{"record":{"id":"4c3540964e12773a","repo":"n8n-io/n8n","slug":"security-violation-name-is-not-allowed","errorCode":null,"errorMessage":"Security violation: '${name}' is not allowed","messagePattern":"Security violation: '(.+?)' is not allowed","errorType":"exception","errorClass":"SecurityError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts","lineNumber":286,"sourceCode":"\t}\n\n\tif (!ALLOWED_NODE_TYPES.has(node.type)) {\n\t\tthrow new UnsupportedNodeError(node.type, node.loc ?? undefined, sourceCode);\n\t}\n}\n\n/**\n * Check if an identifier is a dangerous global.\n * @throws SecurityError if the identifier is dangerous\n */\nexport function validateIdentifier(\n\tname: string,\n\t_allowedVariables: Set<string>,\n\tnode: Node,\n\tsourceCode: string,\n): void {\n\tif (DANGEROUS_GLOBALS.has(name)) {\n\t\tthrow new SecurityError(name, node.loc ?? undefined, sourceCode);\n\t}\n}\n\n/**\n * Validate a function call expression.\n * @throws SecurityError if the call is dangerous\n */\nexport function validateCallExpression(node: CallExpression, sourceCode: string): void {\n\t// Check for dangerous patterns like eval(\"...\")\n\tif (node.callee.type === 'Identifier') {\n\t\tconst name = node.callee.name;\n\t\tif (name === 'eval') {\n\t\t\tthrow new SecurityError('eval()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'Function') {\n\t\t\tthrow new SecurityError('Function()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'require') {","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts#L268-L304","documentation":"Thrown by validateIdentifier when an identifier name is in DANGEROUS_GLOBALS — the set derived from BUILDER_BLOCKED_GLOBALS (eval, Function, require, process, global, globalThis, window, document, setTimeout, console, Buffer, Promise, Date, Math, JSON-as-object, etc.). Referencing any of these as an identifier in SDK code is a security violation.","triggerScenarios":"Referencing `process.env.X`, `console.log(...)`, `globalThis`, `require('...')`, `setTimeout(...)`, `new Date()`, `Math.random()`, `Buffer.from(...)`, `Promise.resolve()`, or any other blocked global as a bare identifier in SDK builder code.","commonSituations":"Pasting Node.js code that reads process.env; debugging with console.log; using Date/ Math/ JSON.parse (only JSON.stringify is whitelisted via getSafeJSONMethod); Promise-based code; accessing window/document in shared snippets.","solutions":["Remove the blocked global reference — compute the value at runtime in a Code node or via an n8n expression ($json, $now, $today).","For Date/now: use the $now or $today helpers inside expr() instead of `new Date()`.","For JSON: only JSON.stringify is allowed; for parsing, do it in a Code node.","For configuration: pass values as node parameters resolved at runtime, not via process.env in builder code."],"exampleFix":"// before\nconst delay = setTimeout(() => {}, 100);\nconst env = process.env.MY_KEY;\n\n// after (move to runtime Code node)\n// In SDK builder: declare a parameter placeholder\nexport default workflow()\n  .add(node('Set').parameters({ key: '={{ $env.MY_KEY }}' }));","handlingStrategy":"validation","validationCode":"import { DANGEROUS_GLOBALS } from '@n8n/workflow-sdk/ast-interpreter/validators';\n\nfunction findDangerousIdents(code: string): string[] {\n  const found = new Set<string>();\n  for (const name of DANGEROUS_GLOBALS) {\n    const re = new RegExp(`\\\\b${name}\\\\b`);\n    if (re.test(code)) found.add(name);\n  }\n  return [...found];\n}","typeGuard":"import { DANGEROUS_GLOBALS } from '@n8n/workflow-sdk/ast-interpreter/validators';\n\nfunction isDangerousGlobal(name: string): boolean {\n  return DANGEROUS_GLOBALS.has(name);\n}","tryCatchPattern":"import { interpretSDKCode } from '@n8n/workflow-sdk/ast-interpreter/interpreter';\nimport { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';\n\ntry {\n  interpretSDKCode(code, sdkFunctions);\n} catch (e) {\n  if (e instanceof SecurityError && !/[()]/.test(e.pattern)) {\n    // e.pattern is the bare identifier name; show BUILDER_BLOCKED_GLOBALS alternative\n  }\n  throw e;\n}","preventionTips":["Keep BUILDER_BLOCKED_GLOBALS visible; it lists allowed alternatives (e.g., use $now/$today for Date).","Never reference process/console/require/global/window in builder code.","Move env reads and Date/Math/JSON.parse to runtime Code nodes or expressions."],"tags":["sdk","validators","security","dangerous-globals"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}