{"record":{"id":"9affbf85d43de872","repo":"n8n-io/n8n","slug":"failed-to-parse-workflow-code-error-message-t","errorCode":null,"errorMessage":"Failed to parse workflow code: ${error.message}. This code contains patterns that are not allowed for security reasons.","messagePattern":"Failed to parse workflow code: (.+?)\\. This code contains patterns that are not allowed for security reasons\\.","errorType":"exception","errorClass":"SyntaxError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/workflow-sdk/src/codegen/parse-workflow-code.ts","lineNumber":623,"sourceCode":"export function parseWorkflowCode(code: string): WorkflowJSON {\n\t// Pre-process: handle double-escaped JSON strings (e.g., when code was JSON.stringify'd twice)\n\t// This converts literal \\n to actual newlines, etc.\n\tconst unescapedCode = unescapeJsonEscapeSequences(code);\n\n\t// Pre-process: escape n8n runtime variables in template literals\n\t// This prevents \"$today is not defined\" errors when parsing Code nodes\n\tconst executableCode = escapeN8nVariables(unescapedCode);\n\n\ttry {\n\t\t// Use AST interpreter instead of new Function() for security\n\t\tconst wf = interpretSDKCode(executableCode, sdkFunctions);\n\n\t\t// Return the JSON representation\n\t\treturn (wf as { toJSON: () => WorkflowJSON }).toJSON();\n\t} catch (error) {\n\t\tif (error instanceof SecurityError) {\n\t\t\t// Re-throw security errors with more context\n\t\t\tthrow new SyntaxError(\n\t\t\t\t`Failed to parse workflow code: ${error.message}. ` +\n\t\t\t\t\t'This code contains patterns that are not allowed for security reasons.',\n\t\t\t);\n\t\t}\n\t\tif (error instanceof InterpreterError) {\n\t\t\t// Check for reserved SDK name conflicts\n\t\t\tif (error.message.includes('reserved SDK function name')) {\n\t\t\t\tthrow new SyntaxError(`Failed to parse workflow code: ${error.message}`);\n\t\t\t}\n\t\t\t// Convert interpreter errors to syntax errors for consistent API\n\t\t\tthrow new SyntaxError(\n\t\t\t\t`Failed to parse workflow code: ${error.message}. ` +\n\t\t\t\t\t'Common causes include unclosed template literals, missing commas, or unbalanced brackets.',\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}","sourceCodeStart":605,"sourceCodeEnd":641,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/workflow-sdk/src/codegen/parse-workflow-code.ts#L605-L641","documentation":"Thrown by parseWorkflowCode (the public WorkflowJSON-returning entry point) when interpretSDKCode raises a SecurityError. The security error is re-thrown as a standard SyntaxError with extra context ('patterns not allowed for security reasons'). This normalizes the error type so callers only need to catch SyntaxError.","triggerScenarios":"Calling parseWorkflowCode(code) where code triggers any SecurityError during interpretation: eval/Function/require calls, constructor access, dynamic member access, dangerous globals, or __proto__/prototype/constructor access (errors 1146–1152).","commonSituations":"Round-tripping generated SDK code that was hand-edited to include forbidden patterns; feeding third-party-generated code through parseWorkflowCode; code that worked in eval but not in the secure interpreter.","solutions":["Inspect the wrapped error.message — it includes the underlying SecurityError detail telling you which pattern was blocked.","Remove the offending security-violating construct (see the specific SecurityError: 1146–1152).","Regenerate the SDK code from a trusted source rather than editing it to include forbidden patterns.","Validate code with a lint step that rejects the same identifiers before calling parseWorkflowCode."],"exampleFix":"// before — code passed to parseWorkflowCode contains:\n// const fs = require('fs');\n\n// after\n// Remove the require; the builder cannot load modules.\n// Re-generate the SDK code without forbidden constructs.","handlingStrategy":"try-catch","validationCode":"import { parseWorkflowCode } from '@n8n/workflow-sdk/codegen/parse-workflow-code';\n\n// Pre-screen for the security patterns before calling parseWorkflowCode\nfunction preflightSecurity(code: string): string[] {\n  const issues: string[] = [];\n  if (/\\beval\\s*\\(/.test(code)) issues.push('eval() forbidden');\n  if (/\\b(new\\s+)?Function\\s*\\(/.test(code)) issues.push('Function() forbidden');\n  if (/\\brequire\\s*\\(/.test(code)) issues.push('require() forbidden');\n  if (/\\.constructor\\s*\\(/.test(code)) issues.push('constructor call forbidden');\n  if (/__proto__|\\.prototype|\\.constructor\\b/.test(code)) issues.push('prototype access forbidden');\n  return issues;\n}","typeGuard":"function looksSafe(code: string): boolean {\n  return preflightSecurity(code).length === 0;\n}","tryCatchPattern":"import { parseWorkflowCode } from '@n8n/workflow-sdk/codegen/parse-workflow-code';\n\ntry {\n  const json = parseWorkflowCode(code);\n} catch (e) {\n  if (e instanceof SyntaxError && /not allowed for security reasons/.test(e.message)) {\n    // e.message includes the underlying SecurityError detail; show it to the user\n  }\n  throw e;\n}","preventionTips":["Run a regex preflight for eval/Function/require/constructor/proto before calling parseWorkflowCode.","Only feed code from a trusted generator into parseWorkflowCode.","Catch SyntaxError specifically and read the embedded security detail."],"tags":["sdk","codegen","parse-workflow-code","security","syntax-error-wrapper"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}