@zereight/mcp-gitlab 2.1.21 → 2.1.23

package/build/test/test-remote-downloads.js

@@ -17,6 +17,16 @@ const MOCK_TOKEN = 'glpat-mock-token-12345';
 const TEST_PROJECT_ID = '123';
 const TEST_JOB_ID = '456';
 const TEST_SECRET = 'testsecret';
+const FORWARDED_BASE_URL = 'https://gitlab.mcp.example.test/gitlab-mcp';
+const FORWARDED_HEADERS = {
+    'X-Forwarded-Proto': 'https',
+    'X-Forwarded-Host': 'gitlab.mcp.example.test',
+    'X-Forwarded-Prefix': '/gitlab-mcp',
+};
+const RFC_FORWARDED_HEADERS = {
+    'Forwarded': 'for=192.0.2.43;proto=http;host=attacker.example.test, for="[2001:db8:cafe::17]";proto="https";host="gitlab.mcp.example.test"',
+    'X-Forwarded-Prefix': '/gitlab-mcp',
+};
 // Minimal 1x1 transparent PNG
 const MINIMAL_PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==', 'base64');
 const LARGE_FILE_TOKEN = 'glpat-largefile-test-token';
@@ -92,6 +102,8 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
             env: {
                 STREAMABLE_HTTP: 'true',
                 REMOTE_AUTHORIZATION: 'true',
+                MCP_TRUST_PROXY: 'false',
+                MCP_SERVER_URL: '',
                 GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
                 USE_PIPELINE: 'true',
                 MAX_REQUESTS_PER_MINUTE: '2',
@@ -148,6 +160,61 @@ describe('Remote Downloads - Download Proxy Endpoint', { timeout: 30_000 }, () =
         }
         assert.ok(got429, 'Should have received 429 within 10 requests (rate limit is 2/min)');
     });
+    test('ignores forwarded headers unless MCP_TRUST_PROXY is enabled', async () => {
+        const initRes = await fetch(`http://${HOST}:${serverPort}/mcp`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Accept': 'application/json, text/event-stream',
+                'Private-Token': MOCK_TOKEN,
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 20,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    capabilities: {},
+                    clientInfo: { name: 'test-remote-downloads-no-trust-proxy', version: '1.0' },
+                },
+            }),
+        });
+        assert.strictEqual(initRes.status, 200, 'Initialize should succeed');
+        const sessionId = initRes.headers.get('mcp-session-id');
+        assert.ok(sessionId, 'Should receive a session ID');
+        const toolRes = await fetch(`http://${HOST}:${serverPort}/mcp`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Accept': 'application/json, text/event-stream',
+                ...FORWARDED_HEADERS,
+                'Private-Token': MOCK_TOKEN,
+                'mcp-session-id': sessionId,
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 21,
+                method: 'tools/call',
+                params: {
+                    name: 'download_job_artifacts',
+                    arguments: {
+                        project_id: TEST_PROJECT_ID,
+                        job_id: TEST_JOB_ID,
+                    },
+                },
+            }),
+        });
+        assert.strictEqual(toolRes.status, 200, 'Tool call should return 200');
+        const responses = parseSSE(await toolRes.text());
+        const result = responses.find(r => r.id === 21);
+        assert.ok(result?.result, 'Should have a result');
+        const textBlock = result.result.content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`http://${HOST}:${serverPort}/downloads/job-artifacts?`), `URL should fall back to local server address when MCP_TRUST_PROXY is disabled, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), 'URL should not use forwarded public base URL when MCP_TRUST_PROXY is disabled');
+    });
 });
 describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000 }, () => {
     let mockGitLab;
@@ -189,6 +256,8 @@ describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000
             env: {
                 STREAMABLE_HTTP: 'true',
                 REMOTE_AUTHORIZATION: 'true',
+                MCP_TRUST_PROXY: 'true',
+                MCP_SERVER_URL: '',
                 GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
                 USE_PIPELINE: 'true',
             },
@@ -222,12 +291,13 @@ describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000
         if (mockGitLab)
             await mockGitLab.stop();
     });
-    async function callTool(id, name, args) {
+    async function callTool(id, name, args, extraHeaders = {}) {
         const res = await fetch(`http://${HOST}:${serverPort}/mcp`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
                 'Accept': 'application/json, text/event-stream',
+                ...extraHeaders,
                 'Private-Token': MOCK_TOKEN,
                 'mcp-session-id': sessionId,
             },
@@ -269,6 +339,97 @@ describe('Remote Downloads - Tool Behavior via MCP Protocol', { timeout: 60_000
         assert.ok(buf.length > 0, 'Downloaded content should not be empty');
         assert.ok(buf.includes(Buffer.from('PK')), 'Should contain zip magic bytes');
     });
+    test('download_job_artifacts ignores forwarded hosts containing URL components', async () => {
+        const result = await callTool(14, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, {
+            ...FORWARDED_HEADERS,
+            'X-Forwarded-Host': 'gitlab.mcp.example.test@attacker.example.test',
+        });
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`http://${HOST}:${serverPort}/downloads/job-artifacts?`), `URL should fall back to local server address for unsafe forwarded host, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not contain unsafe forwarded host, got ${parsed.download_url}`);
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts ignores authority-style forwarded prefixes', async () => {
+        const result = await callTool(15, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, {
+            ...FORWARDED_HEADERS,
+            'X-Forwarded-Prefix': '//attacker.example.test',
+        });
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith('https://gitlab.mcp.example.test/downloads/job-artifacts?'), `URL should keep forwarded proto/host while ignoring unsafe prefix, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not contain authority-style prefix, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.startsWith(`http://${HOST}:${serverPort}`), 'URL should not fall back to local server address');
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts uses rightmost forwarded header values', async () => {
+        const result = await callTool(16, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, {
+            'X-Forwarded-Proto': 'http, https',
+            'X-Forwarded-Host': 'attacker.example.test, gitlab.mcp.example.test',
+            'X-Forwarded-Prefix': '/attacker, /gitlab-mcp',
+        });
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), `URL should use the rightmost forwarded header values, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not use the leftmost untrusted forwarded header value, got ${parsed.download_url}`);
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts derives download_url from RFC 7239 Forwarded header', async () => {
+        const result = await callTool(18, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, RFC_FORWARDED_HEADERS);
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), `URL should use RFC 7239 Forwarded header values, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.includes('attacker.example.test'), `URL should not use the leftmost untrusted Forwarded value, got ${parsed.download_url}`);
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
+    test('download_job_artifacts derives download_url from forwarded headers when MCP_SERVER_URL is unset', async () => {
+        const result = await callTool(17, 'download_job_artifacts', {
+            project_id: TEST_PROJECT_ID,
+            job_id: TEST_JOB_ID,
+        }, FORWARDED_HEADERS);
+        assert.ok(result.result, 'Should have a result');
+        const content = result.result.content;
+        assert.ok(content && content.length > 0, 'Should have content');
+        const textBlock = content.find(c => c.type === 'text');
+        assert.ok(textBlock?.text, 'Should have text content');
+        const parsed = JSON.parse(textBlock.text);
+        assert.ok(parsed.download_url, 'Should contain download_url');
+        assert.ok(parsed.download_url.startsWith(`${FORWARDED_BASE_URL}/downloads/job-artifacts?`), `URL should use forwarded public base URL, got ${parsed.download_url}`);
+        assert.ok(!parsed.download_url.startsWith(`http://${HOST}:${serverPort}`), 'URL should not fall back to local server address');
+        assert.ok(parsed.download_url.includes('_token='), 'URL should contain embedded auth token');
+    });
     test('download_attachment for non-image returns download_url', async () => {
         const result = await callTool(11, 'download_attachment', {
             project_id: TEST_PROJECT_ID,

package/build/test/utils/proxy-client-ip.test.js

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { ipKeyGenerator } from "express-rate-limit";
+import { normalizeProxyClientIpForRateLimit } from "../../utils/proxy-client-ip.js";
+function rateLimitKeyFromForwardedIp(ip) {
+    return ipKeyGenerator(normalizeProxyClientIpForRateLimit(ip));
+}
+describe("When normalizeProxyClientIpForRateLimit runs", () => {
+    describe("with proxy-forwarded client addresses", () => {
+        test("should strip IPv4 ports before ipKeyGenerator accepts the address", () => {
+            const key = rateLimitKeyFromForwardedIp("160.79.106.36:38914");
+            assert.equal(key, "160.79.106.36");
+        });
+        test("should strip bracketed IPv6 ports before ipKeyGenerator accepts the address", () => {
+            const key = rateLimitKeyFromForwardedIp("[2001:db8::1]:5678");
+            assert.equal(key, "2001:db8::/56");
+        });
+        test("should strip brackets from bracketed IPv6 addresses without ports", () => {
+            const key = rateLimitKeyFromForwardedIp("[2001:db8::1]");
+            assert.equal(key, "2001:db8::/56");
+        });
+        test("should leave plain IPv4 and IPv6 addresses unchanged", () => {
+            assert.equal(rateLimitKeyFromForwardedIp("1.2.3.4"), "1.2.3.4");
+            assert.equal(rateLimitKeyFromForwardedIp("2001:db8::1"), "2001:db8::/56");
+            assert.equal(rateLimitKeyFromForwardedIp("::1"), "::/56");
+        });
+    });
+});

package/build/utils/proxy-client-ip.js

@@ -0,0 +1,11 @@
+/**
+ * Normalize Express req.ip values from reverse proxies before rate limiting.
+ *
+ * Some proxies append the client port to X-Forwarded-For (e.g. "1.2.3.4:5678"
+ * or "[2001:db8::1]:5678"). express-rate-limit rejects those unless stripped.
+ */
+export function normalizeProxyClientIpForRateLimit(ip) {
+    return ip
+        .replace(/^(\d+\.\d+\.\d+\.\d+):\d+$/, "$1")
+        .replace(/^\[([^\]]+)\](?::\d+)?$/, "$1");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.21",
+  "version": "2.1.23",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -51,7 +51,7 @@
     "changelog": "auto-changelog -p",
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
-    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
+    "test:mock": "node --import tsx/esm --test test/remote-auth-simple-test.ts && node --import tsx/esm --test test/mcp-oauth-tests.ts && node --import tsx/esm --test test/test-oauth-proxy-rate-limit.ts && node --import tsx/esm --test test/streamable-http-static-token-auth.test.ts && tsx test/oauth-tests.ts && tsx test/test-list-merge-requests.ts && tsx test/test-list-issues.ts && node --import tsx/esm --test test/test-merge-request-pipelines.ts && tsx test/test-list-project-members.ts && tsx test/test-download-attachment.ts && node --import tsx/esm --test test/test-upload-markdown.ts && node --import tsx/esm --test test/test-job-artifacts.ts && node --import tsx/esm --test test/test-remote-downloads.ts && node --import tsx/esm --test test/test-deployment-tools.ts && node --import tsx/esm --test test/test-merge-request-approval-state-tools.ts && node --import tsx/esm --test test/test-search-code.ts && node --import tsx/esm --test test/test-tags.ts && node --import tsx/esm --test test/test-protected-branches.ts && node --import tsx/esm --test test/test-toolset-filtering.ts && node --import tsx/esm --test test/test-ci-lint.ts && node --import tsx/esm --test test/test-todos.ts && node --import tsx/esm --test test/test-auth-retry.ts && node --import tsx/esm --test test/test-issue-description-patch.ts && node --import tsx/esm --test test/test-geteffectiveprojectid.ts && node --import tsx/esm --test test/test-get-file-blame.ts && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts && node --import tsx/esm --test test/utils/tool-args.test.ts && node --import tsx/esm --test test/utils/proxy-client-ip.test.ts && node --import tsx/esm --test test/utils/graphql-query.test.ts && node --import tsx/esm --test test/utils/wiki-title.test.ts && node --import tsx/esm --test test/utils/merge-request-position.test.ts && node --import tsx/esm --test test/nullish-tool-arguments-schema.test.ts && node --import tsx/esm --test test/test-ci-variables.ts && node --import tsx/esm --test test/test-dependency-proxy.ts",
     "test:stateless": "npm run build && node --import tsx/esm --test test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",