@juspay/neurolink 13.0.3 → 13.1.1

package/dist/mcp/mcpRegistryRemote.js

@@ -0,0 +1,289 @@
+/**
+ * Remote registry helpers for MCPRegistryClient
+ *
+ * Pure functions that resolve a registry configuration to an API base URL,
+ * validate responses from the official MCP Registry API (`/v0.1`) and map its
+ * server records to `McpRegistryEntry`. Nothing here performs I/O.
+ *
+ * API reference (spec `2025-12-01`):
+ * https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/openapi.yaml
+ *
+ * @module mcp/mcpRegistryRemote
+ */
+/**
+ * Base URL of the official MCP Registry
+ */
+export const OFFICIAL_REGISTRY_URL = "https://registry.modelcontextprotocol.io";
+const API_VERSION_SEGMENT = "/v0.1";
+/**
+ * Key under which the official registry reports status and timestamps in `_meta`
+ */
+const OFFICIAL_META_KEY = "io.modelcontextprotocol.registry/official";
+// A registry is untrusted input, and a custom registry URL is a supported
+// feature. The npm identifier and version end up in an `npx` argv element and
+// in an install command a user may paste into a shell, so they must be valid
+// npm names and versions, not merely strings. The grammar is the npm
+// package-name rule for new packages (optional `@scope/`, lowercase letters,
+// digits and `._~-`, never a leading dash, dot or underscore) and a
+// conservative version rule (starts alphanumeric). Anything else is not run.
+const NPM_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+const NPM_PACKAGE_NAME_MAX_LENGTH = 214;
+const NPM_VERSION = /^[0-9A-Za-z][0-9A-Za-z.+_~-]*$/;
+const NPM_VERSION_MAX_LENGTH = 128;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(record, key) {
+    const value = record[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function arrayField(record, key) {
+    const value = record[key];
+    return Array.isArray(value) ? value : [];
+}
+function compact(items) {
+    return items.filter((item) => item !== undefined);
+}
+function isLoopbackHost(hostname) {
+    return (hostname === "localhost" ||
+        hostname === "[::1]" ||
+        /^127(?:\.\d{1,3}){3}$/.test(hostname));
+}
+/**
+ * Resolve a registry configuration to the API base URL the client queries.
+ *
+ * Returns `undefined` for registries the client does not query: `npm` and
+ * `github` sources, a `custom` registry without a URL, any URL that is not
+ * plain `http(s)` or that embeds credentials (fetch rejects those, and they
+ * would end up in logs), and a registry with an `authToken` on plain `http:`
+ * to a non-loopback host (the bearer token would cross the network in clear).
+ */
+export function resolveRemoteTarget(config) {
+    if (config.type !== "official" && config.type !== "custom") {
+        return undefined;
+    }
+    const rawUrl = config.url ?? (config.type === "official" ? OFFICIAL_REGISTRY_URL : "");
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return undefined;
+    }
+    if ((parsed.protocol !== "https:" && parsed.protocol !== "http:") ||
+        parsed.username !== "" ||
+        parsed.password !== "") {
+        return undefined;
+    }
+    if (config.authToken &&
+        parsed.protocol === "http:" &&
+        !isLoopbackHost(parsed.hostname)) {
+        return undefined;
+    }
+    const path = parsed.pathname.replace(/\/+$/, "");
+    const apiPath = path.endsWith(API_VERSION_SEGMENT)
+        ? path
+        : `${path}${API_VERSION_SEGMENT}`;
+    return { config, apiBase: `${parsed.origin}${apiPath}` };
+}
+function parseInput(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const name = stringField(value, "name");
+    return name === undefined
+        ? undefined
+        : {
+            name,
+            isRequired: value.isRequired === true,
+            isSecret: value.isSecret === true,
+        };
+}
+function parseTransport(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const type = stringField(value, "type");
+    if (type === undefined) {
+        return undefined;
+    }
+    const url = stringField(value, "url");
+    return url === undefined ? { type } : { type, url };
+}
+function parsePackage(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const registryType = stringField(value, "registryType");
+    const identifier = stringField(value, "identifier");
+    if (registryType === undefined || identifier === undefined) {
+        return undefined;
+    }
+    const version = stringField(value, "version");
+    const transport = parseTransport(value.transport);
+    return {
+        registryType,
+        identifier,
+        ...(version === undefined ? {} : { version }),
+        ...(transport === undefined ? {} : { transport }),
+        environmentVariables: compact(arrayField(value, "environmentVariables").map(parseInput)),
+    };
+}
+function parseServer(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const name = stringField(value, "name");
+    if (name === undefined) {
+        return undefined;
+    }
+    const repository = isRecord(value.repository) ? value.repository : undefined;
+    const repositoryUrl = repository === undefined ? undefined : stringField(repository, "url");
+    const websiteUrl = stringField(value, "websiteUrl");
+    return {
+        name,
+        description: stringField(value, "description") ?? "",
+        version: stringField(value, "version") ?? "",
+        ...(repositoryUrl === undefined ? {} : { repositoryUrl }),
+        ...(websiteUrl === undefined ? {} : { websiteUrl }),
+        packages: compact(arrayField(value, "packages").map(parsePackage)),
+        remotes: compact(arrayField(value, "remotes").map(parseTransport)),
+    };
+}
+/**
+ * Validate one `ServerResponse` (`{ server, _meta }`) from the registry.
+ * Returns `undefined` when it carries no usable server, so a bad record can
+ * be skipped without discarding its neighbours.
+ */
+export function parseRemoteRecord(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const server = parseServer(value.server);
+    if (server === undefined) {
+        return undefined;
+    }
+    const meta = isRecord(value._meta) ? value._meta : undefined;
+    const official = meta !== undefined ? meta[OFFICIAL_META_KEY] : undefined;
+    const status = isRecord(official)
+        ? stringField(official, "status")
+        : undefined;
+    const updatedAt = isRecord(official)
+        ? stringField(official, "updatedAt")
+        : undefined;
+    return {
+        server,
+        ...(status === undefined ? {} : { status }),
+        ...(updatedAt === undefined ? {} : { updatedAt }),
+    };
+}
+/**
+ * Validate a `ServerList` response (`{ servers, metadata: { nextCursor } }`).
+ * Throws when `servers` is not an array, which the caller reports as a
+ * malformed registry; individual bad records are skipped.
+ */
+export function parseRemotePage(value) {
+    if (!isRecord(value) || !Array.isArray(value.servers)) {
+        throw new Error("registry list response has no servers array");
+    }
+    const metadata = isRecord(value.metadata) ? value.metadata : undefined;
+    const nextCursor = metadata === undefined ? undefined : stringField(metadata, "nextCursor");
+    return {
+        records: compact(value.servers.map(parseRemoteRecord)),
+        ...(nextCursor === undefined ? {} : { nextCursor }),
+    };
+}
+function toTransportType(type) {
+    switch (type) {
+        case "stdio":
+            return "stdio";
+        case "streamable-http":
+            return "http";
+        case "sse":
+            return "sse";
+        default:
+            return undefined;
+    }
+}
+/**
+ * The `name@version` spec of an `npm` package, or `undefined` when the
+ * identifier or version is not a valid npm name or version.
+ */
+function npmSpecOf(pkg) {
+    if (pkg.registryType !== "npm" ||
+        pkg.identifier.length > NPM_PACKAGE_NAME_MAX_LENGTH ||
+        !NPM_PACKAGE_NAME.test(pkg.identifier)) {
+        return undefined;
+    }
+    if (pkg.version === undefined) {
+        return pkg.identifier;
+    }
+    return pkg.version.length <= NPM_VERSION_MAX_LENGTH &&
+        NPM_VERSION.test(pkg.version)
+        ? `${pkg.identifier}@${pkg.version}`
+        : undefined;
+}
+/**
+ * Map a registry record to a catalog entry.
+ *
+ * Remote entries are never `verified`: that flag means "reviewed by NeuroLink"
+ * for the built-in catalog, and the registry's contents are the publishers'
+ * own claims. Only an `npm` package whose identifier and version are valid
+ * npm names gets a runnable `command`; anything else (other package types such
+ * as pypi, oci or nuget, or an npm package with a malformed identifier or
+ * version) is listed in `metadata.packages` only, for the caller to act on.
+ */
+export function mapRemoteRecord(record, apiBase) {
+    const { server } = record;
+    const runnable = server.packages
+        .map((pkg) => ({ pkg, spec: npmSpecOf(pkg) }))
+        .find((candidate) => candidate.spec !== undefined);
+    const transports = Array.from(new Set(compact([
+        ...server.packages.map((pkg) => pkg.transport === undefined
+            ? undefined
+            : toTransportType(pkg.transport.type)),
+        ...server.remotes.map((remote) => toTransportType(remote.type)),
+    ])));
+    const requiredEnvVars = runnable === undefined
+        ? []
+        : runnable.pkg.environmentVariables
+            .filter((variable) => variable.isRequired)
+            .map((variable) => variable.name);
+    const remotes = server.remotes.flatMap((remote) => remote.url === undefined ? [] : [{ type: remote.type, url: remote.url }]);
+    const metadata = {
+        source: "remote-registry",
+        registry: apiBase,
+        ...(record.status === undefined ? {} : { registryStatus: record.status }),
+        packages: server.packages.map((pkg) => ({
+            registryType: pkg.registryType,
+            identifier: pkg.identifier,
+            ...(pkg.version === undefined ? {} : { version: pkg.version }),
+        })),
+        remotes,
+    };
+    return {
+        id: server.name,
+        name: server.name,
+        description: server.description,
+        version: server.version,
+        ...(server.websiteUrl === undefined ? {} : { homepage: server.websiteUrl }),
+        ...(server.repositoryUrl === undefined
+            ? {}
+            : { repository: server.repositoryUrl }),
+        ...(runnable === undefined
+            ? {}
+            : {
+                npmPackage: runnable.pkg.identifier,
+                command: "npx",
+                args: ["-y", runnable.spec],
+                installCommand: `npx -y ${runnable.spec}`,
+            }),
+        ...(requiredEnvVars.length === 0 ? {} : { requiredEnvVars }),
+        ...(transports.length === 0 ? {} : { transports }),
+        ...(record.updatedAt === undefined
+            ? {}
+            : { lastUpdated: record.updatedAt }),
+        verified: false,
+        metadata,
+    };
+}

package/dist/middleware/utils/guardrailsUtils.js

@@ -1,5 +1,6 @@
 import { AIProviderFactory } from "../../core/factory.js";
 import { logger } from "../../utils/logger.js";
+import { vetRegexPattern } from "./regexSafety.js";
 export const DEFAULT_EVALUATION_PROMPT = `
 Evaluate the following user input for safety and appropriateness. Respond ONLY with valid JSON:
 
@@ -21,6 +22,11 @@ Evaluate the following user input for safety and appropriateness. Respond ONLY w
 
 User Input: "{USER_INPUT}"
 `;
+/** Longest slice of a refused pattern written to the log. */
+const MAX_LOGGED_PATTERN_LENGTH = 60;
+const describePattern = (pattern) => pattern.length > MAX_LOGGED_PATTERN_LENGTH
+    ? `${pattern.slice(0, MAX_LOGGED_PATTERN_LENGTH)}...`
+    : pattern;
 /**
  * Extract user input from middleware params
  */
@@ -177,6 +183,11 @@ export function applyEvaluationActions(evaluation, config, userInput) {
                 logger.debug(`[GuardrailsUtils] Applying ${patterns.length} sanitization patterns with replacement: "${replacementText}".`);
                 patterns.forEach((pattern, index) => {
                     try {
+                        const verdict = vetRegexPattern(pattern);
+                        if (!verdict.safe) {
+                            logger.error(`[GuardrailsUtils] Refusing sanitization pattern "${describePattern(pattern)}": ${verdict.reason}. The pattern is skipped.`);
+                            return;
+                        }
                         const regex = new RegExp(pattern, "gi");
                         const before = sanitized;
                         let matchCount = 0;
@@ -315,6 +326,8 @@ export function applyContentFiltering(text, badWordsConfig, context = "unknown")
         let hasChanges = false;
         const appliedFilters = [];
         let totalMatches = 0;
+        let regexPatternsApplied = 0;
+        let regexPatternsRejected = 0;
         const replacementText = badWordsConfig.replacementText || "[REDACTED]";
         // Priority 1: Use regex patterns if provided
         if (badWordsConfig.regexPatterns &&
@@ -325,16 +338,14 @@ export function applyContentFiltering(text, badWordsConfig, context = "unknown")
             logger.debug(`[ContentFiltering:${context}] Applying regex pattern filtering with ${badWordsConfig.regexPatterns.length} patterns using replacement: "${replacementText}".`);
             for (const pattern of badWordsConfig.regexPatterns) {
                 try {
-                    // TODO(#1954): Add blocking for overly complex or long patterns
-                    if (pattern.length > 1000) {
-                        logger.warn(`[ContentFiltering:${context}] Regex pattern exceeds max length (1000 chars): "${pattern.substring(0, 50)}..."`);
+                    const verdict = vetRegexPattern(pattern);
+                    if (!verdict.safe) {
+                        regexPatternsRejected++;
+                        logger.error(`[ContentFiltering:${context}] Refusing regex pattern "${describePattern(pattern)}": ${verdict.reason}. The pattern is skipped.`);
+                        continue;
                     }
                     const regex = new RegExp(pattern, "gi");
-                    const testStart = Date.now();
-                    regex.test("test");
-                    if (Date.now() - testStart > 100) {
-                        logger.warn(`[ContentFiltering:${context}] Regex pattern "${pattern}" appears to be too complex (slow test execution).`);
-                    }
+                    regexPatternsApplied++;
                     const before = filteredText;
                     let matchCount = 0;
                     filteredText = filteredText?.replace(regex, () => {
@@ -377,7 +388,8 @@ export function applyContentFiltering(text, badWordsConfig, context = "unknown")
             hasChanges,
             appliedFilters,
             filteringStats: {
-                regexPatternsApplied: badWordsConfig.regexPatterns?.length || 0,
+                regexPatternsApplied,
+                regexPatternsRejected,
                 stringFiltersApplied: badWordsConfig.list?.length || 0,
                 totalMatches,
             },

package/dist/middleware/utils/regexSafety.d.ts

@@ -0,0 +1,46 @@
+import type { RegexPatternVerdict } from "../../types/index.js";
+/**
+ * Static vetting for regular expressions that a caller hands to the
+ * guardrails (`badWords.regexPatterns`, `precallEvaluation.sanitizationPatterns`).
+ *
+ * Both lists are compiled and run synchronously on the event loop against the
+ * whole model response, so one pattern that backtracks catastrophically
+ * (`(a+)+$` on a run of `a`) stalls every request in the process. A timing
+ * probe on a short fixed string cannot find that: the cost only shows on long
+ * adversarial input, and it is measured after the call has already returned.
+ * This reads the pattern instead.
+ *
+ * The cause of every exponential case is one input that can be split between
+ * the parts of the pattern in many ways. A variable-length part (`a+`, `a?`,
+ * `a{1,3}`, `(ab)*`) is ambiguous when what can follow it may start with text
+ * the part itself can match. The check refuses a pattern when:
+ *
+ * - such a part sits inside a repeated group (`(a+)+`, `(a?a?)+`,
+ *   `(a{1,30}){1,30}`), where the ways multiply on every iteration;
+ * - the alternatives of a repeated group may overlap (`(a|aa)+`);
+ * - ambiguous parts are chained: more than {@link MAX_NARROW_WAYS} ways in
+ *   total from optional or short parts (`a?` nine times in a row), or more
+ *   than {@link MAX_OPEN_AMBIGUITY} open-ended ones (`.*a.*b.*c.*d.*e`);
+ * - a repetition bound is above {@link MAX_REPETITION_BOUND}, or the pattern
+ *   is longer than {@link MAX_REGEX_PATTERN_LENGTH}.
+ *
+ * A variable-length part that is followed by something it cannot match is
+ * unambiguous, so `(\d{1,3}\.){3}`, `([a-z0-9-]+\.)+` and `(?:\d[ -]?){13,16}`
+ * run.
+ *
+ * It is deliberately conservative, not a proof. Two classes are compared on a
+ * fixed sample of characters (Latin text plus a few other scripts), so a class
+ * that only overlaps outside the sample looks disjoint, and a back-reference
+ * is assumed to overlap with everything. A hard guarantee would need a time
+ * budget around the match itself (a `node:vm` timeout or a worker), which a
+ * synchronous `String.replace` cannot offer; that is a follow-up.
+ */
+/** Longest pattern accepted, in characters. */
+export declare const MAX_REGEX_PATTERN_LENGTH = 1000;
+/**
+ * Decide whether a caller-supplied pattern may be compiled and run.
+ *
+ * Total: it returns a verdict for any string and never throws, so a caller can
+ * skip a refused pattern the same way it skips an invalid one.
+ */
+export declare function vetRegexPattern(pattern: string): RegexPatternVerdict;