@littlebearapps/outlook-assistant 3.11.1 → 3.11.2

package/README.md

@@ -164,7 +164,7 @@ npx @littlebearapps/outlook-assistant
 To check which version you have, or to see the available options:
 
 ```bash
-outlook-assistant --version     # prints e.g. 3.11.1
+outlook-assistant --version     # prints e.g. 3.11.2
 outlook-assistant --help        # usage, options and key environment variables
 ```
 

package/email/attachments.js

@@ -10,6 +10,65 @@ const _config = require('../config'); // Reserved for future use
 const { callGraphAPI } = require('../utils/graph-api');
 const { ensureAuthenticated } = require('../auth');
 
+const MAX_FILENAME_LENGTH = 200;
+
+/**
+ * Reduce a sender-controlled attachment name to a safe basename.
+ * Strips any directory part (either separator), control and reserved
+ * characters, and leading dots, then caps the length while keeping the
+ * extension. Falls back to "attachment" when nothing usable remains.
+ * @param {string} name - Attachment name from Graph metadata
+ * @returns {string} - Filename safe to join onto an output directory
+ */
+function safeAttachmentFilename(name) {
+  const base = String(name || '')
+    .split(/[\\/]/)
+    .pop()
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x1f\x7f]/g, '')
+    .replace(/[<>:"|?*]/g, '_')
+    .trim()
+    .replace(/^\.+/, '');
+
+  if (!base) return 'attachment';
+  if (base.length <= MAX_FILENAME_LENGTH) return base;
+
+  const ext = path.extname(base).slice(0, 20);
+  return base.slice(0, MAX_FILENAME_LENGTH - ext.length) + ext;
+}
+
+/**
+ * Write a buffer into outputDir without ever overwriting an existing entry
+ * or following a symlink: `wx` fails on any existing path (including a
+ * dangling symlink), so collisions get a numbered suffix instead.
+ * @param {string} outputDir - Target directory
+ * @param {string} filename - Safe basename from safeAttachmentFilename
+ * @param {Buffer} buffer - File contents
+ * @returns {string} - Absolute path actually written
+ */
+function writeUniqueFile(outputDir, filename, buffer) {
+  const root = path.resolve(outputDir);
+  const ext = path.extname(filename);
+  const stem = filename.slice(0, filename.length - ext.length);
+
+  for (let i = 0; i < 1000; i++) {
+    const candidate = path.join(
+      root,
+      i === 0 ? filename : `${stem}-${i}${ext}`
+    );
+    if (path.dirname(candidate) !== root) {
+      throw new Error('Refusing to write attachment outside outputDir');
+    }
+    try {
+      fs.writeFileSync(candidate, buffer, { flag: 'wx' });
+      return candidate;
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+    }
+  }
+  throw new Error(`Too many files named ${filename} in ${root}`);
+}
+
 /**
  * List attachments for a specific email
  * @param {object} args - Tool arguments
@@ -177,13 +236,18 @@ async function handleDownloadAttachment(args) {
       // of cwd so attachments don't silently land in the source tree
       // when the caller forgets to pass outputDir. Auto-create the
       // target directory.
+      // The filename is sender-controlled (GHSA-755c-c45g-69rv): reduce it
+      // to a safe basename and never overwrite or follow a symlink.
       const outputDir = savePath || os.tmpdir();
       fs.mkdirSync(outputDir, { recursive: true });
-      const outputPath = path.join(outputDir, filename);
 
       // Decode base64 and save to file
       const buffer = Buffer.from(contentBytes, 'base64');
-      fs.writeFileSync(outputPath, buffer);
+      const outputPath = writeUniqueFile(
+        outputDir,
+        safeAttachmentFilename(filename),
+        buffer
+      );
 
       const sizeKB = (buffer.length / 1024).toFixed(1);
 

package/email/conversations.js

@@ -15,6 +15,7 @@ const { getEmailFields } = require('../utils/field-presets');
 const {
   formatEmailContent,
   formatEmailsAsCSV,
+  stripHtml,
   VERBOSITY,
 } = require('../utils/response-formatter');
 // Note: buildFromFilter/buildToFilter from search.js use OData $filter which causes
@@ -542,16 +543,7 @@ async function handleExportConversation(args) {
           // Body content
           if (msg.body?.content) {
             if (msg.body.contentType === 'html') {
-              // Simple HTML to text conversion
-              const text = msg.body.content
-                .replace(/<br\s*\/?>/gi, '\n')
-                .replace(/<\/p>/gi, '\n\n')
-                .replace(/<[^>]+>/g, '')
-                .replace(/&nbsp;/g, ' ')
-                .replace(/&lt;/g, '<')
-                .replace(/&gt;/g, '>')
-                .replace(/&amp;/g, '&');
-              mdContent.push(text.trim());
+              mdContent.push(stripHtml(msg.body.content));
             } else {
               mdContent.push(msg.body.content);
             }

package/llms.txt

@@ -79,6 +79,6 @@ Requires an Azure app registration with Microsoft Graph delegated permissions. S
 - [FAQ](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/faq/faq.md): Frequently asked questions — install, accounts, permissions, tokens, send safety, updates, uninstall (also at <https://littlebearapps.com/help/outlook-assistant/faq/>)
 - [CLAUDE.md](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CLAUDE.md): Quick reference for development
 - [CONTRIBUTING](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CONTRIBUTING.md): Contribution guidelines
-- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.11.1 — search and export correctness: a search term combined with a date or boolean filter was silently overwritten, so the request carried only the date window and the whole window came back reported as a filtered result; batch export named files `<date>_<subject>`, so a same-day reply chain overwrote itself on disk while the summary reported `Failed 0` — filenames now carry the time, collisions get a numeric suffix instead of clobbering, and a manifest maps each requested ID to the file actually written; a truncated local scan is now disclosed when it matched, not only when it returned nothing; `query` versus `searchExpression` and the 500-message `to` scan cap documented. Preceded by v3.11.0 — fixes & polish: `--version`/`--help` CLI flags (#68), `AADSTS7000215` explaining the Secret ID vs Secret Value mistake via one shared AADSTS hint table (#69), token-refresh round trip covered end to end (#72), and all 17 development-dependency advisories cleared; and v3.10.0 — search correctness: field-scoped `searchExpression` translated to OData filters and retried on personal accounts (#217), two-filter searches no longer returning the single-filter superset (#229), `from`/`to` filter values OData-escaped (#230), no-results guidance derived from what was actually attempted (#231))
+- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.11.2 — security release: attachment downloads confined to `outputDir` (GHSA-755c-c45g-69rv) and the access token only ever sent to Microsoft Graph (GHSA-mqfm-wfjq-jxq2), HTML-to-text entity double-decoding fixed, `npm audit` at 0. Preceded by v3.11.1 — search and export correctness: a search term combined with a date or boolean filter was silently overwritten, so the request carried only the date window and the whole window came back reported as a filtered result; batch export named files `<date>_<subject>`, so a same-day reply chain overwrote itself on disk while the summary reported `Failed 0` — filenames now carry the time, collisions get a numeric suffix instead of clobbering, and a manifest maps each requested ID to the file actually written; a truncated local scan is now disclosed when it matched, not only when it returned nothing; `query` versus `searchExpression` and the 500-message `to` scan cap documented. Preceded by v3.11.0 — fixes & polish: `--version`/`--help` CLI flags (#68), `AADSTS7000215` explaining the Secret ID vs Secret Value mistake via one shared AADSTS hint table (#69), token-refresh round trip covered end to end (#72), and all 17 development-dependency advisories cleared; and v3.10.0 — search correctness: field-scoped `searchExpression` translated to OData filters and retried on personal accounts (#217), two-filter searches no longer returning the single-filter superset (#229), `from`/`to` filter values OData-escaped (#230), no-results guidance derived from what was actually attempted (#231))
 - [ROADMAP](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/ROADMAP.md): Active milestones (v3.11.2 tool description audit, v3.8.x carry-over, v3.12.0+ new Graph APIs)
 - [SECURITY](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/SECURITY.md): Security policy, token handling, and MCP safety controls

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@littlebearapps/outlook-assistant",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "mcpName": "io.github.littlebearapps/outlook-assistant",
   "description": "Outlook Assistant — MCP server with 22 tools for email, calendar, contacts, and settings via Microsoft Graph API",
   "main": "index.js",
@@ -100,8 +100,8 @@
     "minimatch": ">=3.1.3",
     "hono": "^4.13.7",
     "@hono/node-server": "^1.19.17",
-    "fast-uri": "^3.1.7",
-    "ip-address": "^10.7.0",
+    "fast-uri": "^3.1.8",
+    "ip-address": "^10.7.2",
     "qs": "^6.16.0",
     "body-parser": "^2.3.0"
   }

package/utils/graph-api.js

@@ -5,6 +5,38 @@ const https = require('https');
 const config = require('../config');
 const mockData = require('./mock-data');
 
+/**
+ * Guard for caller-supplied full URLs (nextLink/deltaLink continuations).
+ * The bearer token is attached to every request, so only the configured
+ * Graph host over HTTPS on the default port is allowed (GHSA-mqfm-wfjq-jxq2).
+ * @param {string} url - Full URL about to be requested
+ * @throws {Error} If the URL is malformed or not the Graph host
+ */
+function assertGraphUrl(url) {
+  const allowed = new URL(config.GRAPH_API_ENDPOINT);
+  let target;
+  try {
+    target = new URL(url);
+  } catch {
+    target = null;
+  }
+
+  const ok =
+    target &&
+    target.protocol === 'https:' &&
+    target.hostname === allowed.hostname &&
+    target.port === '' &&
+    target.username === '' &&
+    target.password === '';
+
+  if (!ok) {
+    throw new Error(
+      'Refusing to call non-Graph URL: continuation links must be https://' +
+        `${allowed.hostname}/ (check the deltaToken or nextLink value)`
+    );
+  }
+}
+
 /**
  * Makes a request to the Microsoft Graph API
  * In test mode (USE_TEST_MODE=true), routes to mock data instead of the real API.
@@ -36,6 +68,7 @@ async function callGraphAPI(
     let finalUrl;
     if (path.startsWith('http://') || path.startsWith('https://')) {
       // Path is already a full URL (from pagination nextLink)
+      assertGraphUrl(path);
       finalUrl = path;
     } else {
       // Build URL from path and queryParams

package/utils/response-formatter.js

@@ -467,20 +467,54 @@ function truncateText(text, maxLength) {
   return `${text.substring(0, maxLength - 3)}...`;
 }
 
+const HTML_ENTITIES = {
+  nbsp: ' ',
+  amp: '&',
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: "'",
+  '#39': "'",
+};
+
+/**
+ * Removes tags in one linear scan: `<…>` with no `<` inside is dropped
+ * whole, and any other `<` (nested fragments such as `<scr<script>ipt>`,
+ * or an unterminated tag) is dropped on its own, so no markup can
+ * reassemble. A scanner rather than a repeated regex replace keeps deeply
+ * nested input like `<<<…x…>>>` linear.
+ * @param {string} text - HTML fragment
+ * @returns {string} - Text with no `<` remaining
+ */
+function removeTags(text) {
+  let out = '';
+  let i = 0;
+  while (i < text.length) {
+    const lt = text.indexOf('<', i);
+    if (lt === -1) {
+      out += text.slice(i);
+      break;
+    }
+    out += text.slice(i, lt);
+    // Scan only to the next '<' or '>', so each character is visited once.
+    let j = lt + 1;
+    while (j < text.length && text[j] !== '<' && text[j] !== '>') j++;
+    i = text[j] === '>' ? j + 1 : lt + 1;
+  }
+  return out;
+}
+
 /**
- * Strips HTML tags (simple implementation)
+ * Strips HTML tags (simple implementation), in linear time.
+ * Entities are decoded after tag removal, in a single pass, so `&amp;lt;`
+ * becomes `&lt;`, not `<`.
  */
 function stripHtml(html) {
   if (!html) return '';
-  return html
-    .replace(/<br\s*\/?>/gi, '\n')
-    .replace(/<\/p>/gi, '\n\n')
-    .replace(/<[^>]*>/g, '')
-    .replace(/&nbsp;/g, ' ')
-    .replace(/&amp;/g, '&')
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>')
-    .replace(/&quot;/g, '"')
+  return removeTags(
+    html.replace(/<br\s*\/?>/gi, '\n').replace(/<\/p>/gi, '\n\n')
+  )
+    .replace(/&(nbsp|amp|lt|gt|quot|apos|#39);/g, (_, e) => HTML_ENTITIES[e])
     .replace(/\n{3,}/g, '\n\n')
     .trim();
 }