(template: string, webhook: Record<string, any> | undefined | null)
| 108 | * Unknown references are left as-is. |
| 109 | */ |
| 110 | const resolveWebhookRefs = (template: string, webhook: Record<string, any> | undefined | null): string => { |
| 111 | if (!template) return '' |
| 112 | if (!webhook) return template |
| 113 | return template.replace(/{{(.*?)}}/g, (match, ref) => { |
| 114 | const path = ref.trim() |
| 115 | if (!path.startsWith('$webhook.')) return match |
| 116 | // Block prototype-walking paths defensively — lodash.get follows __proto__/constructor/prototype. |
| 117 | const subPath = path.replace('$webhook.', '') |
| 118 | if (/(^|\.)(__proto__|constructor|prototype)(\.|$)/.test(subPath)) return match |
| 119 | const val = get(webhook, subPath) |
| 120 | if (val == null) return match |
| 121 | return Array.isArray(val) || (typeof val === 'object' && val !== null) ? JSON.stringify(val) : String(val) |
| 122 | }) |
| 123 | } |
| 124 | |
| 125 | interface IExecuteNodeParams { |
| 126 | nodeId: string |
no test coverage detected