@jgardner04/ghost-mcp-server 1.13.2 → 1.13.4

package/src/services/tierService.js

@@ -284,21 +284,8 @@ export function validateTierQueryOptions(options) {
   }
 }
 
-/**
- * Sanitizes a value for use in NQL filters to prevent injection
- * Escapes backslashes, single quotes, and double quotes
- * @param {string} value - The value to sanitize
- * @returns {string} The sanitized value
- */
-export function sanitizeNqlValue(value) {
-  if (!value) return value;
-  // Escape backslashes first, then quotes
-  return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/"/g, '\\"');
-}
-
 export default {
   validateTierData,
   validateTierUpdateData,
   validateTierQueryOptions,
-  sanitizeNqlValue,
 };

package/src/utils/__tests__/nqlSanitizer.test.js

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeNqlValue } from '../nqlSanitizer.js';
+
+describe('sanitizeNqlValue', () => {
+  it('should escape backslashes', () => {
+    expect(sanitizeNqlValue('hello\\world')).toBe('hello\\\\world');
+  });
+
+  it('should escape single quotes', () => {
+    expect(sanitizeNqlValue("it's")).toBe("it\\'s");
+  });
+
+  it('should escape double quotes', () => {
+    expect(sanitizeNqlValue('say "hello"')).toBe('say \\"hello\\"');
+  });
+
+  it('should escape all three special characters combined', () => {
+    expect(sanitizeNqlValue('a\\b\'c"d')).toBe('a\\\\b\\\'c\\"d');
+  });
+
+  it('should return null as-is', () => {
+    expect(sanitizeNqlValue(null)).toBe(null);
+  });
+
+  it('should return undefined as-is', () => {
+    expect(sanitizeNqlValue(undefined)).toBe(undefined);
+  });
+
+  it('should return empty string as-is', () => {
+    expect(sanitizeNqlValue('')).toBe('');
+  });
+
+  it('should pass through normal strings without special characters', () => {
+    expect(sanitizeNqlValue('simple-value')).toBe('simple-value');
+    expect(sanitizeNqlValue('test@example.com')).toBe('test@example.com');
+    expect(sanitizeNqlValue('hello world 123')).toBe('hello world 123');
+  });
+});

package/src/utils/nqlSanitizer.js

@@ -0,0 +1,11 @@
+/**
+ * Sanitizes a value for use in NQL (Ghost's filter query language) to prevent injection.
+ * Escapes backslashes, single quotes, and double quotes.
+ * @param {string} value - The value to sanitize
+ * @returns {string} The sanitized value
+ */
+export function sanitizeNqlValue(value) {
+  if (!value) return value;
+  // Escape backslashes first, then quotes
+  return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/"/g, '\\"');
+}