{"record":{"id":"d2b7fdcf026fd7d6","repo":"n8n-io/n8n","slug":"security-violation-function-is-not-allowed","errorCode":null,"errorMessage":"Security violation: 'Function()' is not allowed","messagePattern":"Security violation: 'Function\\(\\)' is not allowed","errorType":"exception","errorClass":"SecurityError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts","lineNumber":302,"sourceCode":"): void {\n\tif (DANGEROUS_GLOBALS.has(name)) {\n\t\tthrow new SecurityError(name, node.loc ?? undefined, sourceCode);\n\t}\n}\n\n/**\n * Validate a function call expression.\n * @throws SecurityError if the call is dangerous\n */\nexport function validateCallExpression(node: CallExpression, sourceCode: string): void {\n\t// Check for dangerous patterns like eval(\"...\")\n\tif (node.callee.type === 'Identifier') {\n\t\tconst name = node.callee.name;\n\t\tif (name === 'eval') {\n\t\t\tthrow new SecurityError('eval()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'Function') {\n\t\t\tthrow new SecurityError('Function()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t\tif (name === 'require') {\n\t\t\tthrow new SecurityError('require()', node.loc ?? undefined, sourceCode);\n\t\t}\n\t}\n\n\t// Check for dangerous patterns like global.constructor.constructor\n\tif (node.callee.type === 'MemberExpression') {\n\t\tconst memberExpr = node.callee;\n\t\tif (memberExpr.property.type === 'Identifier' && memberExpr.property.name === 'constructor') {\n\t\t\tthrow new SecurityError('constructor access', node.loc ?? undefined, sourceCode);\n\t\t}\n\t}\n}\n\n/**\n * Validate a member expression.\n * @throws SecurityError if the access is dangerous","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/workflow-sdk/src/ast-interpreter/validators.ts#L284-L320","documentation":"Thrown by validateCallExpression when a CallExpression's callee is an Identifier named 'Function'. `Function(...)` is the Function constructor, which compiles and executes arbitrary strings — equivalent to eval. Blocked as a hard security boundary.","triggerScenarios":"SDK code containing `new Function(...)` or `Function(...)` calls. Both `new Function('return ...')()` and `Function('...')()` are caught because the callee Identifier is 'Function'.","commonSituations":"Metaprogramming; building dynamic callbacks; polyfills; code that constructs functions from strings.","solutions":["Remove all Function() constructor calls.","Use static function definitions where allowed, or express the logic via the SDK DSL (factory functions, builder methods).","If dynamic behavior is required, run it in a Code node at execution time, not in the SDK builder."],"exampleFix":"// before\nconst fn = new Function('x', 'return x * 2');\n\n// after\n// SDK builder code is declarative — express the operation as a parameter\nexport default workflow()\n  .add(node('Set').parameters({ doubled: '={{ $json.x * 2 }}' }));","handlingStrategy":"validation","validationCode":"function containsFunctionCtor(code: string): boolean {\n  return /\\bFunction\\s*\\(/.test(code) || /\\bnew\\s+Function\\s*\\(/.test(code);\n}","typeGuard":"function usesFunctionConstructor(code: string): boolean {\n  return /\\b(new\\s+)?Function\\s*\\(/.test(code);\n}","tryCatchPattern":"import { interpretSDKCode } from '@n8n/workflow-sdk/ast-interpreter/interpreter';\nimport { SecurityError } from '@n8n/workflow-sdk/ast-interpreter/errors';\n\ntry {\n  interpretSDKCode(code, sdkFunctions);\n} catch (e) {\n  if (e instanceof SecurityError && e.pattern === 'Function()') {\n    // hard block — instruct removal of Function constructor\n  }\n  throw e;\n}","preventionTips":["Ban the Function constructor via lint (no-new-func rule).","Express callbacks via the SDK DSL, not dynamically-constructed functions.","Run dynamic logic in a Code node."],"tags":["sdk","validators","security","function-constructor","code-injection"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}