Fix Credential Data Leak (FlowiseAI#6042)

Co-authored-by: christopherholland-workday <christopher.holland+evisort@workday.com>
Co-authored-by: yau-wd <yau.ong@workday.com>

Author: 3 people

packages/agentflow/src/infrastructure/api/credentials.test.ts

@@ -33,5 +33,15 @@ describe('bindCredentialsApi', () => {
             expect(mockClient.get).toHaveBeenCalledWith('/credentials', { params: { credentialName: 'openAIApi' } })
             expect(result).toEqual(mockCredentials)
         })
+
+        it('should not expose encryptedData in the response', async () => {
+            const mockCredentials = [{ id: '1', name: 'My OpenAI Key', credentialName: 'openAIApi' }]
+            ;(mockClient.get as jest.Mock).mockResolvedValue({ data: mockCredentials })
+
+            const result = await api.getCredentialsByName('openAIApi')
+            for (const credential of result) {
+                expect(credential).not.toHaveProperty('encryptedData')
+            }
+        })
     })
 })

packages/server/src/services/credentials/index.ts

@@ -60,15 +60,15 @@ const getAllCredentials = async (paramCredentialName: any, workspaceId: string)
                         ...getWorkspaceSearchOptions(workspaceId)
                     }
                     const credentials = await appServer.AppDataSource.getRepository(Credential).findBy(searchOptions)
-                    dbResponse.push(...credentials)
+                    dbResponse.push(...credentials.map((c) => omit(c, ['encryptedData'])))
                 }
             } else {
                 const searchOptions = {
                     credentialName: paramCredentialName,
                     ...getWorkspaceSearchOptions(workspaceId)
                 }
                 const credentials = await appServer.AppDataSource.getRepository(Credential).findBy(searchOptions)
-                dbResponse = [...credentials]
+                dbResponse = credentials.map((c) => omit(c, ['encryptedData']))
             }
             // get shared credentials
             if (workspaceId) {