feat(trigger-docs): new trigger docs, function block rce imports fix

[icecrasher321]

Summary

• New trigger docs
• Fix function block remote code execution issue with imports for Javascript runtime

Type of Change

• Bug fix

Testing

Docs pages read and function block tested locally with e2b env vars set

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Ready	Preview	Comment	Sep 26, 2025 11:32pm
sim	Ready	Preview	Comment	Sep 26, 2025 11:32pm

[greptile-apps]

Greptile Overview

Summary

This PR delivers two main improvements: comprehensive trigger documentation and a critical security fix for JavaScript function execution.

Key Changes:

• New Trigger Documentation: Added complete documentation for all trigger types (API, Chat, Input Form, Manual, etc.) with clear examples, reference tables, and usage guidance
• RCE Security Fix: Implemented proper JavaScript import extraction using TypeScript AST parsing to prevent remote code execution vulnerabilities in function blocks
• Minor UI Fix: Added z-index styling for workflow edge label visibility

The import extraction fix is particularly important as it securely handles JavaScript imports in user-provided code by separating them from the main execution body, preventing potential security exploits. The documentation provides users with clear guidance on workflow triggers, improving the platform's usability.

Confidence Score: 4/5

• This PR is safe to merge with minor considerations for CSS organization
• Score reflects well-implemented security fixes and comprehensive documentation. The import extraction logic is properly implemented with TypeScript AST parsing and error handling. Only minor style consideration is the globals.css edit which could be better placed in a component file.
• apps/sim/app/globals.css - consider moving z-index style to local component

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/app/api/function/execute/route.ts	4/5	Added comprehensive JavaScript import extraction and RCE security fix with proper AST parsing
apps/sim/app/globals.css	5/5	Minor CSS z-index fix for workflow edge labels visibility
apps/docs/content/docs/en/triggers/index.mdx	5/5	New comprehensive trigger documentation with clear overview and comparison table
apps/docs/content/docs/en/triggers/api.mdx	5/5	Complete API trigger documentation with examples and reference tables
apps/docs/content/docs/en/triggers/chat.mdx	5/5	Chat trigger documentation with runtime outputs and usage guidance

Sequence Diagram

sequenceDiagram
    participant User as User
    participant API as Function Execute API
    participant Parser as Import Parser
    participant E2B as E2B Sandbox
    participant VM as Local VM

    User->>API: POST /api/function/execute
    Note over API: resolveCodeVariables()
    API->>Parser: extractJavaScriptImports(code)
    Parser->>Parser: Load TypeScript AST
    Parser->>Parser: Parse import statements
    Parser-->>API: {imports, remainingCode, importLineCount}
    
    alt E2B Execution
        API->>E2B: executeInE2B(importSection + prologue + wrapped)
        E2B-->>API: {result, stdout, error}
        alt Error Case
            API->>API: formatE2BError(error, stdout, lang, userCode, prologueLineCount + importLineCount)
            API-->>User: {success: false, error: formattedError}
        else Success Case
            API-->>User: {success: true, output: {result, stdout}}
        end
    else Local VM Execution
        API->>VM: script.runInContext(context, timeout)
        VM-->>API: result
        alt Error Case
            API->>API: extractEnhancedError(error, userCodeStartLine, resolvedCode)
            API-->>User: {success: false, error: userFriendlyErrorMessage}
        else Success Case
            API-->>User: {success: true, output: {result, stdout}}
        end
    end

Loading

_{13 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}