@nocobase/plugin-mcp-server 2.1.0-alpha.15 → 2.1.0-alpha.17

package/dist/node_modules/@apidevtools/json-schema-ref-parser/dist/lib/util/url.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -35,6 +45,7 @@ exports.stripQuery = stripQuery;
 exports.getHash = getHash;
 exports.stripHash = stripHash;
 exports.isHttp = isHttp;
+exports.isUnsafeUrl = isUnsafeUrl;
 exports.isFileSystemPath = isFileSystemPath;
 exports.fromFileSystemPath = fromFileSystemPath;
 exports.toFileSystemPath = toFileSystemPath;
@@ -63,10 +74,11 @@ exports.parse = parse;
  * @returns
  */
 function resolve(from, to) {
-    const fromUrl = new URL((0, convert_path_to_posix_1.default)(from), "resolve://");
+    // we use a non-existent URL to check if its a relative URL
+    const fromUrl = new URL((0, convert_path_to_posix_1.default)(from), "https://aaa.nonexistanturl.com");
     const resolvedUrl = new URL((0, convert_path_to_posix_1.default)(to), fromUrl);
     const endSpaces = to.match(/(\s*)$/)?.[1] || "";
-    if (resolvedUrl.protocol === "resolve:") {
+    if (resolvedUrl.hostname === "aaa.nonexistanturl.com") {
         // `from` is a relative URL.
         const { pathname, search, hash } = resolvedUrl;
         return pathname + search + hash + endSpaces;
@@ -79,17 +91,31 @@ function resolve(from, to) {
  * @returns
  */
 function cwd() {
-    if (typeof window !== "undefined") {
-        return location.href;
-    }
-    const path = process.cwd();
-    const lastChar = path.slice(-1);
-    if (lastChar === "/" || lastChar === "\\") {
-        return path;
+    if (typeof window !== "undefined" && window.location && window.location.href) {
+        const href = window.location.href;
+        if (!href || !href.startsWith("http")) {
+            // try parsing as url, and if it fails, return root url /
+            try {
+                new URL(href);
+                return href;
+            }
+            catch {
+                return "/";
+            }
+        }
+        return href;
     }
-    else {
-        return path + "/";
+    if (typeof process !== "undefined" && process.cwd) {
+        const path = process.cwd();
+        const lastChar = path.slice(-1);
+        if (lastChar === "/" || lastChar === "\\") {
+            return path;
+        }
+        else {
+            return path + "/";
+        }
     }
+    return "/";
 }
 /**
  * Returns the protocol of the given URL, or `undefined` if it has no protocol.
@@ -184,6 +210,152 @@ function isHttp(path) {
         return false;
     }
 }
+/**
+ * Determines whether the given url is an unsafe or internal url.
+ *
+ * @param path - The URL or path to check
+ * @returns true if the URL is unsafe/internal, false otherwise
+ */
+function isUnsafeUrl(path) {
+    if (!path || typeof path !== "string") {
+        return true;
+    }
+    // Trim whitespace and convert to lowercase for comparison
+    const normalizedPath = path.trim().toLowerCase();
+    // Empty or just whitespace
+    if (!normalizedPath) {
+        return true;
+    }
+    // JavaScript protocols
+    if (normalizedPath.startsWith("javascript:") ||
+        normalizedPath.startsWith("vbscript:") ||
+        normalizedPath.startsWith("data:")) {
+        return true;
+    }
+    // File protocol
+    if (normalizedPath.startsWith("file:")) {
+        return true;
+    }
+    // if we're in the browser, we assume that it is safe
+    if (typeof window !== "undefined" && window.location && window.location.href) {
+        return false;
+    }
+    // Local/internal network addresses
+    const localPatterns = [
+        // Localhost variations
+        "localhost",
+        "127.0.0.1",
+        "::1",
+        // Private IP ranges (RFC 1918)
+        "10.",
+        "172.16.",
+        "172.17.",
+        "172.18.",
+        "172.19.",
+        "172.20.",
+        "172.21.",
+        "172.22.",
+        "172.23.",
+        "172.24.",
+        "172.25.",
+        "172.26.",
+        "172.27.",
+        "172.28.",
+        "172.29.",
+        "172.30.",
+        "172.31.",
+        "192.168.",
+        // Link-local addresses
+        "169.254.",
+        // Internal domains
+        ".local",
+        ".internal",
+        ".intranet",
+        ".corp",
+        ".home",
+        ".lan",
+    ];
+    try {
+        // Try to parse as URL
+        const url = new URL(normalizedPath.startsWith("//") ? "http:" + normalizedPath : normalizedPath);
+        const hostname = url.hostname.toLowerCase();
+        // Check against local patterns
+        for (const pattern of localPatterns) {
+            if (hostname === pattern || hostname.startsWith(pattern) || hostname.endsWith(pattern)) {
+                return true;
+            }
+        }
+        // Check for IP addresses in private ranges
+        if (isPrivateIP(hostname)) {
+            return true;
+        }
+        // Check for non-standard ports that might indicate internal services
+        const port = url.port;
+        if (port && isInternalPort(parseInt(port))) {
+            return true;
+        }
+    }
+    catch (e) {
+        // If URL parsing fails, check if it's a relative path or contains suspicious patterns
+        // Relative paths starting with / are generally safe for same-origin
+        if (normalizedPath.startsWith("/") && !normalizedPath.startsWith("//")) {
+            return false;
+        }
+        // Check for localhost patterns in non-URL strings
+        for (const pattern of localPatterns) {
+            if (normalizedPath.includes(pattern)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Helper function to check if an IP address is in a private range
+ */
+function isPrivateIP(ip) {
+    const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+    const match = ip.match(ipRegex);
+    if (!match) {
+        return false;
+    }
+    const [, a, b, c, d] = match.map(Number);
+    // Validate IP format
+    if (a > 255 || b > 255 || c > 255 || d > 255) {
+        return false;
+    }
+    // Private IP ranges
+    return (a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254) // Link-local
+    );
+}
+/**
+ * Helper function to check if a port is typically used for internal services
+ */
+function isInternalPort(port) {
+    const internalPorts = [
+        22, // SSH
+        23, // Telnet
+        25, // SMTP
+        53, // DNS
+        135, // RPC
+        139, // NetBIOS
+        445, // SMB
+        993, // IMAPS
+        995, // POP3S
+        1433, // SQL Server
+        1521, // Oracle
+        3306, // MySQL
+        3389, // RDP
+        5432, // PostgreSQL
+        5900, // VNC
+        6379, // Redis
+        8080, // Common internal web
+        8443, // Common internal HTTPS
+        9200, // Elasticsearch
+        27017, // MongoDB
+    ];
+    return internalPorts.includes(port);
+}
 /**
  * Determines whether the given path is a filesystem path.
  * This includes "file://" URLs.

package/dist/node_modules/@apidevtools/json-schema-ref-parser/dist/vite.config.js

@@ -14,5 +14,6 @@ exports.default = (0, config_1.defineConfig)({
         passWithNoTests: true,
         reporters: ["verbose"],
         coverage: { reporter: ["lcov", "html", "text"] },
+        snapshotSerializers: ["./test/utils/serializeJson.ts"],
     },
 });

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/bundle.ts

@@ -76,9 +76,9 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
       const keys = Object.keys(obj).sort((a, b) => {
         // Most people will expect references to be bundled into the the "definitions" property,
         // so we always crawl that property first, if it exists.
-        if (a === "definitions") {
+        if (a === "definitions" || a === "$defs") {
           return -1;
-        } else if (b === "definitions") {
+        } else if (b === "definitions" || b === "$defs") {
           return 1;
         } else {
           // Otherwise, crawl the keys based on their length.
@@ -216,8 +216,14 @@ function remap(inventory: InventoryEntry[]) {
     } else {
       // Determine how far each $ref is from the "definitions" property.
       // Most people will expect references to be bundled into the the "definitions" property if possible.
-      const aDefinitionsIndex = a.pathFromRoot.lastIndexOf("/definitions");
-      const bDefinitionsIndex = b.pathFromRoot.lastIndexOf("/definitions");
+      const aDefinitionsIndex = Math.max(
+        a.pathFromRoot.lastIndexOf("/definitions"),
+        a.pathFromRoot.lastIndexOf("/$defs"),
+      );
+      const bDefinitionsIndex = Math.max(
+        b.pathFromRoot.lastIndexOf("/definitions"),
+        b.pathFromRoot.lastIndexOf("/$defs"),
+      );
 
       if (aDefinitionsIndex !== bDefinitionsIndex) {
         // Give higher priority to the $ref that's closer to the "definitions" property

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/dereference.ts

@@ -1,6 +1,5 @@
 import $Ref from "./ref.js";
 import Pointer from "./pointer.js";
-import { ono } from "@jsdevtools/ono";
 import * as url from "./util/url.js";
 import type $Refs from "./refs.js";
 import type { DereferenceOptions, ParserOptions } from "./options.js";
@@ -69,11 +68,8 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
     circular: false,
   };
 
-  if (options && options.timeoutMs) {
-    if (Date.now() - startTime > options.timeoutMs) {
-      throw new TimeoutError(options.timeoutMs);
-    }
-  }
+  checkDereferenceTimeout<S, O>(startTime, options);
+
   const derefOptions = (options.dereference || {}) as DereferenceOptions;
   const isExcludedPath = derefOptions.excludedPathMatcher || (() => false);
 
@@ -98,6 +94,8 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
         result.value = dereferenced.value;
       } else {
         for (const key of Object.keys(obj)) {
+          checkDereferenceTimeout<S, O>(startTime, options);
+
           const keyPath = Pointer.join(path, key);
           const keyPathFromRoot = Pointer.join(pathFromRoot, key);
 
@@ -123,7 +121,31 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
             circular = dereferenced.circular;
             // Avoid pointless mutations; breaks frozen objects to no profit
             if (obj[key] !== dereferenced.value) {
+              // If we have properties we want to preserve from our dereferenced schema then we need
+              // to copy them over to our new object.
+              const preserved: Map<string, unknown> = new Map();
+              if (derefOptions?.preservedProperties) {
+                if (typeof obj[key] === "object" && !Array.isArray(obj[key])) {
+                  derefOptions?.preservedProperties.forEach((prop) => {
+                    if (prop in obj[key]) {
+                      preserved.set(prop, obj[key][prop]);
+                    }
+                  });
+                }
+              }
+
               obj[key] = dereferenced.value;
+
+              // If we have data to preserve and our dereferenced object is still an object then
+              // we need copy back our preserved data into our dereferenced schema.
+              if (derefOptions?.preservedProperties) {
+                if (preserved.size && typeof obj[key] === "object" && !Array.isArray(obj[key])) {
+                  preserved.forEach((value, prop) => {
+                    obj[key][prop] = value;
+                  });
+                }
+              }
+
               derefOptions?.onDereference?.(value.$ref, obj[key], obj, key);
             }
           } else {
@@ -190,23 +212,53 @@ function dereference$Ref<S extends object = JSONSchema, O extends ParserOptions<
   const $refPath = url.resolve(shouldResolveOnCwd ? url.cwd() : path, $ref.$ref);
 
   const cache = dereferencedCache.get($refPath);
-  if (cache && !cache.circular) {
-    const refKeys = Object.keys($ref);
-    if (refKeys.length > 1) {
-      const extraKeys = {};
-      for (const key of refKeys) {
-        if (key !== "$ref" && !(key in cache.value)) {
-          // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
-          extraKeys[key] = $ref[key];
+
+  if (cache) {
+    // If the object we found is circular we can immediately return it because it would have been
+    // cached with everything we need already and we don't need to re-process anything inside it.
+    //
+    // If the cached object however is _not_ circular and there are additional keys alongside our
+    // `$ref` pointer here we should merge them back in and return that.
+    if (!cache.circular) {
+      const refKeys = Object.keys($ref);
+      if (refKeys.length > 1) {
+        const extraKeys = {};
+        for (const key of refKeys) {
+          if (key !== "$ref" && !(key in cache.value)) {
+            // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
+            extraKeys[key] = $ref[key];
+          }
         }
+        return {
+          circular: cache.circular,
+          value: Object.assign({}, cache.value, extraKeys),
+        };
       }
-      return {
-        circular: cache.circular,
-        value: Object.assign({}, cache.value, extraKeys),
-      };
+
+      return cache;
     }
 
-    return cache;
+    // If both our cached value and our incoming `$ref` are the same then we can return what we
+    // got out of the cache, otherwise we should re-process this value. We need to do this because
+    // the current dereference caching mechanism doesn't take into account that `$ref` are neither
+    // unique or reference the same file.
+    //
+    // For example if `schema.yaml` references `definitions/child.yaml` and
+    // `definitions/parent.yaml` references `child.yaml` then `$ref: 'child.yaml'` may get cached
+    // for `definitions/child.yaml`, resulting in `schema.yaml` being having an invalid reference
+    // to `child.yaml`.
+    //
+    // This check is not perfect and the design of the dereference caching mechanism needs a total
+    // overhaul.
+    if (typeof cache.value === "object" && "$ref" in cache.value && "$ref" in $ref) {
+      if (cache.value.$ref === $ref.$ref) {
+        return cache;
+      } else {
+        // no-op
+      }
+    } else {
+      return cache;
+    }
   }
 
   const pointer = $refs._resolve($refPath, path, options);
@@ -270,9 +322,27 @@ function dereference$Ref<S extends object = JSONSchema, O extends ParserOptions<
   return dereferencedObject;
 }
 
+/**
+ * Check if we've run past our allowed timeout and throw an error if we have.
+ *
+ * @param startTime - The time when the dereferencing started.
+ * @param options
+ */
+function checkDereferenceTimeout<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
+  startTime: number,
+  options: O,
+): void {
+  if (options && options.timeoutMs) {
+    if (Date.now() - startTime > options.timeoutMs) {
+      throw new TimeoutError(options.timeoutMs);
+    }
+  }
+}
+
 /**
  * Called when a circular reference is found.
- * It sets the {@link $Refs#circular} flag, and throws an error if options.dereference.circular is false.
+ * It sets the {@link $Refs#circular} flag, executes the options.dereference.onCircular callback,
+ * and throws an error if options.dereference.circular is false.
  *
  * @param keyPath - The JSON Reference path of the circular reference
  * @param $refs
@@ -281,8 +351,11 @@ function dereference$Ref<S extends object = JSONSchema, O extends ParserOptions<
  */
 function foundCircularReference(keyPath: any, $refs: any, options: any) {
   $refs.circular = true;
+  options?.dereference?.onCircular?.(keyPath);
+
   if (!options.dereference.circular) {
-    throw ono.reference(`Circular $ref pointer found at ${keyPath}`);
+    const error = new ReferenceError(`Circular $ref pointer found at ${keyPath}`);
+    throw error;
   }
   return true;
 }