first commit

packages/nodes-base/nodes/Merge/v3/helpers/sandbox-utils.ts

@@ -0,0 +1,75 @@
+import { readFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+
+import ivm from 'isolated-vm';
+
+import type { IDataObject } from 'n8n-workflow';
+
+// Singleton – recreated only after resetSandboxCache() (tests) or isolate disposal.
+let sandboxIsolate: ivm.Isolate | null = null;
+let sandboxContext: ivm.Context | null = null;
+
+/** Disposes the cached isolate. Exposed for tests only. */
+export function resetSandboxCache(): void {
+	sandboxContext = null;
+	if (sandboxIsolate && !sandboxIsolate.isDisposed) {
+		sandboxIsolate.dispose();
+	}
+	sandboxIsolate = null;
+}
+
+/** Returns a cached isolated-vm context with alasql pre-loaded. Creates it on first call. */
+export async function loadAlaSqlSandbox(): Promise<ivm.Context> {
+	if (sandboxContext && sandboxIsolate && !sandboxIsolate.isDisposed) {
+		return sandboxContext;
+	}
+
+	sandboxIsolate = new ivm.Isolate({ memoryLimit: 64 }); // 64 MB hard limit
+	sandboxContext = await sandboxIsolate.createContext();
+
+	// Browser bundle only – no Node.js fs/require handlers inside the isolate.
+	// eslint-disable-next-line @typescript-eslint/no-require-imports
+	const alasqlBundlePath = require.resolve('alasql/dist/alasql.min.js');
+	await sandboxContext.eval(await readFile(alasqlBundlePath, 'utf-8'));
+	await sandboxContext.eval('Object.freeze(alasql.fn)');
+
+	return sandboxContext;
+}
+
+/**
+ * Runs a SQL query against plain-object table data inside the isolated-vm sandbox.
+ * Only JSON-serialisable values cross the isolate boundary.
+ */
+export async function runAlaSqlInSandbox(
+	context: ivm.Context,
+	tableData: unknown[][],
+	query: string,
+): Promise<IDataObject[]> {
+	// UUID per invocation so concurrent calls sharing the singleton context
+	// don't collide on alasql.databases.
+	const dbId = randomUUID();
+
+	// Double-serialization: outer JSON.stringify produces a JSON string, inner produces a JSON literal
+	// embedded in the script source. Inside the isolate, JSON.parse reconstructs the plain array.
+	// This ensures data enters the isolate as a parsed JSON literal, never as live objects.
+	const script = `(function() {
+		const __rows = JSON.parse(${JSON.stringify(JSON.stringify(tableData))});
+		const __db = new alasql.Database(${JSON.stringify(dbId)});
+		try {
+			for (let i = 0; i < __rows.length; i++) {
+				__db.exec('CREATE TABLE input' + (i + 1));
+				__db.tables['input' + (i + 1)].data = __rows[i];
+			}
+			return JSON.stringify(__db.exec(${JSON.stringify(query)}));
+		} finally {
+			delete alasql.databases[${JSON.stringify(dbId)}];
+		}
+	})()`;
+
+	const resultJson = (await context.eval(script, { timeout: 5000, copy: true })) as string;
+	try {
+		return JSON.parse(resultJson) as IDataObject[];
+	} catch (e) {
+		throw new Error(`Failed to parse SQL result: ${(e as Error).message}`);
+	}
+}