High risk
Persistent workflows can send record fields to arbitrary external HTTP endpoints
Source references: 5What we found
Workflows support HTTP requests whose URL, headers, and body can combine literal text with references to prior-step record fields. The supplied example sends a lead name, mobile number, company, owner, and record ID to an external CRM.
Why this matters
If the destination, field selection, or trigger is wrong, every workflow run may repeatedly disclose customer or business data to an external system after the workflow is enabled.
This capability creates a plausible data-export risk, though the example is not self-executing malicious code. If a user creates and enables a persistent Workflow containing `HTTPClientAction`, its URL, headers, and body can combine text with prior record fields and send them externally; the example includes a phone number, company, owner, and record ID. Users should verify the destination, fields, trigger, and enabled state before authorization.
Workflow 本身是 Base Block，其内部是一张由 `next` / `children` 连接的 steps 执行图；触发器、动作、条件分支和循环都是 step 类型。它适合定时执行、Record 新增或变更联动、消息通知、记录读写和跨系统调用。Workflow 分为三条操作路径：1. **读取配置：** `+workflow-list` 定位流程，`+workflow-get` 读取 `title`、`status` 和完整 `steps` 执行图。2. **写入配置：** `+workflow-create` 创建完整定义，`+workflow-update` 更新完整定义；构造或修改配置前读取 [Workflow](references/lark-base-workflow.md)，由该入口继续路由 step 类型和 schema。3. **运行状态控制：** `+workflow-enable` / `+workflow-disable` 启用或停用已有 Workflow，不修改 steps 执行图。Show 4 other places
{ "id": "step_call_crm_api", "type": "HTTPClientAction", "title": "调用 CRM 同步接口", "next": "step_add_sync_log", "data": { "method": "POST", "url": [ { "value_type": "text", "value": "https://api.example-crm.com/v1/leads/sync" } ], "headers": [ { "key": "Content-Type", "value": [{ "value_type": "text", "value": "application/json" }] }, { "key": "X-System", "value": [{ "value_type": "text", "value": "lark_base_workflow" }] } ], "body_type": "raw", "raw_body": [ { "value_type": "text", "value": "{\"lead_name\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldLeadName" }, { "value_type": "text", "value": "\",\"mobile\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldMobile" }, { "value_type": "text", "value": "\",\"company\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldCompany" }, { "value_type": "text", "value": "\",\"owner\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldOwner" }, { "value_type": "text", "value": "\",\"source_record_id\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.recordId" }, { "value_type": "text", "value": "\"}" } ], "response_type": "json", "response_value": "{\"success\":true,\"message\":\"lead synced successfully\"}" }## Workflow BlockWorkflow 本身是 Base Block，其内部是一张由 `next` / `children` 连接的 steps 执行图；触发器、动作、条件分支和循环都是 step 类型。它适合定时执行、Record 新增或变更联动、消息通知、记录读写和跨系统调用。Workflow 分为三条操作路径：1. **读取配置：** `+workflow-list` 定位流程，`+workflow-get` 读取 `title`、`status` 和完整 `steps` 执行图。2. **写入配置：** `+workflow-create` 创建完整定义，`+workflow-update` 更新完整定义；构造或修改配置前读取 [Workflow](references/lark-base-workflow.md)，由该入口继续路由 step 类型和 schema。3. **运行状态控制：** `+workflow-enable` / `+workflow-disable` 启用或停用已有 Workflow，不修改 steps 执行图。| 字段 | 必填 | 说明 ||------|-----|------|| `method` | 否 | 请求方法：`GET` / `POST` / `PUT` / `PATCH` / `DELETE`，默认 `POST` || `url` | 是 | ValueInfo[]，请求 URL，支持 `text` / `ref` 拼接 || `queries` | 否 | KeyValue[]，查询参数 || `headers` | 否 | KeyValue[]，请求头 || `body_type` | 否 | 请求体类型：`none` / `raw` / `form-data` / `form-urlencoded`，默认 `raw` || `raw_body` | 否 | ValueInfo[]，原始请求体，仅 `body_type=raw` 时使用 || `form_body` | 否 | KeyValue[]，表单数据，仅 `body_type=form-data` 或 `body_type=form-urlencoded` 时使用 || `response_type` | 否 | 响应类型：`none` / `text` / `json`，默认 `json` || `response_value` | 否 | string，JSON 字符串形式的响应结果示例；仅当 `response_type=json` 时必填 | "method": "POST", "url": [ { "value_type": "text", "value": "https://api.example-crm.com/v1/leads/sync" } ], "headers": [ { "key": "Content-Type", "value": [{ "value_type": "text", "value": "application/json" }] }, { "key": "X-System", "value": [{ "value_type": "text", "value": "lark_base_workflow" }] } ], "body_type": "raw", "raw_body": [ { "value_type": "text", "value": "{\"lead_name\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldLeadName" }, { "value_type": "text", "value": "\",\"mobile\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldMobile" }, { "value_type": "text", "value": "\",\"company\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldCompany" }, { "value_type": "text", "value": "\",\"owner\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldOwner" }, { "value_type": "text", "value": "\",\"source_record_id\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.recordId" }, { "value_type": "text", "value": "\"}" } ],