@adobe/design-data-mcp 1.7.0 → 1.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -3
- package/src/tools/design-data.js +11 -2
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@adobe/design-data-mcp",
|
|
3
|
-
"version": "1.7.
|
|
3
|
+
"version": "1.7.1",
|
|
4
4
|
"description": "MCP server for Spectrum design tokens, component schemas, and design guidelines (embedded, offline)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -28,8 +28,8 @@
|
|
|
28
28
|
},
|
|
29
29
|
"dependencies": {
|
|
30
30
|
"@modelcontextprotocol/sdk": "^1.27.1",
|
|
31
|
-
"@adobe/
|
|
32
|
-
"@adobe/design-data
|
|
31
|
+
"@adobe/design-data-wasm": "0.4.0",
|
|
32
|
+
"@adobe/spectrum-design-data": "0.7.0"
|
|
33
33
|
},
|
|
34
34
|
"devDependencies": {
|
|
35
35
|
"@anthropic-ai/mcpb": "^2.1.2",
|
package/src/tools/design-data.js
CHANGED
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
|
|
19
19
|
import { createRequire } from "module";
|
|
20
20
|
import { readFileSync, existsSync } from "fs";
|
|
21
|
-
import { join, dirname } from "path";
|
|
21
|
+
import { join, dirname, resolve, sep } from "path";
|
|
22
22
|
|
|
23
23
|
let _wasm;
|
|
24
24
|
/** Lazy-load and cache the wasm module (nodejs target, no init() required). */
|
|
@@ -56,6 +56,10 @@ function resolveSpectrumDataPackage() {
|
|
|
56
56
|
* Load a JSON file from a subdirectory of the design-data package.
|
|
57
57
|
* Throws descriptive errors when the package or file is absent.
|
|
58
58
|
*
|
|
59
|
+
* Path safety: the resolved absolute path is asserted to stay within
|
|
60
|
+
* `<pkgRoot>/<subdir>/` so that a crafted `id` value (e.g. `../../etc/passwd`)
|
|
61
|
+
* cannot read files outside the intended data directory.
|
|
62
|
+
*
|
|
59
63
|
* @param {string} subdir - e.g. "components" or "guidelines"
|
|
60
64
|
* @param {string} id - kebab-case slug, e.g. "button" or "colors"
|
|
61
65
|
*/
|
|
@@ -67,7 +71,12 @@ function loadDataFile(subdir, id) {
|
|
|
67
71
|
`Install it with: pnpm add @adobe/spectrum-design-data`,
|
|
68
72
|
);
|
|
69
73
|
}
|
|
70
|
-
const
|
|
74
|
+
const baseDir = resolve(pkgRoot, subdir);
|
|
75
|
+
const filePath = resolve(baseDir, `${id}.json`);
|
|
76
|
+
// Containment check: reject any path that escapes the intended subdirectory.
|
|
77
|
+
if (!filePath.startsWith(baseDir + sep)) {
|
|
78
|
+
throw new Error(`Invalid ${subdir} id: "${id}"`);
|
|
79
|
+
}
|
|
71
80
|
if (!existsSync(filePath)) {
|
|
72
81
|
throw new Error(
|
|
73
82
|
`Not found: "${id}" in ${subdir}/. ` +
|