@dollhousemcp/mcp-server 1.3.0

package/dist/test/src/elements/templates/Template.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Template element class implementing IElement interface.
+ * Represents reusable content structures with variable substitution and dynamic content.
+ *
+ * SECURITY FIXES IMPLEMENTED (Following PR #319 patterns):
+ * 1. CRITICAL: Template injection prevention - no eval() or Function() constructor
+ * 2. CRITICAL: Path traversal prevention for template includes
+ * 3. HIGH: Input validation and sanitization for all template variables
+ * 4. MEDIUM: Memory limits to prevent resource exhaustion (100KB templates, 100 variables)
+ * 5. MEDIUM: Audit logging for all security operations via SecurityMonitor
+ * 6. MEDIUM: Unicode normalization to prevent homograph attacks
+ */
+import { BaseElement } from '../BaseElement.js';
+import { IElement, IElementMetadata, ElementValidationResult } from '../../types/elements/index.js';
+export interface TemplateMetadata extends IElementMetadata {
+    category?: string;
+    output_format?: string;
+    variables?: TemplateVariable[];
+    includes?: string[];
+    tags?: string[];
+    usage_count?: number;
+    last_used?: string;
+    examples?: TemplateExample[];
+}
+export interface TemplateVariable {
+    name: string;
+    type: 'string' | 'number' | 'boolean' | 'date' | 'array' | 'object';
+    description?: string;
+    required?: boolean;
+    default?: unknown;
+    validation?: string;
+    options?: string[];
+    format?: string;
+}
+export interface TemplateExample {
+    title: string;
+    description?: string;
+    variables: Record<string, unknown>;
+    output?: string;
+}
+export declare class Template extends BaseElement implements IElement {
+    metadata: TemplateMetadata;
+    content: string;
+    private compiledTemplate?;
+    private readonly MAX_TEMPLATE_SIZE;
+    private readonly MAX_VARIABLE_COUNT;
+    private readonly MAX_INCLUDE_DEPTH;
+    private readonly MAX_STRING_LENGTH;
+    constructor(metadata: Partial<TemplateMetadata>, content?: string);
+    /**
+     * Validate include paths to prevent directory traversal
+     * SECURITY FIX #2: Prevents accessing files outside template directory
+     */
+    private isValidIncludePath;
+    /**
+     * Compile the template for efficient rendering
+     * SECURITY FIX #1: Safe template compilation without eval() or Function()
+     * Uses regex-based token replacement instead of dynamic code execution
+     */
+    private compile;
+    /**
+     * Render the template with provided variables
+     * SECURITY FIX #1: Safe rendering without code execution
+     * SECURITY FIX #3: All variables are validated and sanitized
+     * TYPE SAFETY: Strong typing for variables with runtime validation
+     */
+    render<T extends Record<string, unknown>>(variables?: T, includeDepth?: number): Promise<string>;
+    /**
+     * Validate and sanitize variables according to their definitions
+     * SECURITY FIX #3: Comprehensive validation of all input variables
+     * TYPE SAFETY: Improved type safety for variable validation
+     */
+    private validateAndSanitizeVariables;
+    /**
+     * Sanitize a single variable value according to its definition
+     * SECURITY FIX #3 & #6: Type-specific validation and Unicode normalization
+     */
+    private sanitizeVariableValue;
+    /**
+     * Recursively sanitize string values in objects
+     * SECURITY FIX: Truncate deep nesting instead of throwing to prevent DoS
+     */
+    private sanitizeObject;
+    /**
+     * Resolve nested variable paths (e.g., "user.name")
+     * TYPE SAFETY: Improved type safety for variable resolution
+     */
+    private resolveVariable;
+    /**
+     * Check if a regex pattern is potentially dangerous (ReDoS)
+     * SECURITY FIX: Detect patterns that could cause exponential backtracking
+     */
+    private isDangerousRegex;
+    /**
+     * Format a value for template output
+     */
+    private formatValue;
+    /**
+     * Process template includes
+     * SECURITY FIX #2: Safe include processing with path validation
+     *
+     * TODO: Implement actual include processing functionality
+     * This is currently a placeholder that validates the security model
+     * but does not actually load and render included templates.
+     *
+     * Future implementation should:
+     * 1. Load templates from validated paths
+     * 2. Render them with current variables
+     * 3. Replace include markers in content
+     * 4. Respect includeDepth limit
+     */
+    private processIncludes;
+    /**
+     * Template-specific validation
+     */
+    validate(): ElementValidationResult;
+    /**
+     * Serialize template to JSON format
+     */
+    serialize(): string;
+    /**
+     * Deserialize template from JSON format
+     */
+    deserialize(data: string): void;
+    /**
+     * Get a preview of the template with sample data
+     */
+    preview(): Promise<string>;
+    /**
+     * Template activation lifecycle
+     */
+    activate(): Promise<void>;
+    /**
+     * Template deactivation lifecycle
+     */
+    deactivate(): Promise<void>;
+}
+//# sourceMappingURL=Template.d.ts.map

package/dist/test/src/elements/templates/Template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Template.d.ts","sourceRoot":"","sources":["../../../../../src/elements/templates/Template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AASpG,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,QAAS,SAAQ,WAAY,YAAW,QAAQ;IAC5C,QAAQ,EAAE,gBAAgB,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAI5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAO;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAK;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAE,MAAW;IA0ErE;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAe1B;;;;OAIG;IACH,OAAO,CAAC,OAAO;IA2Bf;;;;;OAKG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5C,SAAS,GAAE,CAAW,EACtB,YAAY,GAAE,MAAU,GACvB,OAAO,CAAC,MAAM,CAAC;IAyDlB;;;;OAIG;YACW,4BAA4B;IAyC1C;;;OAGG;YACW,qBAAqB;IAwGnC;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6DtB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA6BxB;;OAEG;IACH,OAAO,CAAC,WAAW;IAoBnB;;;;;;;;;;;;;OAaG;YACW,eAAe;IA8B7B;;OAEG;IACa,QAAQ,IAAI,uBAAuB;IAyGnD;;OAEG;IACa,SAAS,IAAI,MAAM;IAenC;;OAEG;IACa,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IA+B/C;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IA8BhC;;OAEG;IACmB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAS/C;;OAEG;IACmB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAQlD"}