fix(apply_tweaks): skip tweaks to code field and log warning (#9467)

* fix: add security warning for overriding code field in tweaks

* test: add tests for preventing code field overrides in tweaks

src/backend/base/langflow/processing/process.py

@@ -147,6 +147,9 @@ def apply_tweaks(node: dict[str, Any], node_tweaks: dict[str, Any]) -> None:
     for tweak_name, tweak_value in node_tweaks.items():
         if tweak_name not in template_data:
             continue
+        if tweak_name == "code":
+            logger.warning("Security: Code field cannot be overridden via tweaks.")
+            continue
         if tweak_name in template_data:
             if template_data[tweak_name]["type"] == "NestedDict":
                 value = validate_and_repair_json(tweak_value)

src/backend/tests/unit/test_process.py

@@ -306,3 +306,71 @@ async def test_load_langchain_object_with_cached_session(basic_graph_data):
 #     )
 #
 #     assert graph1 == graph2
+
+
+def test_apply_tweaks_code_override_prevention():
+    """Test that code tweaks are prevented and logged as warning."""
+    from unittest.mock import patch
+
+    from langflow.processing.process import apply_tweaks
+
+    # Create a simple node with template including code field
+    node = {
+        "id": "test_node",
+        "data": {
+            "node": {
+                "template": {
+                    "code": {"value": "original_code", "type": "code"},
+                    "param1": {"value": "original_value", "type": "str"},
+                }
+            }
+        },
+    }
+
+    # Try to tweak both code and a normal parameter
+    node_tweaks = {"code": "malicious_code_injection", "param1": "new_value"}
+
+    # Capture log output
+    with patch("langflow.processing.process.logger") as mock_logger:
+        apply_tweaks(node, node_tweaks)
+
+        # Verify warning was logged for code override attempt
+        mock_logger.warning.assert_called_once_with("Security: Code field cannot be overridden via tweaks.")
+
+    # Verify code field was NOT modified
+    assert node["data"]["node"]["template"]["code"]["value"] == "original_code"
+
+    # Verify other parameter WAS modified
+    assert node["data"]["node"]["template"]["param1"]["value"] == "new_value"
+
+
+def test_apply_tweaks_code_only_prevention():
+    """Test that only code tweaks are prevented when trying to override code alone."""
+    from unittest.mock import patch
+
+    from langflow.processing.process import apply_tweaks
+
+    # Create a simple node with template including code field
+    node = {
+        "id": "test_node",
+        "data": {
+            "node": {
+                "template": {
+                    "code": {"value": "original_code", "type": "code"},
+                }
+            }
+        },
+    }
+
+    # Try to tweak only the code field
+    node_tweaks = {"code": "attempted_code_injection"}
+
+    # Capture log output
+    with patch("langflow.processing.process.logger") as mock_logger:
+        apply_tweaks(node, node_tweaks)
+
+        # Verify warning was logged
+        mock_logger.warning.assert_called_once_with("Security: Code field cannot be overridden via tweaks.")
+
+    # Verify code field was NOT modified
+    assert node["data"]["node"]["template"]["code"]["value"] == "original_code"