@neverinfamous/postgres-mcp 1.0.2 → 1.2.0

package/dist/utils/where-clause.js

@@ -0,0 +1,123 @@
+/**
+ * postgres-mcp - WHERE Clause Validation
+ *
+ * Validates WHERE clause parameters to prevent SQL injection.
+ * Uses a blocklist approach to reject dangerous patterns while
+ * allowing legitimate complex conditions.
+ */
+/**
+ * Error thrown when an unsafe WHERE clause is detected
+ */
+export class UnsafeWhereClauseError extends Error {
+    constructor(reason) {
+        super(`Unsafe WHERE clause: ${reason}`);
+        this.name = "UnsafeWhereClauseError";
+    }
+}
+/**
+ * Dangerous SQL patterns that should never appear in WHERE clauses.
+ * These patterns indicate SQL injection attempts.
+ */
+const DANGEROUS_PATTERNS = [
+    // Statement terminators and new statements
+    {
+        pattern: /;\s*(DROP|DELETE|TRUNCATE|INSERT|UPDATE|CREATE|ALTER|GRANT|REVOKE)/i,
+        reason: "contains statement terminator followed by dangerous keyword",
+    },
+    // Trailing semicolons (potential statement injection)
+    {
+        pattern: /;\s*$/,
+        reason: "contains trailing semicolon",
+    },
+    // SQL comments (can be used to comment out security checks)
+    {
+        pattern: /--/,
+        reason: "contains SQL line comment",
+    },
+    {
+        pattern: /\/\*/,
+        reason: "contains SQL block comment",
+    },
+    // UNION injection (data exfiltration)
+    {
+        pattern: /\bUNION\s+(ALL\s+)?SELECT\b/i,
+        reason: "contains UNION SELECT",
+    },
+    // File operations
+    {
+        pattern: /\bINTO\s+(OUT|DUMP)FILE\b/i,
+        reason: "contains file write operation",
+    },
+    {
+        pattern: /\bLOAD_FILE\s*\(/i,
+        reason: "contains file read operation",
+    },
+    // PostgreSQL specific dangerous functions
+    {
+        pattern: /\bpg_sleep\s*\(/i,
+        reason: "contains time-based injection function",
+    },
+    {
+        pattern: /\bpg_read_file\s*\(/i,
+        reason: "contains file read function",
+    },
+    {
+        pattern: /\bpg_read_binary_file\s*\(/i,
+        reason: "contains binary file read function",
+    },
+    {
+        pattern: /\bpg_ls_dir\s*\(/i,
+        reason: "contains directory listing function",
+    },
+    {
+        pattern: /\blo_import\s*\(/i,
+        reason: "contains large object import function",
+    },
+    {
+        pattern: /\blo_export\s*\(/i,
+        reason: "contains large object export function",
+    },
+    // System command execution
+    {
+        pattern: /\bCOPY\s+.*\s+(FROM|TO)\s+PROGRAM\b/i,
+        reason: "contains COPY PROGRAM (command execution)",
+    },
+];
+/**
+ * Validates a WHERE clause for dangerous SQL patterns.
+ *
+ * This function uses a blocklist approach to detect and reject
+ * common SQL injection patterns. It allows legitimate complex
+ * conditions while blocking obvious attack vectors.
+ *
+ * @param where - The WHERE clause to validate
+ * @throws UnsafeWhereClauseError if a dangerous pattern is detected
+ *
+ * @example
+ * validateWhereClause("price > 10");                    // OK
+ * validateWhereClause("status = 'active' AND id < 100"); // OK
+ * validateWhereClause("1=1; DROP TABLE users;--");      // Throws
+ * validateWhereClause("1=1 UNION SELECT * FROM pg_shadow"); // Throws
+ */
+export function validateWhereClause(where) {
+    if (!where || typeof where !== "string") {
+        throw new UnsafeWhereClauseError("WHERE clause must be a non-empty string");
+    }
+    for (const { pattern, reason } of DANGEROUS_PATTERNS) {
+        if (pattern.test(where)) {
+            throw new UnsafeWhereClauseError(reason);
+        }
+    }
+}
+/**
+ * Validates and returns a safe WHERE clause.
+ *
+ * @param where - The WHERE clause to sanitize
+ * @returns The validated WHERE clause (unchanged if safe)
+ * @throws UnsafeWhereClauseError if a dangerous pattern is detected
+ */
+export function sanitizeWhereClause(where) {
+    validateWhereClause(where);
+    return where;
+}
+//# sourceMappingURL=where-clause.js.map

package/dist/utils/where-clause.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"where-clause.js","sourceRoot":"","sources":["../../src/utils/where-clause.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,MAAc;QACxB,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,kBAAkB,GAA0C;IAChE,2CAA2C;IAC3C;QACE,OAAO,EACL,qEAAqE;QACvE,MAAM,EAAE,6DAA6D;KACtE;IACD,sDAAsD;IACtD;QACE,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,6BAA6B;KACtC;IACD,4DAA4D;IAC5D;QACE,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,2BAA2B;KACpC;IACD;QACE,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,4BAA4B;KACrC;IACD,sCAAsC;IACtC;QACE,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,uBAAuB;KAChC;IACD,kBAAkB;IAClB;QACE,OAAO,EAAE,4BAA4B;QACrC,MAAM,EAAE,+BAA+B;KACxC;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,8BAA8B;KACvC;IACD,0CAA0C;IAC1C;QACE,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,wCAAwC;KACjD;IACD;QACE,OAAO,EAAE,sBAAsB;QAC/B,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,MAAM,EAAE,oCAAoC;KAC7C;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,qCAAqC;KAC9C;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,uCAAuC;KAChD;IACD;QACE,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,uCAAuC;KAChD;IACD,2BAA2B;IAC3B;QACE,OAAO,EAAE,sCAAsC;QAC/C,MAAM,EAAE,2CAA2C;KACpD;CACF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,sBAAsB,CAAC,yCAAyC,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neverinfamous/postgres-mcp",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "mcpName": "io.github.neverinfamous/postgres-mcp",
   "description": "PostgreSQL MCP server with connection pooling, tool filtering, and full extension support",
   "type": "module",
@@ -45,21 +45,21 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.25.3",
-    "commander": "^14.0.0",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "commander": "^14.0.3",
     "jose": "^6.0.0",
-    "pg": "^8.17.2",
+    "pg": "^8.18.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@eslint/js": "^9.28.0",
-    "@types/node": "^25.0.10",
+    "@types/node": "^25.2.3",
     "@types/pg": "^8.11.0",
     "@vitest/coverage-v8": "^4.0.18",
     "eslint": "^9.28.0",
-    "globals": "^17.1.0",
+    "globals": "^17.3.0",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.53.1",
+    "typescript-eslint": "^8.55.0",
     "vitest": "^4.0.18"
   }
-}
+}