@cmd233/mcp-database-server 1.4.0 → 1.4.1

package/dist/src/db/sqlserver-adapter.js

@@ -296,6 +296,8 @@ export class SqlServerAdapter {
     getDescribeTableQuery(tableName) {
         // 验证并转义表名，防止 SQL 注入
         const escapedTableName = escapeIdentifier(tableName);
+        // 用于字符串比较（不带方括号）
+        const safeTableName = tableName.replace(/'/g, "''");
         return `
       SELECT
         c.COLUMN_NAME as name,
@@ -316,13 +318,13 @@ export class SqlServerAdapter {
             SELECT o.object_id
             FROM sys.objects o
             INNER JOIN sys.schemas s ON o.schema_id = s.schema_id
-            WHERE o.name = ${escapedTableName} AND s.name = c.TABLE_SCHEMA
+            WHERE o.name = '${safeTableName}' AND s.name = c.TABLE_SCHEMA
             AND o.type IN ('U', 'V')
           )
           AND ep.minor_id = c.ORDINAL_POSITION
           AND ep.name = 'MS_Description'
       WHERE
-        c.TABLE_NAME = ${escapedTableName}
+        c.TABLE_NAME = '${safeTableName}'
       ORDER BY
         c.ORDINAL_POSITION
     `;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cmd233/mcp-database-server",
-    "version": "1.4.0",
+    "version": "1.4.1",
     "description": "MCP server for interacting with SQLite, SQL Server, PostgreSQL and MySQL databases (Added stored procedure support and enhanced SQL injection protection)",
     "license": "MIT",
     "author": "cmd233",