@aborruso/ckan-mcp-server 0.4.117 → 0.4.118

package/LOG.md

@@ -1,5 +1,21 @@
 # LOG
 
+## 2026-08-06
+
+### v0.4.118 — pin the fetch path to the validated IP
+
+`GHSA-r8hw-3fch-r42w` reported the v0.4.108 SSRF fix as bypassable by DNS rebinding, with a PoC pointing `ckan_package_search` at `7f000001.7f000001.rbndr.us`. Reproduced: the PoC is blocked. Both halves of that label decode to 127.0.0.1, so the name never rebinds — it is a plain DNS-name-to-loopback, the case v0.4.108 already closed. Replaying it against `localtest.me` with a listener on 127.0.0.1:8054 is rejected by `createSsrfSafeLookup`, and a genuine rebinding fake-DNS (public IP first, loopback second) through the axios agent produces exactly one lookup with the connection pinned to the validated address.
+
+The class was right on the wrong path, though. `safeFetch()` — used by `sparql_query` and the MQA quality tools — validated the hostname with `assertHostnameResolvesSafe()` and then let undici resolve it a second time, which is a real TOCTOU window. `getSafeDispatcher()` now builds an `undici.Agent({ connect: { lookup: createSsrfSafeLookup(dns) } })` and `safeFetch` passes it on every hop, so the socket connects to the address that was just checked. `assertHostnameResolvesSafe()` stays as defence in depth for runtimes without a dispatcher (Workers, where the CF sandbox blocks internal egress anyway).
+
+`undici` becomes an explicit dependency: it was only present transitively through wrangler, i.e. absent in production installs. The import specifier is assembled at runtime (`["und","ici"].join("")`) because esbuild constant-folds `"undici" + ""` and would otherwise bundle all of undici into `dist/index.js` (207 KB → 969 KB) and break the browser-platform Workers build.
+
+Same trap on the other side: because the specifier is dynamic, the DXT bundle cannot contain undici either, and a `.dxt` unpacked by Claude Desktop has no `node_modules` to resolve it from — the dispatcher would have been null and the pin silently inert. `pack:dxt` now copies `node_modules/undici` into `dxt-staging/server/node_modules/` (+1.7 MB uncompressed), verified by resolving it from a copy of the staging dir outside the repo.
+
+`engines.node` moves to `>=18.17.0`, undici 6's own floor — the old `>=18.0.0` would have promised installs that cannot work.
+
+Also fixed the `serverInfo` version, hardcoded at `0.4.108` in `src/server.ts` and `src/worker.ts` while the package was at 0.4.117.
+
 ## 2026-08-04
 
 ### v0.4.117 — escaping portal-controlled strings

package/dist/index.js

@@ -776,6 +776,22 @@ function getSafeAgents() {
   }
   return _safeAgents;
 }
+var _safeDispatcher = null;
+function getSafeDispatcher() {
+  if (!_safeDispatcher) {
+    _safeDispatcher = (async () => {
+      try {
+        const dnsMod = await import("node:dns");
+        const undiciSpecifier = ["und", "ici"].join("");
+        const undiciMod = await import(undiciSpecifier);
+        return new undiciMod.Agent({ connect: { lookup: createSsrfSafeLookup(dnsMod) } });
+      } catch {
+        return null;
+      }
+    })();
+  }
+  return _safeDispatcher;
+}
 var _dnsResolver = null;
 async function assertHostnameResolvesSafe(hostname) {
   let lookup;
@@ -806,9 +822,14 @@ async function assertHostnameResolvesSafe(hostname) {
 }
 async function safeFetch(url, init = {}, opts = {}) {
   const maxHops = opts.maxHops ?? 3;
+  const dispatcher = await getSafeDispatcher();
   let current = url;
   for (let hop = 0; ; hop++) {
-    const response = await fetch(current, { ...init, redirect: "manual" });
+    const response = await fetch(current, {
+      ...init,
+      redirect: "manual",
+      ...dispatcher ? { dispatcher } : {}
+    });
     const status = response.status;
     const location = response.headers.get("location");
     const isRedirect = (status === 301 || status === 302 || status === 303 || status === 307 || status === 308) && !!location;
@@ -5736,7 +5757,7 @@ var registerAllPrompts = (server) => {
 function createServer() {
   return new McpServer({
     name: "ckan-mcp-server",
-    version: "0.4.108"
+    version: "0.4.118"
   });
 }
 function registerAll(server) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aborruso/ckan-mcp-server",
-  "version": "0.4.117",
+  "version": "0.4.118",
   "mcpName": "io.github.aborruso/ckan-mcp-server",
   "description": "MCP server for interacting with CKAN open data portals",
   "repository": {
@@ -25,7 +25,7 @@
     "test:watch": "vitest --watch",
     "test:coverage": "vitest --coverage",
     "build:dxt": "esbuild src/index.ts --bundle --platform=node --format=cjs --outfile=dxt-staging/server/index.js",
-    "pack:dxt": "rm -rf dxt-staging && mkdir -p dxt-staging/server && npm run build:dxt && echo '{\"type\":\"commonjs\"}' > dxt-staging/server/package.json && cp manifest.json icon.png dxt-staging/ && dxt pack dxt-staging ckan-mcp-server.dxt && rm -rf dxt-staging",
+    "pack:dxt": "rm -rf dxt-staging && mkdir -p dxt-staging/server && npm run build:dxt && echo '{\"type\":\"commonjs\"}' > dxt-staging/server/package.json && mkdir -p dxt-staging/server/node_modules && cp -r node_modules/undici dxt-staging/server/node_modules/ && cp manifest.json icon.png dxt-staging/ && dxt pack dxt-staging ckan-mcp-server.dxt && rm -rf dxt-staging",
     "pack:skill": "mkdir -p tmp && cd skills && zip -r ../tmp/ckan-mcp.skill ckan-mcp/ && cd ..",
     "prepack": "cp README.md .readme-full.md && cp .readme-npm.md README.md",
     "postpack": "mv .readme-full.md README.md"
@@ -44,6 +44,7 @@
     "@modelcontextprotocol/sdk": "^1.27.1",
     "axios": "^1.7.2",
     "express": "^4.19.2",
+    "undici": "^6.28.0",
     "zod": "^3.23.8"
   },
   "devDependencies": {
@@ -70,6 +71,6 @@
     "AGENTS.md"
   ],
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=18.17.0"
   }
 }