Exclude nodes from the "core" package

[kenn...@centralite.com]

I'm looking at using NodeRED as the rules engine for my current project.  However, some of the core nodes are either not necessary or present a potential security or stability issue (exec, file, tail, etc).  Looking through the documentation, I can't see any way to exclude any of the "core" nodes.  Is it possible to do so?

[Dave C-J]

you can either disable them using the node-red-admin command line tool (or the node-red-contrib-admin someone contributed yesterday :-)  - OR you can just delete the nodes from the relevant directories - typically  node-red/nodes/core/...

[Nicholas O'Leary]

Or... use the nodesExcludes option. I thought it was documented, but apparently not.

You can see it in action here: https://github.com/node-red/node-red-bluemix-starter/blob/master/bluemix-settings.js#L36

Nick

On 15 January 2016 at 16:51, Dave C-J <dce...@gmail.com> wrote:

you can either disable them using the node-red-admin command line tool (or the node-red-contrib-admin someone contributed yesterday :-)  - OR you can just delete the nodes from the relevant directories - typically  node-red/nodes/core/...

--
http://nodered.org
---
You received this message because you are subscribed to the Google Groups "Node-RED" group.
To unsubscribe from this group and stop receiving emails from it, send an email to node-red+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Dave C-J]

Though if worried about security etc then deletion always the best option ;-)

[kenn...@centralite.com]

I gave this a shot and it works for anything under the "nodes/" folder, but doesn't cover packages included under the "node_modules/" folder like the serial port node.

Is that expected behavior?

[Mark Setrem]

which of the 3 different suggestions did you try?

[kenn...@centralite.com]

I used the "nodesExcludes" property in my settings object.

[Nicholas O'Leary]

"Expected" - yes

"Desirable" - no

You are right that the nodesExcludes property only applies to what we call 'local' files. The (flawed) theory being, those are typically the nodes that are preinstalled with node-red, and any provided by npm module can be excluded by not installing the npm module. But of course we complicated matters by moving some of the 'core' nodes to their own npm module and automatically pulling them in (ie serial).

We need to extend the ability of nodesExcludes to identify node modules/node sets that should not be loaded.

Nick

--

[Dave C-J]

though the three mentioned at top are (Exec, file and tail) are all core core ones...

I still suggest delete being the most absolute method to prevent execution.

[kenn...@centralite.com]

The "Serial" node is the main one left that I need to disable.

I agree that deleting guarantees the behavior I want, but if the core nodes I want removed are migrated to their own projects I'll have to manage what is deleted.  Seems more difficult to manage it that way in the long term.

Thanks for all the help.

[Dave C-J]

That's not to say we won't fix it as Nick suggests above... just that you started the thread talking about the (in)security of some extra nodes -  any node left lying around could potentially be re-activated if only turned off by a software switch.

[Nicholas O'Leary]

Having sat down to look at this, I discovered my previous self had been cleverer than I remembered.

To exclude a node module, list the node module name, not the individual node file name...

    nodesExcludes: [ "node-red-node-serialport" ],

It doesn't let you be finer grained (exclude specific nodes within the module), but that is what you want.

Nick