n8n-io/n8n · error · SyntaxError

Failed to parse workflow code: ${error.message}. This code c

Error message

Failed to parse workflow code: ${error.message}. This code contains patterns that are not allowed for security reasons.

What it means

Thrown by parseWorkflowCode (the public WorkflowJSON-returning entry point) when interpretSDKCode raises a SecurityError. The security error is re-thrown as a standard SyntaxError with extra context ('patterns not allowed for security reasons'). This normalizes the error type so callers only need to catch SyntaxError.

Source

Thrown at packages/@n8n/workflow-sdk/src/codegen/parse-workflow-code.ts:623

export function parseWorkflowCode(code: string): WorkflowJSON {
	// Pre-process: handle double-escaped JSON strings (e.g., when code was JSON.stringify'd twice)
	// This converts literal \n to actual newlines, etc.
	const unescapedCode = unescapeJsonEscapeSequences(code);

	// Pre-process: escape n8n runtime variables in template literals
	// This prevents "$today is not defined" errors when parsing Code nodes
	const executableCode = escapeN8nVariables(unescapedCode);

	try {
		// Use AST interpreter instead of new Function() for security
		const wf = interpretSDKCode(executableCode, sdkFunctions);

		// Return the JSON representation
		return (wf as { toJSON: () => WorkflowJSON }).toJSON();
	} catch (error) {
		if (error instanceof SecurityError) {
			// Re-throw security errors with more context
			throw new SyntaxError(
				`Failed to parse workflow code: ${error.message}. ` +
					'This code contains patterns that are not allowed for security reasons.',
			);
		}
		if (error instanceof InterpreterError) {
			// Check for reserved SDK name conflicts
			if (error.message.includes('reserved SDK function name')) {
				throw new SyntaxError(`Failed to parse workflow code: ${error.message}`);
			}
			// Convert interpreter errors to syntax errors for consistent API
			throw new SyntaxError(
				`Failed to parse workflow code: ${error.message}. ` +
					'Common causes include unclosed template literals, missing commas, or unbalanced brackets.',
			);
		}
		throw error;
	}
}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Inspect the wrapped error.message — it includes the underlying SecurityError detail telling you which pattern was blocked.
2. Remove the offending security-violating construct (see the specific SecurityError: 1146–1152).
3. Regenerate the SDK code from a trusted source rather than editing it to include forbidden patterns.
4. Validate code with a lint step that rejects the same identifiers before calling parseWorkflowCode.

Example fix

// before — code passed to parseWorkflowCode contains:
// const fs = require('fs');

// after
// Remove the require; the builder cannot load modules.
// Re-generate the SDK code without forbidden constructs.

import { parseWorkflowCode } from '@n8n/workflow-sdk/codegen/parse-workflow-code';

// Pre-screen for the security patterns before calling parseWorkflowCode
function preflightSecurity(code: string): string[] {
  const issues: string[] = [];
  if (/\beval\s*\(/.test(code)) issues.push('eval() forbidden');
  if (/\b(new\s+)?Function\s*\(/.test(code)) issues.push('Function() forbidden');
  if (/\brequire\s*\(/.test(code)) issues.push('require() forbidden');
  if (/\.constructor\s*\(/.test(code)) issues.push('constructor call forbidden');
  if (/__proto__|\.prototype|\.constructor\b/.test(code)) issues.push('prototype access forbidden');
  return issues;
}

function looksSafe(code: string): boolean {
  return preflightSecurity(code).length === 0;
}

import { parseWorkflowCode } from '@n8n/workflow-sdk/codegen/parse-workflow-code';

try {
  const json = parseWorkflowCode(code);
} catch (e) {
  if (e instanceof SyntaxError && /not allowed for security reasons/.test(e.message)) {
    // e.message includes the underlying SecurityError detail; show it to the user
  }
  throw e;
}

When it happens

Trigger: Calling parseWorkflowCode(code) where code triggers any SecurityError during interpretation: eval/Function/require calls, constructor access, dynamic member access, dangerous globals, or __proto__/prototype/constructor access (errors 1146–1152).

Common situations: Round-tripping generated SDK code that was hand-edited to include forbidden patterns; feeding third-party-generated code through parseWorkflowCode; code that worked in eval but not in the secure interpreter.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Failed to parse workflow code: ${error.message}. Common caus
• Failed to parse workflow code: ${error.message}
• Security violation: '${name}' is not allowed
• Security violation: 'eval()' is not allowed
• Security violation: 'Function()' is not allowed

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/9affbf85d43de872. Report an issue: GitHub.