunityPackagesService } from '@/modules/community-packages/community-packages.service';
+import { NodeTypes } from '@/node-types';
+import { OFFICIAL_RISKY_NODE_TYPES, NODES_REPORT } from '@/security-audit/constants';
+import { PackagesRepository } from '@/security-audit/security-audit.repository';
+import { SecurityAuditService } from '@/security-audit/security-audit.service';
+import { toReportTitle } from '@/security-audit/utils';
+
+import { getRiskSection, MOCK_PACKAGE, saveManualTriggerWorkflow } from './utils';
+
+const nodesAndCredentials = mockInstance(LoadNodesAndCredentials);
+nodesAndCredentials.getCustomDirectories.mockReturnValue([]);
+mockInstance(NodeTypes);
+const communityPackagesService = mockInstance(CommunityPackagesService);
+Container.set(CommunityPackagesService, communityPackagesService);
+const packagesRepository = mockInstance(PackagesRepository);
+
+let securityAuditService: SecurityAuditService;
+
+beforeAll(async () => {
+	await testDb.init();
+
+	securityAuditService = new SecurityAuditService(Container.get(WorkflowRepository), mock());
+});
+
+beforeEach(async () => {
+	await testDb.truncate(['WorkflowEntity']);
+});
+
+afterAll(async () => {
+	await testDb.terminate();
+	jest.resetAllMocks();
+});
+
+test('should report risky official nodes', async () => {
+	packagesRepository.find.mockResolvedValue(MOCK_PACKAGE);
+	const map = [...OFFICIAL_RISKY_NODE_TYPES].reduce<{ [nodeType: string]: string }>((acc, cur) => {
+		return (acc[cur] = uuid()), acc;
+	}, {});
+
+	const promises = Object.entries(map).map(async ([nodeType, nodeId]) => {
+		const details = Container.get(WorkflowRepository).create({
+			name: 'My Test Workflow',
+			active: false,
+			connections: {},
+			versionId: uuid(),
+			nodes: [
+				{
+					id: nodeId,
+					name: 'My Node',
+					type: nodeType,
+					typeVersion: 1,
+					position: [0, 0] as [number, number],
+					parameters: {},
+				},
+			],
+		});
+
+		return await Container.get(WorkflowRepository).save(details);
+	});
+
+	await Promise.all(promises);
+
+	const testAudit = await securityAuditService.run(['nodes']);
+
+	const section = getRiskSection(
+		testAudit,
+		NODES_REPORT.RISK,
+		NODES_REPORT.SECTIONS.OFFICIAL_RISKY_NODES,
+	);
+
+	expect(section.location).toHaveLength(OFFICIAL_RISKY_NODE_TYPES.size);
+
+	for (const loc of section.location) {
+		if (loc.kind === 'node') {
+			expect(loc.nodeId).toBe(map[loc.nodeType]);
+		}
+	}
+});
+
+test('should not report non-risky official nodes', async () => {
+	packagesRepository.find.mockResolvedValue(MOCK_PACKAGE);
+	await saveManualTriggerWorkflow();
+
+	const testAudit = await securityAuditService.run(['nodes']);
+
+	if (Array.isArray(testAudit)) return;
+
+	const report = testAudit[toReportTitle('nodes')];
+
+	if (!report) return;
+
+	for (const section of report.sections) {
+		expect(section.title).not.toBe(NODES_REPORT.SECTIONS.OFFICIAL_RISKY_NODES);
+	}
+});
+
+test('should report community nodes', async () => {
+	packagesRepository.find.mockResolvedValue(MOCK_PACKAGE);
+
+	const testAudit = await securityAuditService.run(['nodes']);
+
+	const section = getRiskSection(
+		testAudit,
+		NODES_REPORT.RISK,
+		NODES_REPORT.SECTIONS.COMMUNITY_NODES,
+	);
+
+	expect(section.location).toHaveLength(1);
+
+	if (section.location[0].kind === 'community') {
+		expect(section.location[0].nodeType).toBe(MOCK_PACKAGE[0].installedNodes[0].type);
+	}
+});

packages/cli/test/integration/security-audit/utils.ts

@@ -0,0 +1,131 @@
+import { GlobalConfig } from '@n8n/config';
+import { WorkflowRepository } from '@n8n/db';
+import { Container } from '@n8n/di';
+import nock from 'nock';
+import { v4 as uuid } from 'uuid';
+
+import * as constants from '@/constants';
+import type { InstalledNodes } from '@/modules/community-packages/installed-nodes.entity';
+import type { InstalledPackages } from '@/modules/community-packages/installed-packages.entity';
+import type { Risk } from '@/security-audit/types';
+import { toReportTitle } from '@/security-audit/utils';
+
+type GetSectionKind<C extends Risk.Category> = C extends 'instance'
+	? Risk.InstanceSection
+	: Risk.StandardSection;
+
+export function getRiskSection<C extends Risk.Category>(
+	testAudit: Risk.Audit | never[],
+	riskCategory: C,
+	sectionTitle: string,
+): GetSectionKind<C> {
+	if (Array.isArray(testAudit)) {
+		throw new Error('Expected test audit not to be an array');
+	}
+
+	const report = testAudit[toReportTitle(riskCategory)];
+
+	if (!report) throw new Error(`Expected risk "${riskCategory}"`);
+
+	for (const section of report.sections) {
+		if (section.title === sectionTitle) {
+			return section as GetSectionKind<C>;
+		}
+	}
+
+	throw new Error(`Expected section "${sectionTitle}" for risk "${riskCategory}"`);
+}
+
+export async function saveManualTriggerWorkflow() {
+	const details = {
+		id: '1',
+		name: 'My Test Workflow',
+		active: false,
+		connections: {},
+		nodeTypes: {},
+		versionId: uuid(),
+		nodes: [
+			{
+				id: uuid(),
+				name: 'My Node',
+				type: 'n8n-nodes-base.manualTrigger',
+				typeVersion: 1,
+				position: [0, 0] as [number, number],
+			},
+		],
+	};
+
+	return await Container.get(WorkflowRepository).save(details);
+}
+
+export const MOCK_09990_N8N_VERSION = {
+	name: '0.999.0',
+	nodes: [
+		{
+			name: 'n8n-nodes-base.testNode',
+			displayName: 'Test Node',
+			icon: 'file:testNode.svg',
+			defaults: {
+				name: 'Test Node',
+			},
+		},
+	],
+	createdAt: '2022-11-11T11:11:11.111Z',
+	description:
+		'Includes <strong>new nodes</strong>, <strong>node enhancements</strong>, <strong>core functionality</strong> and <strong>bug fixes</strong>',
+	documentationUrl: 'https://docs.n8n.io/release-notes/0-x/#n8n0990',
+	hasBreakingChange: false,
+	hasSecurityFix: false,
+	hasSecurityIssue: false,
+	securityIssueFixVersion: null,
+};
+
+export const MOCK_01110_N8N_VERSION = {
+	name: '0.111.0',
+	nodes: [],
+	createdAt: '2022-01-01T00:00:00.000Z',
+	description:
+		'Includes <strong>new nodes</strong>, <strong>node enhancements</strong>, <strong>core functionality</strong> and <strong>bug fixes</strong>',
+	documentationUrl: 'https://docs.n8n.io/release-notes/0-x/#n8n01100',
+	hasBreakingChange: false,
+	hasSecurityFix: false,
+	hasSecurityIssue: false,
+	securityIssueFixVersion: null,
+};
+
+export const MOCK_PACKAGE: InstalledPackages[] = [
+	{
+		createdAt: new Date(),
+		updatedAt: new Date(),
+		packageName: 'n8n-nodes-test',
+		installedVersion: '1.1.2',
+		authorName: 'test',
+		authorEmail: 'test@test.com',
+		setUpdateDate: () => {},
+		installedNodes: [
+			{
+				name: 'My Test Node',
+				type: 'myTestNode',
+				latestVersion: 1,
+			} as InstalledNodes,
+		],
+	},
+];
+
+export function simulateOutdatedInstanceOnce(versionName = MOCK_01110_N8N_VERSION.name) {
+	const baseUrl = Container.get(GlobalConfig).versionNotifications.endpoint + '/';
+
+	// @ts-expect-error readonly export
+	constants.N8N_VERSION = versionName;
+
+	nock(baseUrl).get(versionName).reply(200, [MOCK_01110_N8N_VERSION, MOCK_09990_N8N_VERSION]);
+}
+
+export function simulateUpToDateInstance(versionName = MOCK_09990_N8N_VERSION.name) {
+	const baseUrl = Container.get(GlobalConfig).versionNotifications.endpoint + '/';
+
+	// @ts-expect-error readonly export
+	constants.N8N_VERSION = versionName;
+
+	nock(baseUrl).persist().get(versionName).reply(200, [MOCK_09990_N8N_VERSION]);
+}