Fix: Disclosures

[0xi4o]

• Identifies areas where system information is unnecessarily logged and fixes them

Fixes:

• Add authentication flow for BullMQ dashboard, if enabled
• Remove the /api/v1/get-upload-path endpoint and move related logic to backend
• Remove /api/v1/metrics endpoint from whitelist and require API key authentication
• Remove hostname from log file names

[gemini-code-assist]

Summary of Changes

Hello @0xi4o, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the application's security posture by addressing several potential information disclosure vulnerabilities. It secures critical endpoints like the BullMQ dashboard and the metrics API, centralizes sensitive file path logic on the backend, and enhances log privacy. Additionally, it introduces a valuable new feature that enables users to export chatflow messages, providing greater control over their data.

Highlights

• Enhanced Security for BullMQ Dashboard: Implemented JWT-based authentication for the BullMQ dashboard, ensuring only authenticated users can access it.
• Secured Metrics Endpoint: The '/api/v1/metrics' endpoint now requires API key authentication, removing it from public whitelist access.
• Centralized File Path Logic: Removed the '/api/v1/get-upload-path' endpoint, moving its functionality to the backend for better control and security.
• Improved Logging Privacy: Removed hostname information from S3 log file names to reduce unnecessary system information disclosure.
• New Chatflow Message Export Feature: Introduced a new API endpoint and UI functionality to allow users to export chatflow messages, including associated files and artifacts.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces several security enhancements and a new feature for exporting chatflow messages. The security fixes include adding authentication to the BullMQ dashboard and the Prometheus metrics endpoint, removing an endpoint that disclosed system paths, and removing hostnames from log files. These are all valuable improvements to reduce information disclosure.

The new message export feature is well-implemented, moving the logic from the frontend to the backend. My review includes a critical comment on handling secrets in the Prometheus configuration, a suggestion to remove an unused import, and a recommendation to refactor duplicated code for better maintainability.

[HenryHengZJ]

can we update the docs as well? now that it requires an api key
https://docs.flowiseai.com/using-flowise/monitoring

[HenryHengZJ]

there is a method called parseJsonBody from flowise-components