@zereight/mcp-gitlab 2.1.46 → 2.1.47

package/build/test/test-get-file-contents.js

@@ -0,0 +1,128 @@
+import assert from "node:assert";
+import { after, before, describe, test } from "node:test";
+import { Buffer } from "node:buffer";
+import { CustomHeaderClient } from "./clients/custom-header-client.js";
+import { cleanupServers, findAvailablePort, HOST, launchServer, TransportMode, } from "./utils/server-launcher.js";
+import { findMockServerPort, MockGitLabServer } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-get-file-contents-test-token";
+const TEST_PROJECT_ID = "123";
+describe("get_file_contents", { timeout: 20_000 }, () => {
+    let mockGitLab;
+    let server;
+    let mcpUrl;
+    before(async () => {
+        const binaryContent = Buffer.from([
+            0x25, 0x50, 0x44, 0x46, 0x2d, 0x31, 0x2e, 0x37, 0x0a, 0xc7, 0xff, 0xd8, 0x00,
+        ]).toString("base64");
+        const mockPort = await findMockServerPort();
+        mockGitLab = new MockGitLabServer({
+            port: mockPort,
+            validTokens: [MOCK_TOKEN],
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/sample.pdf`, (_req, res) => {
+            res.json({
+                file_name: "sample.pdf",
+                file_path: "sample.pdf",
+                encoding: "base64",
+                content: binaryContent,
+            });
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/README.md`, (_req, res) => {
+            res.json({
+                file_name: "README.md",
+                file_path: "README.md",
+                encoding: "base64",
+                content: Buffer.from("Hello, 世界\n", "utf8").toString("base64"),
+            });
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/repository/files/empty.txt`, (_req, res) => {
+            res.json({
+                file_name: "empty.txt",
+                file_path: "empty.txt",
+                encoding: "base64",
+                content: "",
+            });
+        });
+        await mockGitLab.start();
+        const port = await findAvailablePort(3480);
+        server = await launchServer({
+            mode: TransportMode.STREAMABLE_HTTP,
+            port,
+            timeout: 10_000,
+            env: {
+                STREAMABLE_HTTP: "true",
+                REMOTE_AUTHORIZATION: "true",
+                GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
+            },
+        });
+        mcpUrl = `http://${HOST}:${port}/mcp`;
+    });
+    after(async () => {
+        cleanupServers([server]);
+        if (mockGitLab)
+            await mockGitLab.stop();
+    });
+    test("preserves non-UTF-8 file content as base64", async () => {
+        const expectedContent = Buffer.from([
+            0x25, 0x50, 0x44, 0x46, 0x2d, 0x31, 0x2e, 0x37, 0x0a, 0xc7, 0xff, 0xd8, 0x00,
+        ]).toString("base64");
+        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
+        await client.connect(mcpUrl);
+        try {
+            const result = await Promise.race([
+                client.callTool("get_file_contents", {
+                    project_id: TEST_PROJECT_ID,
+                    file_path: "sample.pdf",
+                    ref: "main",
+                }),
+                new Promise((_, reject) => {
+                    const timer = setTimeout(() => reject(new Error("get_file_contents timed out")), 5_000);
+                    timer.unref();
+                }),
+            ]);
+            const responseText = result.content?.[0]?.type === "text" ? result.content[0].text : "";
+            const file = JSON.parse(responseText);
+            assert.strictEqual(file.content, expectedContent);
+            assert.strictEqual(file.encoding, "base64");
+        }
+        finally {
+            await client.disconnect();
+        }
+    });
+    test("decodes valid UTF-8 file content", async () => {
+        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
+        await client.connect(mcpUrl);
+        try {
+            const result = await client.callTool("get_file_contents", {
+                project_id: TEST_PROJECT_ID,
+                file_path: "README.md",
+                ref: "main",
+            });
+            const responseText = result.content?.[0]?.type === "text" ? result.content[0].text : "";
+            const file = JSON.parse(responseText);
+            assert.strictEqual(file.content, "Hello, 世界\n");
+            assert.strictEqual(file.encoding, "utf8");
+        }
+        finally {
+            await client.disconnect();
+        }
+    });
+    test("decodes empty file content as UTF-8", async () => {
+        const client = new CustomHeaderClient({ Authorization: `Bearer ${MOCK_TOKEN}` });
+        await client.connect(mcpUrl);
+        try {
+            const result = await client.callTool("get_file_contents", {
+                project_id: TEST_PROJECT_ID,
+                file_path: "empty.txt",
+                ref: "main",
+            });
+            const responseText = result.content?.[0]?.type === "text" ? result.content[0].text : "";
+            const file = JSON.parse(responseText);
+            assert.strictEqual(file.content, "");
+            assert.strictEqual(file.encoding, "utf8");
+        }
+        finally {
+            await client.disconnect();
+        }
+    });
+});

package/build/test/test-job-artifacts.js

@@ -123,8 +123,9 @@ describe('job artifacts tools', () => {
         });
         await mockGitLab.start();
         mockGitLabUrl = mockGitLab.getUrl();
-        // Create a temp directory for download tests
-        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gitlab-mcp-test-'));
+        // Relative temp dir — absolute local_path is rejected as traversal
+        tmpDir = `gitlab-mcp-test-artifacts-${process.pid}`;
+        fs.mkdirSync(tmpDir, { recursive: true });
     });
     after(async () => {
         await mockGitLab.stop();
@@ -167,6 +168,30 @@ describe('job artifacts tools', () => {
         assert.ok(fs.existsSync(result.file_path), `File should exist at ${result.file_path}`);
         assert.ok(fs.existsSync(nestedLocalPath), `Directory should be created at ${nestedLocalPath}`);
     });
+    test('download_job_artifacts rejects local_path with directory traversal', async () => {
+        await assert.rejects(() => callTool('download_job_artifacts', { project_id: TEST_PROJECT_ID, job_id: TEST_JOB_ID, local_path: '../../../tmp' }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (err) => {
+            const msg = String(err.message || err).toLowerCase();
+            return msg.includes('traversal') || msg.includes('invalid');
+        });
+    });
+    test('download_job_artifacts rejects symlink local_path escape', async () => {
+        const linkName = path.join(tmpDir, 'symlink-escape');
+        fs.symlinkSync(os.tmpdir(), linkName);
+        await assert.rejects(() => callTool('download_job_artifacts', { project_id: TEST_PROJECT_ID, job_id: TEST_JOB_ID, local_path: linkName }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        }), (err) => {
+            const msg = String(err.message || err).toLowerCase();
+            return (msg.includes('symbolic') ||
+                msg.includes('symlink') ||
+                msg.includes('escapes') ||
+                msg.includes('traversal') ||
+                msg.includes('invalid'));
+        });
+    });
     test('get_job_artifact_file returns file content', async () => {
         const result = await callTool('get_job_artifact_file', {
             project_id: TEST_PROJECT_ID,

package/build/test/test-merge-request-approval-state-tools.js

@@ -6,6 +6,7 @@ const MOCK_TOKEN = "glpat-mock-token-approval";
 const TEST_PROJECT_ID = "123";
 const TEST_MR_IID_WITH_FALLBACK = "88";
 const TEST_MR_IID_WITH_APPROVAL_STATE = "89";
+const TEST_MR_IID_WITHOUT_RULES = "90";
 async function callTool(toolName, args, env) {
     return new Promise((resolve, reject) => {
         const proc = spawn("node", ["build/index.js"], {
@@ -133,6 +134,33 @@ describe("merge request approval state tools", () => {
                 ],
             });
         });
+        // A project without approval rules answers 200 with an empty rules array, while
+        // the approval itself is only visible on /approvals.
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/merge_requests/${TEST_MR_IID_WITHOUT_RULES}/approval_state`, (_req, res) => {
+            res.json({
+                approval_rules_overwritten: false,
+                rules: [],
+            });
+        });
+        mockGitLab.addMockHandler("get", `/projects/${TEST_PROJECT_ID}/merge_requests/${TEST_MR_IID_WITHOUT_RULES}/approvals`, (_req, res) => {
+            res.json({
+                approved: true,
+                user_has_approved: false,
+                user_can_approve: true,
+                approved_by: [
+                    {
+                        user: {
+                            id: "35",
+                            username: "sergey.kravchenya",
+                            name: "Sergey Kravchenya",
+                            state: "active",
+                            avatar_url: "https://gitlab.mock/uploads/avatar.png",
+                            web_url: "https://gitlab.mock/sergey.kravchenya",
+                        },
+                    },
+                ],
+            });
+        });
         await mockGitLab.start();
         mockGitLabUrl = mockGitLab.getUrl();
     });
@@ -153,6 +181,20 @@ describe("merge request approval state tools", () => {
         assert.ok(Array.isArray(result.approved_by));
         assert.strictEqual(result.approved_by[0].username, "sergey.kravchenya");
     });
+    test("finds approvers via approvals when approval_state reports no rules", async () => {
+        const result = await callTool("get_merge_request_approval_state", {
+            project_id: TEST_PROJECT_ID,
+            merge_request_iid: TEST_MR_IID_WITHOUT_RULES,
+        }, {
+            GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+        });
+        assert.strictEqual(result.source_endpoint, "approvals");
+        assert.strictEqual(result.approved, true);
+        assert.deepStrictEqual(result.approved_by_usernames, ["sergey.kravchenya"]);
+        assert.ok(Array.isArray(result.approved_by));
+        assert.strictEqual(result.approved_by[0].username, "sergey.kravchenya");
+    });
     test("returns deduplicated approvers from approval_state rules", async () => {
         const result = await callTool("get_merge_request_approval_state", {
             project_id: TEST_PROJECT_ID,

package/build/test/test-upload-markdown.js

@@ -89,7 +89,7 @@ describe('upload_markdown', () => {
         await mockGitLab.stop();
     });
     test('Content-Type is multipart/form-data with a boundary', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-ct-test.txt');
+        const tmpFile = `mcp-upload-ct-test-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'content-type test');
         try {
             await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
@@ -102,7 +102,7 @@ describe('upload_markdown', () => {
         }
     });
     test('multipart body contains a "file" field with the file content', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-body-test.txt');
+        const tmpFile = `mcp-upload-body-test-${process.pid}.txt`;
         const fileContent = 'hello from multipart upload test';
         fs.writeFileSync(tmpFile, fileContent);
         try {
@@ -116,19 +116,19 @@ describe('upload_markdown', () => {
         }
     });
     test('multipart body includes the original filename', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-filename-check.txt');
+        const tmpFile = `mcp-upload-filename-check-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'filename check');
         try {
             await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
             assert.ok(lastRawBody, 'Request body must be captured');
-            assert.ok(lastRawBody.includes('mcp-upload-filename-check.txt'), 'Multipart body should include the original filename');
+            assert.ok(lastRawBody.includes(`mcp-upload-filename-check-${process.pid}.txt`), 'Multipart body should include the original filename');
         }
         finally {
             fs.unlinkSync(tmpFile);
         }
     });
     test('returns markdown, url, alt, and full_path from upload response', async () => {
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-response-test.txt');
+        const tmpFile = `mcp-upload-response-test-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'response field test');
         try {
             const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
@@ -148,7 +148,7 @@ describe('upload_markdown', () => {
     test('accepts upload responses without id from older self-hosted GitLab', async () => {
         const { id: _id, ...idlessUploadResponse } = MOCK_UPLOAD_RESPONSE;
         uploadResponse = idlessUploadResponse;
-        const tmpFile = path.join(os.tmpdir(), 'mcp-upload-idless-response-test.txt');
+        const tmpFile = `mcp-upload-idless-response-test-${process.pid}.txt`;
         fs.writeFileSync(tmpFile, 'idless response field test');
         try {
             const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
@@ -167,9 +167,40 @@ describe('upload_markdown', () => {
         }
     });
     test('returns an error when the file does not exist', async () => {
-        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '/nonexistent/no-such-file.txt' }, env);
+        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: `mcp-upload-missing-${process.pid}.txt` }, env);
         const hasError = typeof raw.error?.message === 'string' ||
             raw.result?.content?.some(c => c.text && (c.text.toLowerCase().includes('not found') || c.text.toLowerCase().includes('error')));
         assert.ok(hasError, 'Should return an error for a nonexistent file path');
     });
+    test('rejects absolute file_path (path traversal / arbitrary read)', async () => {
+        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '/etc/passwd' }, env);
+        const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+            (raw.result?.content?.map(c => c.text || '').join(' ') || '');
+        assert.ok(msg.toLowerCase().includes('traversal') || msg.toLowerCase().includes('invalid'), `Expected traversal rejection, got: ${msg}`);
+    });
+    test('rejects file_path with ".." traversal', async () => {
+        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '../../../etc/passwd' }, env);
+        const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+            (raw.result?.content?.map(c => c.text || '').join(' ') || '');
+        assert.ok(msg.toLowerCase().includes('traversal') || msg.toLowerCase().includes('invalid'), `Expected traversal rejection, got: ${msg}`);
+    });
+    test('rejects file_path that is a symlink escape', async () => {
+        const linkName = `mcp-upload-symlink-${process.pid}.txt`;
+        const target = path.join(os.tmpdir(), `mcp-upload-secret-${process.pid}.txt`);
+        fs.writeFileSync(target, 'secret-content');
+        fs.symlinkSync(target, linkName);
+        try {
+            const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: linkName }, env);
+            const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+                (raw.result?.content?.map(c => c.text || '').join(' ') || '');
+            assert.ok(msg.toLowerCase().includes('symbolic') ||
+                msg.toLowerCase().includes('symlink') ||
+                msg.toLowerCase().includes('escapes') ||
+                msg.toLowerCase().includes('invalid'), `Expected symlink rejection, got: ${msg}`);
+        }
+        finally {
+            fs.rmSync(linkName, { force: true });
+            fs.rmSync(target, { force: true });
+        }
+    });
 });

package/build/test/utils/helpers-path.test.js

@@ -0,0 +1,104 @@
+import { describe, test } from "node:test";
+import assert from "node:assert";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { assertSafeRelativePath, openSafeOutputWriteStream, readSafeExistingFile, resolveSafeExistingPath, resolveSafeOutputDir, resolveSafeOutputFile, } from "../../utils/helpers.js";
+describe("assertSafeRelativePath", () => {
+    test("allows relative paths", () => {
+        assert.strictEqual(assertSafeRelativePath("uploads"), "uploads");
+        assert.strictEqual(assertSafeRelativePath("uploads/nested"), path.normalize("uploads/nested"));
+    });
+    test("rejects absolute paths", () => {
+        assert.throws(() => assertSafeRelativePath("/etc/passwd", "file_path"), /traversal/);
+    });
+    test("rejects parent-directory traversal", () => {
+        assert.throws(() => assertSafeRelativePath("../../../tmp", "local_path"), /traversal/);
+        assert.throws(() => assertSafeRelativePath("foo/../../etc", "local_path"), /traversal/);
+    });
+});
+describe("resolveSafeExistingPath / resolveSafeOutputDir", () => {
+    let base;
+    test("setup base dir", () => {
+        base = fs.mkdtempSync(path.join(os.tmpdir(), "safe-path-"));
+    });
+    test("resolves an existing file inside the base", () => {
+        const file = path.join(base, "ok.txt");
+        fs.writeFileSync(file, "hello");
+        const resolved = resolveSafeExistingPath("ok.txt", "file_path", base);
+        assert.strictEqual(resolved, fs.realpathSync(file));
+    });
+    test("rejects symlink file escape on read", () => {
+        const target = path.join(os.tmpdir(), `outside-target-${process.pid}.txt`);
+        fs.writeFileSync(target, "secret");
+        fs.symlinkSync(target, path.join(base, "link.txt"));
+        try {
+            assert.throws(() => resolveSafeExistingPath("link.txt", "file_path", base), /symbolic links|escapes/);
+        }
+        finally {
+            fs.unlinkSync(target);
+        }
+    });
+    test("rejects symlink directory escape on write", () => {
+        fs.symlinkSync(os.tmpdir(), path.join(base, "escape-dir"));
+        assert.throws(() => resolveSafeOutputDir("escape-dir", "local_path", base), /symbolic links|escapes/);
+    });
+    test("creates nested output dirs that stay inside the base", () => {
+        const out = resolveSafeOutputDir(path.join("artifacts", "run-1"), "local_path", base);
+        const baseReal = fs.realpathSync(base);
+        const rel = path.relative(baseReal, out);
+        assert.ok(rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel)));
+        assert.ok(fs.statSync(out).isDirectory());
+    });
+    test("resolveSafeOutputFile rejects destination file symlink", () => {
+        const outDir = path.join(base, "out");
+        fs.mkdirSync(outDir, { recursive: true });
+        const target = path.join(os.tmpdir(), `outside-write-${process.pid}.txt`);
+        fs.writeFileSync(target, "before");
+        fs.symlinkSync(target, path.join(outDir, "payload.bin"));
+        try {
+            assert.throws(() => resolveSafeOutputFile("payload.bin", "out", "local_path", base), /symbolic links/);
+        }
+        finally {
+            fs.unlinkSync(target);
+        }
+    });
+    test("resolveSafeOutputFile returns contained path for new files", () => {
+        const dest = resolveSafeOutputFile("fresh.bin", "downloads", "local_path", base);
+        assert.ok(dest.startsWith(fs.realpathSync(base) + path.sep));
+        assert.ok(dest.endsWith(`${path.sep}fresh.bin`));
+    });
+    test("anchors to cwd snapshot when baseDir is omitted", () => {
+        const nested = path.join(base, "anchored");
+        fs.mkdirSync(nested, { recursive: true });
+        const file = path.join(nested, "data.txt");
+        fs.writeFileSync(file, "anchored");
+        const originalCwd = process.cwd();
+        try {
+            process.chdir(nested);
+            const resolved = resolveSafeExistingPath("data.txt", "file_path");
+            assert.strictEqual(resolved, fs.realpathSync(file));
+        }
+        finally {
+            process.chdir(originalCwd);
+        }
+    });
+    test("readSafeExistingFile reads without returning a reusable path", () => {
+        const file = path.join(base, "inline.txt");
+        fs.writeFileSync(file, "payload");
+        const { buffer, basename } = readSafeExistingFile("inline.txt", "file_path", base);
+        assert.strictEqual(buffer.toString(), "payload");
+        assert.strictEqual(basename, "inline.txt");
+    });
+    test("openSafeOutputWriteStream writes without a separate createWriteStream call", async () => {
+        const { stream, path: dest } = openSafeOutputWriteStream("streamed.bin", "downloads", "local_path", base);
+        await new Promise((resolve, reject) => {
+            stream.on("error", reject);
+            stream.end("streamed", () => resolve());
+        });
+        assert.strictEqual(fs.readFileSync(dest, "utf8"), "streamed");
+    });
+    test("cleanup base dir", () => {
+        fs.rmSync(base, { recursive: true, force: true });
+    });
+});

package/build/utils/helpers.js

@@ -1,3 +1,208 @@
+import fs from "node:fs";
+import path from "node:path";
+/**
+ * Reject absolute paths and directory-traversal sequences for user-supplied
+ * local filesystem paths (e.g. local_path / file_path tool arguments).
+ *
+ * Returns the normalized relative path on success. This is a lexical check
+ * only — callers that touch the filesystem must also use
+ * {@link resolveSafeExistingPath}, {@link resolveSafeOutputDir}, or
+ * {@link resolveSafeOutputFile}.
+ */
+export function assertSafeRelativePath(inputPath, label = "path") {
+    const normalized = path.normalize(inputPath);
+    if (path.isAbsolute(normalized) ||
+        normalized === ".." ||
+        normalized.startsWith(".." + path.sep) ||
+        normalized.includes(path.sep + ".." + path.sep)) {
+        throw new Error(`Invalid ${label}: directory traversal is not allowed.`);
+    }
+    return normalized;
+}
+/** Snapshot and canonicalize the trusted base directory once per operation. */
+function resolveTrustedBaseDir(baseDir) {
+    const anchor = baseDir ?? process.cwd();
+    return fs.realpathSync(anchor);
+}
+function isInsideBase(candidate, baseReal) {
+    const relative = path.relative(baseReal, candidate);
+    // "" = same path; absolute relative = different Windows volume root.
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+/**
+ * Walk each path component under baseReal and reject symbolic links so a
+ * repository-controlled symlink cannot escape the trusted base directory.
+ */
+function assertNoSymlinkComponents(baseReal, relative, label) {
+    const parts = relative.split(path.sep).filter(part => part.length > 0 && part !== ".");
+    let current = baseReal;
+    for (const part of parts) {
+        const next = path.join(current, part);
+        let st;
+        try {
+            st = fs.lstatSync(next);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT") {
+                // Remaining components do not exist yet (typical for mkdir output dirs).
+                return;
+            }
+            throw err;
+        }
+        if (st.isSymbolicLink()) {
+            throw new Error(`Invalid ${label}: symbolic links are not allowed.`);
+        }
+        current = next;
+    }
+}
+/**
+ * Resolve a user-supplied relative path to an existing file/dir that is
+ * guaranteed to stay inside `baseDir` after symlink resolution.
+ */
+export function resolveSafeExistingPath(inputPath, label = "path", baseDir) {
+    const relative = assertSafeRelativePath(inputPath, label);
+    const baseReal = resolveTrustedBaseDir(baseDir);
+    assertNoSymlinkComponents(baseReal, relative, label);
+    const absolute = path.resolve(baseReal, relative);
+    if (!isInsideBase(absolute, baseReal)) {
+        throw new Error(`Invalid ${label}: path escapes the allowed directory.`);
+    }
+    if (!fs.existsSync(absolute)) {
+        throw new Error(`File not found: ${relative}`);
+    }
+    const real = fs.realpathSync(absolute);
+    if (!isInsideBase(real, baseReal)) {
+        throw new Error(`Invalid ${label}: path escapes the allowed directory.`);
+    }
+    return real;
+}
+/**
+ * Resolve a user-supplied relative output directory under `baseDir`, creating
+ * it if needed. Rejects symlink components and verifies the final real path
+ * remains inside the base.
+ */
+export function resolveSafeOutputDir(inputDir, label = "local_path", baseDir) {
+    const relative = assertSafeRelativePath(inputDir, label);
+    const baseReal = resolveTrustedBaseDir(baseDir);
+    assertNoSymlinkComponents(baseReal, relative, label);
+    const absolute = path.resolve(baseReal, relative);
+    // Reject escapes before mkdir so we never create dirs outside the base.
+    if (!isInsideBase(absolute, baseReal)) {
+        throw new Error(`Invalid ${label}: path escapes the allowed directory.`);
+    }
+    fs.mkdirSync(absolute, { recursive: true });
+    const real = fs.realpathSync(absolute);
+    if (!isInsideBase(real, baseReal)) {
+        throw new Error(`Invalid ${label}: path escapes the allowed directory.`);
+    }
+    return real;
+}
+/**
+ * Build a write destination under a trusted directory. Rejects an existing
+ * destination symlink so createWriteStream cannot follow it outside the base.
+ *
+ * When `inputDir` is omitted, the file is resolved under `baseDir` itself
+ * (still rejecting symlink destinations).
+ */
+export function resolveSafeOutputFile(filename, inputDir, label = "local_path", baseDir) {
+    if (!filename ||
+        filename === "." ||
+        filename === ".." ||
+        filename.includes("/") ||
+        filename.includes("\\") ||
+        filename.includes(path.sep)) {
+        throw new Error(`Invalid ${label}: directory separators are not allowed in filename.`);
+    }
+    const baseReal = resolveTrustedBaseDir(baseDir);
+    const dirReal = inputDir ? resolveSafeOutputDir(inputDir, label, baseReal) : baseReal;
+    const dest = path.join(dirReal, filename);
+    try {
+        const st = fs.lstatSync(dest);
+        if (st.isSymbolicLink()) {
+            throw new Error(`Invalid ${label}: symbolic links are not allowed.`);
+        }
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT") {
+            throw err;
+        }
+    }
+    return dest;
+}
+const READ_OPEN_FLAGS = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0);
+const WRITE_OPEN_FLAGS = fs.constants.O_WRONLY |
+    fs.constants.O_CREAT |
+    fs.constants.O_TRUNC |
+    (fs.constants.O_NOFOLLOW ?? 0);
+/**
+ * Validate and read a file in one step so callers never reuse a path string
+ * after a symlink swap (final-component TOCTOU mitigation via O_NOFOLLOW).
+ */
+export function readSafeExistingFile(inputPath, label = "path", baseDir) {
+    const relative = assertSafeRelativePath(inputPath, label);
+    const baseReal = resolveTrustedBaseDir(baseDir);
+    assertNoSymlinkComponents(baseReal, relative, label);
+    const absolute = path.resolve(baseReal, relative);
+    if (!isInsideBase(absolute, baseReal)) {
+        throw new Error(`Invalid ${label}: path escapes the allowed directory.`);
+    }
+    if (!fs.existsSync(absolute)) {
+        throw new Error(`File not found: ${relative}`);
+    }
+    const fd = fs.openSync(absolute, READ_OPEN_FLAGS);
+    try {
+        const st = fs.fstatSync(fd);
+        if (st.isSymbolicLink()) {
+            throw new Error(`Invalid ${label}: symbolic links are not allowed.`);
+        }
+        const real = fs.realpathSync(absolute);
+        if (!isInsideBase(real, baseReal)) {
+            throw new Error(`Invalid ${label}: path escapes the allowed directory.`);
+        }
+        return { buffer: fs.readFileSync(fd), basename: path.basename(relative) };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/**
+ * Validate an output destination and open a write stream immediately so the
+ * path is not handed back for a separate createWriteStream call.
+ */
+export function openSafeOutputWriteStream(filename, inputDir, label = "local_path", baseDir) {
+    if (!filename ||
+        filename === "." ||
+        filename === ".." ||
+        filename.includes("/") ||
+        filename.includes("\\") ||
+        filename.includes(path.sep)) {
+        throw new Error(`Invalid ${label}: directory separators are not allowed in filename.`);
+    }
+    const dirReal = inputDir
+        ? resolveSafeOutputDir(inputDir, label, baseDir)
+        : resolveTrustedBaseDir(baseDir);
+    const dest = path.join(dirReal, filename);
+    try {
+        const st = fs.lstatSync(dest);
+        if (st.isSymbolicLink()) {
+            throw new Error(`Invalid ${label}: symbolic links are not allowed.`);
+        }
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT") {
+            throw err;
+        }
+    }
+    const fd = fs.openSync(dest, WRITE_OPEN_FLAGS, 0o666);
+    const stream = fs.createWriteStream(null, {
+        fd,
+        autoClose: true,
+    });
+    return { stream, path: dest };
+}
 /**
  * Estimate the number of merge commits that will be added based on the merge method.
  */

package/build/utils/logger.js

@@ -18,6 +18,10 @@ const REDACT_PATHS = [
     "*.sessionId",
     "ctx.sessionId",
     "context.sessionId",
+    "approval_password",
+    "*.approval_password",
+    "arguments.approval_password",
+    "params.arguments.approval_password",
 ];
 /**
  * Create a pino logger with consistent redaction, level, format, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.46",
+  "version": "2.1.47",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [
@@ -53,7 +53,7 @@
     "test": "npm run test:all",
     "test:all": "npm run build && npm run test:mock && npm run test:live",
     "test:mock": "bash scripts/run-mock-tests.sh",
-    "test:stateless": "npm run build && node --import tsx/esm --test --experimental-test-isolation=none test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts",
+    "test:stateless": "npm run build && node --import tsx/esm --test --experimental-test-isolation=none test/stateless/codec.test.ts test/stateless/client-id.test.ts test/stateless/callback-proxy.test.ts test/stateless/session-id.test.ts test/stateless/session-id-integration.test.ts test/stateless/config-ttl.test.ts test/stateless/consumed-proxy-code-cache.test.ts",
     "test:mcp-oauth": "npm run build && node --import tsx/esm --test test/mcp-oauth-tests.ts",
     "test:live": "node test/validate-api.js",
     "test:consumer-smoke": "bash scripts/consumer-install-smoke.sh",