@zereight/mcp-gitlab 2.1.63 → 2.1.65

package/build/test/path-segment-encoding.test.js

@@ -1,7 +1,9 @@
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { test } from "node:test";
-const source = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
+import { encodeGitLabPath, encodeGitLabPathSegment } from "../utils/url.js";
+const readSource = (relativePath) => readFileSync(new URL(relativePath, import.meta.url), "utf8");
+const indexSource = readSource("../index.ts");
 const rawPathSegmentPatterns = [
     "/issues/${issueIid}",
     "/merge_requests/${mergeRequestIid}",
@@ -21,22 +23,76 @@ const rawPathSegmentPatterns = [
 ];
 test("GitLab URL path IDs are encoded before interpolation", () => {
     for (const pattern of rawPathSegmentPatterns) {
-        assert.equal(source.includes(pattern), false, `${pattern} must use encodeGitLabPathSegment`);
+        assert.equal(indexSource.includes(pattern), false, `${pattern} must use encodeGitLabPathSegment`);
     }
 });
-test("encoding keeps path traversal payloads inside one URL segment", () => {
-    const payload = "1/../../../../admin/ci/variables";
-    const url = new URL(`https://gitlab.com/api/v4/projects/42/issues/${encodeURIComponent(payload)}/notes`);
-    assert.equal(url.pathname, "/api/v4/projects/42/issues/1%2F..%2F..%2F..%2F..%2Fadmin%2Fci%2Fvariables/notes");
-});
-test("job_id path traversal stays under /jobs/", () => {
-    // GHSA-7c3w-fxgh-frc7 / #587: unencoded job_id with ../ escaped to /api/v4/user
-    const payload = "../../../user";
-    const url = new URL(`https://gitlab.com/api/v4/projects/1/jobs/${encodeURIComponent(payload)}/trace`);
-    assert.equal(url.pathname, "/api/v4/projects/1/jobs/..%2F..%2F..%2Fuser/trace");
-    assert.match(url.pathname, /\/jobs\/[^/]+\/trace$/);
-    assert.equal(url.pathname.includes("/api/v4/user"), false);
-});
-test("malformed percent-encoded segments can still be encoded", () => {
-    assert.equal(encodeURIComponent("bad%zz/path"), "bad%25zz%2Fpath");
+/**
+ * encodeURIComponent() does not validate what it encodes: "../../user" becomes
+ * "..%2F..%2Fuser", which a server that decodes the separator turns back into a
+ * traversal. Every value that lands in a URL path goes through
+ * encodeGitLabPathSegment()/encodeGitLabPath() instead; plain encoding stays only
+ * for query-string values, where a "/" is data and not a path separator.
+ */
+const queryStringEncoders = [
+    "?source_branch=${encodeURIComponent(branchName)}",
+    "?access_token=${encodeURIComponent(token)}",
+];
+const serverSources = [
+    ["index.ts", "../index.ts"],
+    ["downloads/proxy.ts", "../downloads/proxy.ts"],
+    ["oauth-proxy.ts", "../oauth-proxy.ts"],
+];
+for (const [name, relativePath] of serverSources) {
+    test(`${name} validates values before they reach a URL path`, () => {
+        for (const line of readSource(relativePath).split("\n")) {
+            if (!line.includes("encodeURIComponent("))
+                continue;
+            assert.ok(queryStringEncoders.some(allowed => line.includes(allowed)), `${name} encodes a URL value without validating it: ${line.trim()}`);
+        }
+    });
+}
+test("plain encoding of a project path would leave the traversal visible", () => {
+    // The payload this guard exists for: the old encoder emits the separators, so a
+    // server that decodes them routes the request to /api/v4/user.
+    const payload = "../../user";
+    const legacy = `https://gitlab.com/api/v4/projects/${encodeURIComponent(payload)}`;
+    assert.equal(new URL(legacy).pathname, "/api/v4/projects/..%2F..%2Fuser");
+});
+test("the validated encoder keeps an ordinary project path inside one segment", () => {
+    const url = new URL(`https://gitlab.com/api/v4/projects/${encodeGitLabPathSegment("group/project")}/issues/${encodeGitLabPathSegment("1")}/notes`);
+    assert.equal(url.pathname, "/api/v4/projects/group%2Fproject/issues/1/notes");
+});
+test("path traversal payloads are rejected instead of encoded into one segment", () => {
+    // GHSA-7c3w-fxgh-frc7 / #587: an unencoded job_id with ../ escaped to /api/v4/user
+    for (const payload of [
+        "../../../user",
+        "1/../../../../admin/ci/variables",
+        "..%2F..%2Fuser",
+        "..%252F..%252Fuser",
+        "/etc/passwd",
+    ]) {
+        assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/, payload);
+    }
+});
+test("a slash-separated path cannot start outside its route prefix", () => {
+    assert.throws(() => encodeGitLabPath("/etc/passwd"), /Cannot use value as a GitLab URL path/);
+    assert.throws(() => encodeGitLabPath("1/../../../../admin/ci/variables"), /Cannot use value as a GitLab URL path segment/);
+});
+test("a broken escape next to a valid one is rejected, not passed through", () => {
+    // A guard cannot inspect a value it fails to decode: "%2E%2E%2F%ZZ" still holds a
+    // real escape that may hide a separator, so it must not be forwarded unvalidated.
+    assert.throws(() => encodeGitLabPathSegment("%2E%2E%2F%ZZ"), /Cannot use value as a GitLab URL path segment/);
+});
+test("the artifact path goes through the shared multi-segment validator", () => {
+    // getJobArtifactFile() was the last call site that split the path itself. The
+    // hand-rolled version kept empty segments, so "a//b" reached the URL as an extra
+    // separator instead of being rejected like every other call site.
+    assert.ok(indexSource.includes("const encodedArtifactPath = encodeGitLabPath(artifactPath);"), "artifact paths must go through encodeGitLabPath");
+    assert.equal(indexSource.includes(".map(segment => encodeGitLabPathSegment(segment))"), false, "artifact paths must not be split into segments by hand");
+});
+test("a percent sign that starts no escape stays a literal character", () => {
+    // "bad%zz/path" cannot be decoded either, but it holds no escape at all, so the
+    // guard sees the entire value and the percent sign is encoded as data. Rejecting
+    // it would break every file or branch name containing "%".
+    assert.equal(encodeGitLabPathSegment("bad%zz/path"), "bad%25zz%2Fpath");
 });

package/build/test/sse-session-limits.test.js

@@ -0,0 +1,273 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import http from "node:http";
+import { afterEach, describe, test } from "node:test";
+import * as path from "node:path";
+import { findAvailablePort } from "./utils/server-launcher.js";
+const LOOPBACK = "127.0.0.1";
+const SSE_TOKEN = "mcp_sse_secret";
+const SERVER_PATH = path.resolve(process.cwd(), "build/index.js");
+// Keeps connection churn from tripping the per-IP creation limit in tests that
+// are not about rate limiting.
+const UNTHROTTLED = "1000";
+const running = new Set();
+function startSseServer(env, port) {
+    const child = spawn("node", [SERVER_PATH], {
+        env: {
+            ...process.env,
+            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
+            HOST: "0.0.0.0",
+            PORT: String(port),
+            SSE: "true",
+            STREAMABLE_HTTP: "false",
+            REMOTE_AUTHORIZATION: "false",
+            GITLAB_MCP_OAUTH: "false",
+            GITLAB_USE_OAUTH: "false",
+            GITLAB_PERSONAL_ACCESS_TOKEN: "glpat_test",
+            GITLAB_JOB_TOKEN: "",
+            GITLAB_AUTH_COOKIE_PATH: "",
+            SSE_AUTH_TOKEN: SSE_TOKEN,
+            ...env,
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    running.add(child);
+    child.once("exit", () => running.delete(child));
+    return child;
+}
+async function waitForHealth(port, timeoutMs = 10000) {
+    const deadline = Date.now() + timeoutMs;
+    let lastError;
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(`http://${LOOPBACK}:${port}/health`);
+            if (response.ok)
+                return;
+        }
+        catch (error) {
+            lastError = error;
+        }
+        await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    throw new Error(`server did not become healthy: ${String(lastError)}`);
+}
+function openSseConnection(port) {
+    let statusCode;
+    let text = "";
+    let resolveEnded = () => { };
+    const ended = new Promise(resolve => {
+        resolveEnded = resolve;
+    });
+    const request = http.get({
+        host: LOOPBACK,
+        port,
+        path: "/sse",
+        headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+    }, response => {
+        statusCode = response.statusCode;
+        response.on("data", chunk => {
+            text += chunk.toString();
+        });
+        response.on("end", () => resolveEnded());
+        response.on("close", () => resolveEnded());
+    });
+    request.on("error", () => resolveEnded());
+    return {
+        get statusCode() {
+            return statusCode;
+        },
+        streamText: () => text,
+        close: () => {
+            request.destroy();
+            resolveEnded();
+        },
+        ended,
+    };
+}
+async function waitFor(predicate, timeoutMs = 5000, stepMs = 50) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (predicate())
+            return true;
+        await new Promise(resolve => setTimeout(resolve, stepMs));
+    }
+    return predicate();
+}
+/** Resolves true when the server ends the stream within the window. */
+async function endedWithin(connection, ms) {
+    return Promise.race([
+        connection.ended.then(() => true),
+        new Promise(resolve => setTimeout(() => resolve(false), ms)),
+    ]);
+}
+/** Reads the session id the transport advertises in its opening `endpoint` event. */
+async function readSessionId(connection, timeoutMs = 5000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const match = /data: \/messages\?sessionId=([^\s]+)/.exec(connection.streamText());
+        if (match)
+            return match[1];
+        await new Promise(resolve => setTimeout(resolve, 25));
+    }
+    throw new Error(`SSE stream did not advertise a session id: ${connection.streamText()}`);
+}
+async function postSseMessage(port, sessionId, body) {
+    const response = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=${sessionId}`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${SSE_TOKEN}`, "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    await response.arrayBuffer();
+    return response.status;
+}
+async function getSseStatus(port) {
+    const response = await fetch(`http://${LOOPBACK}:${port}/sse`, {
+        headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+    });
+    await response.arrayBuffer();
+    return response.status;
+}
+/**
+ * Connection attempts are rate-limited per IP, so a capacity slot released
+ * asynchronously has to be polled for instead of raced with a single request.
+ */
+async function waitForAcceptedConnection(port, timeoutMs = 5000) {
+    const deadline = Date.now() + timeoutMs;
+    let connection = openSseConnection(port);
+    for (;;) {
+        await waitFor(() => connection.statusCode !== undefined, 2000, 25);
+        if (connection.statusCode === 200)
+            return connection;
+        connection.close();
+        if (Date.now() >= deadline)
+            return connection;
+        await new Promise(resolve => setTimeout(resolve, 100));
+        connection = openSseConnection(port);
+    }
+}
+afterEach(() => {
+    for (const child of running) {
+        if (!child.killed)
+            child.kill("SIGTERM");
+    }
+    running.clear();
+});
+describe("SSE session limits", { concurrency: 1 }, () => {
+    test("rejects new SSE connections once MAX_SESSIONS is reached", async () => {
+        const port = await findAvailablePort(4500);
+        startSseServer({ MAX_SESSIONS: "2", MAX_REQUESTS_PER_MINUTE: UNTHROTTLED }, port);
+        await waitForHealth(port);
+        const first = openSseConnection(port);
+        const second = openSseConnection(port);
+        const bothConnected = await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000);
+        assert.ok(bothConnected, "expected the first two SSE connections to be accepted");
+        const rejected = await fetch(`http://${LOOPBACK}:${port}/sse`, {
+            headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+        });
+        assert.equal(rejected.status, 503);
+        const body = (await rejected.json());
+        assert.match(body.error ?? "", /capacity/i);
+        first.close();
+        second.close();
+    });
+    test("frees the capacity slot when a client closes the stream", async () => {
+        const port = await findAvailablePort(4510);
+        startSseServer({ MAX_SESSIONS: "2", MAX_REQUESTS_PER_MINUTE: UNTHROTTLED }, port);
+        await waitForHealth(port);
+        const first = openSseConnection(port);
+        const second = openSseConnection(port);
+        assert.ok(await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000), "expected the first two SSE connections to be accepted");
+        assert.equal(await getSseStatus(port), 503, "expected the server to be at capacity");
+        first.close();
+        // SESSION_TIMEOUT_SECONDS is left at its 3600s default, so the slot can
+        // only come back through the response "close" handler - not the idle sweep.
+        const reclaimed = await waitForAcceptedConnection(port);
+        assert.equal(reclaimed.statusCode, 200, "closing a client connection should free its capacity slot");
+        reclaimed.close();
+        second.close();
+    });
+    test("rate-limits SSE connection creation per client IP", async () => {
+        const port = await findAvailablePort(4520);
+        startSseServer({ MAX_REQUESTS_PER_MINUTE: "2" }, port);
+        await waitForHealth(port);
+        const first = openSseConnection(port);
+        const second = openSseConnection(port);
+        assert.ok(await waitFor(() => first.statusCode === 200 && second.statusCode === 200, 5000), "expected the first two SSE connections to be accepted");
+        const rejected = await fetch(`http://${LOOPBACK}:${port}/sse`, {
+            headers: { Authorization: `Bearer ${SSE_TOKEN}`, Accept: "text/event-stream" },
+        });
+        assert.equal(rejected.status, 429);
+        const body = (await rejected.json());
+        assert.equal(body.error, "Rate limit exceeded");
+        assert.match(body.message ?? "", /per minute/i);
+        first.close();
+        second.close();
+    });
+    test("closes SSE sessions that stay idle", async () => {
+        const port = await findAvailablePort(4530);
+        startSseServer({ SESSION_TIMEOUT_SECONDS: "2" }, port);
+        await waitForHealth(port);
+        const connection = openSseConnection(port);
+        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
+        const closedByIdleTimeout = await Promise.race([
+            connection.ended.then(() => true),
+            new Promise(resolve => setTimeout(() => resolve(false), 12000)),
+        ]);
+        assert.equal(closedByIdleTimeout, true, "idle SSE session should be closed by the server");
+        connection.close();
+    });
+    test("POST /messages keeps an SSE session alive past the idle timeout", async () => {
+        const port = await findAvailablePort(4540);
+        startSseServer({ SESSION_TIMEOUT_SECONDS: "2" }, port);
+        await waitForHealth(port);
+        const connection = openSseConnection(port);
+        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
+        const sessionId = await readSessionId(connection);
+        // Ping across several idle windows; every POST /messages must reset activity.
+        const pingStatuses = [];
+        const keepAlive = setInterval(() => {
+            void postSseMessage(port, sessionId, { jsonrpc: "2.0", id: 1, method: "ping" })
+                .then(status => pingStatuses.push(status))
+                .catch(() => undefined);
+        }, 400);
+        try {
+            await new Promise(resolve => setTimeout(resolve, 6000));
+        }
+        finally {
+            clearInterval(keepAlive);
+        }
+        assert.ok(pingStatuses.length >= 8, `expected keep-alive pings to be sent, saw ${pingStatuses.length}`);
+        assert.ok(pingStatuses.every(status => status === 202), `expected every ping to be accepted, saw ${JSON.stringify(pingStatuses)}`);
+        assert.match(connection.streamText(), /"result"/, "expected a ping response on the stream");
+        assert.equal(await endedWithin(connection, 300), false, "POST /messages activity should keep the SSE session open");
+        assert.equal(await endedWithin(connection, 8000), true, "the session should close once POST /messages activity stops");
+        connection.close();
+    });
+    test("treats inherited object keys as unknown SSE sessions", async () => {
+        const port = await findAvailablePort(4560);
+        startSseServer({}, port);
+        await waitForHealth(port);
+        const response = await fetch(`http://${LOOPBACK}:${port}/messages?sessionId=constructor`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${SSE_TOKEN}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "ping" }),
+            signal: AbortSignal.timeout(3000),
+        });
+        assert.equal(response.status, 400);
+        assert.match(await response.text(), /No transport found/);
+    });
+    test("reports degraded health while SSE capacity is exhausted", async () => {
+        const port = await findAvailablePort(4550);
+        startSseServer({ MAX_SESSIONS: "1" }, port);
+        await waitForHealth(port);
+        const connection = openSseConnection(port);
+        assert.ok(await waitFor(() => connection.statusCode === 200, 5000), "expected the SSE connection to be accepted");
+        const degraded = await fetch(`http://${LOOPBACK}:${port}/health`);
+        const body = (await degraded.json());
+        assert.equal(degraded.status, 503);
+        assert.equal(body.status, "degraded");
+        assert.equal(body.activeSessions, 1);
+        assert.equal(body.maxSessions, 1);
+        connection.close();
+    });
+});

package/build/test/test-blank-filters.js

@@ -0,0 +1,156 @@
+import { describe, test, before, after, afterEach } from "node:test";
+import assert from "node:assert";
+import { spawn } from "child_process";
+import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
+const MOCK_TOKEN = "glpat-mock-token-12345";
+const TEST_PROJECT_ID = "123";
+// Cases below cover tools outside the default toolsets, so every toolset is enabled.
+const TOOLSET_ENV = { GITLAB_TOOLSETS: "all" };
+// Helper to run an MCP tool through the stdio server
+async function callTool(toolName, args, env) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("node", ["build/index.js"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: {
+                ...process.env,
+                ...TOOLSET_ENV,
+                ...env,
+                GITLAB_READ_ONLY_MODE: "true",
+            },
+        });
+        let output = "";
+        let errorOutput = "";
+        proc.stdout?.on("data", d => (output += d));
+        proc.stderr?.on("data", d => (errorOutput += d));
+        proc.on("close", code => {
+            if (code !== 0)
+                return reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
+            const line = output.split("\n").find(l => l.startsWith("{"));
+            if (!line)
+                return reject(new Error("No JSON output found"));
+            try {
+                const response = JSON.parse(line);
+                if (response.error) {
+                    reject(new Error(JSON.stringify(response.error)));
+                    return;
+                }
+                const content = response.result?.content?.[0]?.text;
+                if (content) {
+                    try {
+                        resolve(JSON.parse(content));
+                    }
+                    catch {
+                        reject(new Error(`Failed to parse tool output JSON: ${content}`));
+                    }
+                }
+                else {
+                    resolve(response.result);
+                }
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        proc.stdin?.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: toolName, arguments: args },
+        }) + "\n");
+    });
+}
+describe("blank query filters", () => {
+    let mockGitLab;
+    let mockGitLabUrl;
+    before(async () => {
+        const mockPort = await findMockServerPort();
+        mockGitLab = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
+        await mockGitLab.start();
+        mockGitLabUrl = mockGitLab.getUrl();
+    });
+    after(async () => {
+        await mockGitLab.stop();
+    });
+    afterEach(() => {
+        mockGitLab.clearCustomHandlers();
+    });
+    const env = () => ({
+        GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
+        GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
+    });
+    // Registers a handler that captures the request URL and answers with an empty list
+    function captureRequest(path) {
+        let capturedUrl;
+        mockGitLab.addMockHandler("get", path, (req, res) => {
+            capturedUrl = req.originalUrl;
+            res.json([]);
+        });
+        return () => {
+            assert.ok(capturedUrl, "Mock handler should have received a request");
+            return capturedUrl;
+        };
+    }
+    function searchOf(capturedUrl) {
+        return new URL(capturedUrl, "http://localhost").search;
+    }
+    test("list_labels omits blank filters", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/labels`);
+        const labels = await callTool("list_labels", { project_id: TEST_PROJECT_ID, search: "" }, env());
+        assert.deepStrictEqual(labels, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_tags omits blank filters", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/repository/tags`);
+        const tags = await callTool("list_tags", { project_id: TEST_PROJECT_ID, search: "   " }, env());
+        assert.deepStrictEqual(tags, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_pipelines omits blank filters", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/pipelines`);
+        const pipelines = await callTool("list_pipelines", { project_id: TEST_PROJECT_ID, ref: "" }, env());
+        assert.deepStrictEqual(pipelines, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_deployments omits blank filters", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/deployments`);
+        const deployments = await callTool("list_deployments", { project_id: TEST_PROJECT_ID, environment: "", ref: "\t" }, env());
+        assert.deepStrictEqual(deployments, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_environments omits blank filters", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/environments`);
+        const environments = await callTool("list_environments", { project_id: TEST_PROJECT_ID, name: " ", search: "" }, env());
+        assert.deepStrictEqual(environments, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_job_artifacts omits blank filters", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/jobs/7/artifacts/tree`);
+        const artifacts = await callTool("list_job_artifacts", { project_id: TEST_PROJECT_ID, job_id: "7", path: "" }, env());
+        assert.deepStrictEqual(artifacts, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_events omits blank filters", async () => {
+        const capturedUrl = captureRequest("/events");
+        const events = await callTool("list_events", { action: "", scope: " \t" }, env());
+        assert.deepStrictEqual(events, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_project_variables omits blank nested filters", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/variables`);
+        const variables = await callTool("list_project_variables", { project_id: TEST_PROJECT_ID, filter: { environment_scope: "  " } }, env());
+        assert.deepStrictEqual(variables, []);
+        assert.strictEqual(searchOf(capturedUrl()), "");
+    });
+    test("list_labels keeps a non-blank filter", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/labels`);
+        await callTool("list_labels", { project_id: TEST_PROJECT_ID, search: "bug" }, env());
+        const params = new URL(capturedUrl(), "http://localhost").searchParams;
+        assert.deepStrictEqual(params.getAll("search"), ["bug"]);
+    });
+    test("list_project_variables keeps a non-blank nested filter", async () => {
+        const capturedUrl = captureRequest(`/projects/${TEST_PROJECT_ID}/variables`);
+        await callTool("list_project_variables", { project_id: TEST_PROJECT_ID, filter: { environment_scope: "production" } }, env());
+        const params = new URL(capturedUrl(), "http://localhost").searchParams;
+        assert.deepStrictEqual(params.getAll("filter[environment_scope]"), ["production"]);
+    });
+});

package/build/test/test-download-attachment.js

@@ -72,6 +72,9 @@ describe('download_attachment', () => {
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/image.png`, (_req, res) => { res.set('Content-Type', 'image/png').send(MINIMAL_PNG_BUF); });
         // Plain-text upload endpoint
         mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/document.txt`, (_req, res) => { res.set('Content-Type', 'text/plain').send('hello world'); });
+        // GitLab redirects uploads to its object storage, so the hop after this response
+        // leaves the origin. The destination is a non-public address here.
+        mockGitLab.addMockHandler('get', `/projects/${TEST_PROJECT_ID}/uploads/${TEST_SECRET}/redirected.txt`, (_req, res) => { res.redirect('http://169.254.169.254/latest/meta-data/'); });
     });
     after(async () => {
         await mockGitLab.stop();
@@ -126,6 +129,14 @@ describe('download_attachment', () => {
             raw.result.content.some(c => typeof c.text === 'string' && c.text.toLowerCase().includes('traversal'));
         assert.ok(isRpcError || isContentError, 'Should return an error mentioning directory traversal');
     });
+    test('a redirect to a non-public address is refused', async () => {
+        const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'redirected.txt' }, env);
+        const mentionsRefusal = (text) => text.toLowerCase().includes('non-public address');
+        const isRpcError = typeof raw.error?.message === 'string' && mentionsRefusal(raw.error.message);
+        const isContentError = Array.isArray(raw.result?.content) &&
+            raw.result.content.some(c => typeof c.text === 'string' && mentionsRefusal(c.text));
+        assert.ok(isRpcError || isContentError, `Should refuse the redirect instead of following it, got ${JSON.stringify(raw)}`);
+    });
     test('local_path through a symlink directory is rejected', async () => {
         const linkDir = `omc-test-symlink-${RUN_ID}`;
         fs.rmSync(linkDir, { recursive: true, force: true });