@imenam/mcp-documentor 1.0.103 → 1.0.104

package/README.md

@@ -152,6 +152,8 @@ Images can be embedded in any documentation entry using standard markdown syntax
 ![alt text](https://example.com/diagram.png)          <!-- external URL -->
 ```
 
+The GUI serves uploaded images under `/api/images/<project>/<file>`, where `<project>` and `<file>` are single path segments; any other shape is refused. Images are served with `X-Content-Type-Options: nosniff` and a `sandbox` Content-Security-Policy, so an SVG opened on its own runs no script.
+
 **Via the MCP tool** — use `upload_image` with the absolute path of the file on the server:
 
 ```json

package/dist/src/gui-worker.js

@@ -1016,6 +1016,8 @@ app.post("/api/images", async (c) => {
     const project = c.req.query("project");
     if (!project)
         return c.json({ error: "project is required" }, 400);
+    if (!isSafeSegment(project))
+        return c.json({ error: "project must be a single path segment" }, 400);
     let body;
     try {
         body = await c.req.parseBody();
@@ -1035,6 +1037,8 @@ app.post("/api/images", async (c) => {
 });
 app.get("/api/images/:project", (c) => {
     const project = c.req.param("project");
+    if (!isSafeSegment(project))
+        return c.json({ error: "project must be a single path segment" }, 400);
     const assetsDir = path.join(dataDir, "projects", project, "assets");
     if (!fs.existsSync(assetsDir))
         return c.json([]);
@@ -1044,13 +1048,20 @@ app.get("/api/images/:project", (c) => {
 app.get("/api/images/:project/:filename", (c) => {
     const project = c.req.param("project");
     const filename = c.req.param("filename");
+    if (!isSafeSegment(project) || !isSafeSegment(filename))
+        return c.notFound();
     const filePath = path.join(dataDir, "projects", project, "assets", filename);
     if (!fs.existsSync(filePath))
         return c.notFound();
     const ext = path.extname(filename).toLowerCase().slice(1);
     const mime = IMAGE_MIME[ext] ?? "application/octet-stream";
     return new Response(fs.readFileSync(filePath), {
-        headers: { "Content-Type": mime },
+        headers: {
+            "Content-Type": mime,
+            "X-Content-Type-Options": "nosniff",
+            // An SVG opened on its own must not run scripts under the hub's origin.
+            "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+        },
     });
 });
 // Static files

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imenam/mcp-documentor",
-  "version": "1.0.103",
+  "version": "1.0.104",
   "main": "dist/src/index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",