@zereight/mcp-gitlab 2.1.63 → 2.1.65

package/build/test/utils/safe-redirect-fetch.test.js

@@ -0,0 +1,463 @@
+import assert from "node:assert/strict";
+import http from "node:http";
+import { after, before, describe, test } from "node:test";
+import { Agent, MockAgent } from "undici";
+import { fetchWithValidatedRedirects, isNonPublicAddress, UnsafeRedirectError, } from "../../utils/safe-redirect-fetch.js";
+const dispatcher = new Agent();
+/** A public IPv4 literal, so hop checks never depend on DNS resolution. */
+const PUBLIC_HOST = "93.184.216.34";
+let server;
+let origin;
+let serverPort;
+let secondServer;
+let secondOrigin;
+let secondPort;
+let lastSecondHeaders = {};
+/** Hosts the trusted-host predicate has been called with. */
+const trustedHostArguments = [];
+function listen(target) {
+    return new Promise(resolve => {
+        target.listen(0, "127.0.0.1", () => {
+            const address = target.address();
+            if (!address || typeof address === "string")
+                throw new Error("no port");
+            resolve(address.port);
+        });
+    });
+}
+/**
+ * A fetch stub that answers the first request with a redirect and every later one
+ * with a body, recording the headers used on each hop. Injected so hop policy can
+ * be asserted without reaching the network.
+ */
+function stubRedirectFetch(location, calls) {
+    const impl = async (input, init) => {
+        calls.push({ url: String(input), headers: { ...(init?.headers ?? {}) } });
+        if (calls.length === 1 && location) {
+            return new Response(null, { status: 302, headers: { location } });
+        }
+        return new Response("payload", { status: 200 });
+    };
+    return impl;
+}
+/**
+ * A fetch stub that walks a list of redirect locations: call N answers with
+ * `locations[N - 1]` and the call after the last location returns a body. Used to
+ * assert the header policy on chains longer than one hop.
+ */
+function stubRedirectChain(locations, calls) {
+    const impl = async (input, init) => {
+        calls.push({ url: String(input), headers: { ...(init?.headers ?? {}) } });
+        const location = locations[calls.length - 1];
+        if (location) {
+            return new Response(null, { status: 302, headers: { location } });
+        }
+        return new Response("payload", { status: 200 });
+    };
+    return impl;
+}
+/**
+ * Pass one injected client for both the hops that carry the credentials and the ones the
+ * helper strips. The stripped hops default to plain `undici`, so injecting only
+ * `fetchImpl` in a test would send the hop it wants to inspect to the network.
+ */
+function sameClientForEveryHop(stub) {
+    return { fetchImpl: stub, unauthenticatedFetchImpl: stub };
+}
+describe("safe redirect fetch", () => {
+    before(async () => {
+        server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            switch (url.pathname) {
+                case "/file":
+                    res.writeHead(200, { "content-type": "application/octet-stream" });
+                    res.end("payload");
+                    return;
+                case "/same-origin-redirect":
+                    res.writeHead(302, { location: "/file" });
+                    res.end();
+                    return;
+                case "/cross-origin-redirect":
+                    res.writeHead(302, { location: `${secondOrigin}/file` });
+                    res.end();
+                    return;
+                case "/loopback-redirect":
+                    res.writeHead(302, { location: "http://127.0.0.1:1/file" });
+                    res.end();
+                    return;
+                case "/metadata-redirect":
+                    res.writeHead(302, { location: "http://169.254.169.254/latest/meta-data/" });
+                    res.end();
+                    return;
+                case "/mapped-metadata-redirect":
+                    res.writeHead(302, { location: "http://[::ffff:169.254.169.254]/latest/meta-data/" });
+                    res.end();
+                    return;
+                case "/mapped-loopback-redirect":
+                    res.writeHead(302, { location: "http://[::ffff:7f00:1]:1/file" });
+                    res.end();
+                    return;
+                case "/dotted-mapped-loopback-redirect":
+                    res.writeHead(302, { location: "http://[::ffff:127.0.0.1]:1/file" });
+                    res.end();
+                    return;
+                case "/nat64-metadata-redirect":
+                    res.writeHead(302, { location: "http://[64:ff9b::a9fe:a9fe]/latest/meta-data/" });
+                    res.end();
+                    return;
+                case "/file-protocol-redirect":
+                    res.writeHead(302, { location: "file:///etc/passwd" });
+                    res.end();
+                    return;
+                case "/loop":
+                    res.writeHead(302, { location: "/loop" });
+                    res.end();
+                    return;
+                default:
+                    res.writeHead(404);
+                    res.end();
+            }
+        });
+        secondServer = http.createServer((req, res) => {
+            lastSecondHeaders = req.headers;
+            res.writeHead(200).end("second");
+        });
+        serverPort = await listen(server);
+        secondPort = await listen(secondServer);
+        origin = `http://127.0.0.1:${serverPort}`;
+        secondOrigin = `http://127.0.0.1:${secondPort}`;
+    });
+    after(async () => {
+        await Promise.all([
+            new Promise(resolve => server.close(resolve)),
+            new Promise(resolve => secondServer.close(resolve)),
+            dispatcher.close(),
+        ]);
+    });
+    const rejectsWith = (promise, fragment) => assert.rejects(promise, (error) => error instanceof UnsafeRedirectError && error.message.includes(fragment));
+    test("follows a same-origin redirect", async () => {
+        const response = await fetchWithValidatedRedirects(`${origin}/same-origin-redirect`, {
+            headers: {},
+            dispatcher,
+        });
+        assert.equal(response.status, 200);
+        assert.equal(await response.text(), "payload");
+    });
+    test("refuses a redirect to a loopback address on another origin", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/loopback-redirect`, { headers: {}, dispatcher }), "non-public address");
+    });
+    test("refuses a redirect to the cloud instance metadata address", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/metadata-redirect`, { headers: {}, dispatcher }), "169.254.169.254");
+    });
+    // The URL parser canonicalizes IPv4-mapped hosts to hex (`::ffff:169.254.169.254`
+    // becomes `::ffff:a9fe:a9fe`), so the check has to classify parsed bits. These
+    // routes exercise the production path: `new URL(location, currentUrl)`.
+    for (const [route, address] of [
+        ["/mapped-metadata-redirect", "::ffff:a9fe:a9fe"],
+        ["/mapped-loopback-redirect", "::ffff:7f00:1"],
+        ["/dotted-mapped-loopback-redirect", "::ffff:7f00:1"],
+        ["/nat64-metadata-redirect", "64:ff9b::a9fe:a9fe"],
+    ]) {
+        test(`refuses a redirect to the IPv6 form ${route} (${address})`, async () => {
+            await rejectsWith(() => fetchWithValidatedRedirects(`${origin}${route}`, { headers: {}, dispatcher }), "non-public address");
+        });
+    }
+    test("refuses a redirect to a non-http protocol", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/file-protocol-redirect`, {
+            headers: {},
+            dispatcher,
+        }), "unsupported protocol");
+    });
+    test("refuses to follow more redirects than the limit allows", async () => {
+        await rejectsWith(() => fetchWithValidatedRedirects(`${origin}/loop`, {
+            headers: {},
+            dispatcher,
+            maxRedirects: 2,
+        }), "Too many redirects");
+    });
+    test("follows a non-public redirect target when the host:port is trusted", async () => {
+        trustedHostArguments.length = 0;
+        const response = await fetchWithValidatedRedirects(`${origin}/cross-origin-redirect`, {
+            headers: {},
+            dispatcher,
+            isTrustedRedirectHost: host => {
+                trustedHostArguments.push(host);
+                return host === `127.0.0.1:${secondPort}`;
+            },
+        });
+        assert.equal(response.status, 200);
+        assert.equal(await response.text(), "second");
+        // The allowlist is keyed by `URL.host`, so the predicate must receive the port
+        // with the host: matching on a bare hostname would never find `:8443` entries.
+        assert.deepEqual(trustedHostArguments, [`127.0.0.1:${secondPort}`]);
+    });
+    test("the URL parser canonicalizes IPv4-mapped literals before the check runs", () => {
+        assert.equal(new URL("http://[::ffff:169.254.169.254]/").hostname, "[::ffff:a9fe:a9fe]");
+        assert.equal(new URL("http://[::ffff:7f00:1]/").hostname, "[::ffff:7f00:1]");
+        assert.equal(new URL("http://[::ffff:127.0.0.1]:1/").hostname, "[::ffff:7f00:1]");
+        assert.equal(new URL("http://[64:ff9b::a9fe:a9fe]/").hostname, "[64:ff9b::a9fe:a9fe]");
+    });
+    test("classifies address ranges", () => {
+        for (const address of [
+            // IPv4
+            "127.0.0.1",
+            "10.1.2.3",
+            "172.16.0.1",
+            "192.168.1.1",
+            "169.254.169.254",
+            "100.64.0.1",
+            "0.0.0.0",
+            // IPv6
+            "::",
+            "::1",
+            "fd00::1",
+            "fe80::1",
+            "fea0::1",
+            "febf::1",
+            "fec0::1",
+            // IPv6 carrying a non-public IPv4 address
+            "::ffff:127.0.0.1",
+            "::ffff:a9fe:a9fe",
+            "::ffff:7f00:1",
+            "::ffff:0:127.0.0.1",
+            "::7f00:1",
+            "64:ff9b::a9fe:a9fe",
+            "64:ff9b:1::a9fe:a9fe",
+            "2002:a9fe:a9fe::",
+            // Not a literal address this helper understands — fail closed
+            "[::ffff:a9fe:a9fe]",
+            "not-an-address",
+        ]) {
+            assert.equal(isNonPublicAddress(address), true, `${address} should be non-public`);
+        }
+        for (const address of [
+            "8.8.8.8",
+            "1.1.1.1",
+            "2606:4700::1111",
+            // IPv6 carrying a public IPv4 address
+            "::ffff:8.8.8.8",
+            "::ffff:808:808",
+            "64:ff9b::808:808",
+            "2002:0808:0808::",
+        ]) {
+            assert.equal(isNonPublicAddress(address), false, `${address} should be public`);
+        }
+    });
+});
+describe("credential headers across redirect hops", () => {
+    const credentials = {
+        Accept: "application/octet-stream",
+        Authorization: "Bearer secret",
+        "Private-Token": "secret",
+    };
+    test("keeps credentials on a same-origin hop", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            fetchImpl: stubRedirectFetch("/file", calls),
+        });
+        assert.equal(response.status, 200);
+        assert.deepEqual(calls.map(call => call.url), ["http://127.0.0.1:1/start", "http://127.0.0.1:1/file"]);
+        assert.equal(calls[1].headers.Authorization, "Bearer secret");
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+    });
+    test("drops credential headers on a cross-origin hop to a public host", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls)),
+        });
+        assert.equal(response.status, 200);
+        assert.equal(calls[0].headers["Private-Token"], "secret");
+        assert.equal(calls[1].headers.Authorization, undefined);
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        // Non-credential headers still travel with the request.
+        assert.equal(calls[1].headers.Accept, "application/octet-stream");
+    });
+    test("drops additional header names passed as credentialHeaders", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: { ...credentials, "X-Gitlab-Session": "secret" },
+            credentialHeaders: ["authorization", "private-token", "x-gitlab-session"],
+            ...sameClientForEveryHop(stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls)),
+        });
+        assert.equal(calls[1].headers["X-Gitlab-Session"], undefined);
+        assert.equal(calls[1].headers.Accept, "application/octet-stream");
+    });
+    test("keeps credentials on a hop to a trusted host", async () => {
+        const calls = [];
+        const seen = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => {
+                seen.push(host);
+                return host === PUBLIC_HOST;
+            },
+            fetchImpl: stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls),
+        });
+        assert.deepEqual(seen, [PUBLIC_HOST]);
+        assert.equal(calls[1].headers.Authorization, "Bearer secret");
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+    });
+    test("still refuses an untrusted non-public target even without credentials", async () => {
+        const calls = [];
+        await assert.rejects(() => fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            fetchImpl: stubRedirectFetch("http://169.254.169.254/latest/meta-data/", calls),
+        }), (error) => error instanceof UnsafeRedirectError && error.message.includes("non-public address"));
+        assert.equal(calls.length, 1);
+    });
+    const rejectsWithCleartext = (promise) => assert.rejects(promise, (error) => error instanceof UnsafeRedirectError && error.message.includes("cleartext"));
+    test("refuses an https-to-http downgrade even for a trusted host", async () => {
+        const calls = [];
+        await rejectsWithCleartext(() => fetchWithValidatedRedirects(`https://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            // Trust must not re-enable the credentials on a cleartext hop.
+            isTrustedRedirectHost: () => true,
+            fetchImpl: stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls),
+        }));
+        assert.deepEqual(calls.map(call => call.url), [`https://${PUBLIC_HOST}/start`]);
+    });
+    test("refuses a downgrade that happens after an earlier https hop", async () => {
+        const calls = [];
+        await rejectsWithCleartext(() => fetchWithValidatedRedirects(`https://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            fetchImpl: stubRedirectChain([`https://${PUBLIC_HOST}/mid`, `http://${PUBLIC_HOST}/file`], calls),
+        }));
+        assert.deepEqual(calls.map(call => call.url), [`https://${PUBLIC_HOST}/start`, `https://${PUBLIC_HOST}/mid`]);
+    });
+    test("follows an http-to-https upgrade and keeps credentials on a trusted host", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects(`http://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === PUBLIC_HOST,
+            fetchImpl: stubRedirectFetch(`https://${PUBLIC_HOST}/file`, calls),
+        });
+        assert.equal(response.status, 200);
+        assert.equal(calls[1].headers.Authorization, "Bearer secret");
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+    });
+    test("treats a scheme change to an untrusted host as cross-origin", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects(`http://${PUBLIC_HOST}/start`, {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectFetch(`https://${PUBLIC_HOST}/file`, calls)),
+        });
+        assert.equal(calls[1].headers.Authorization, undefined);
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[1].headers.Accept, "application/octet-stream");
+    });
+    test("keeps the credentials off a hop that returns to the initial origin", async () => {
+        const calls = [];
+        const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"], calls)),
+        });
+        assert.equal(response.status, 200);
+        assert.deepEqual(calls.map(call => call.url), ["http://127.0.0.1:1/start", `http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"]);
+        // The untrusted hop keeps the token out of the request...
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        // ...and a target cannot get it back by bouncing the request to the origin, whose
+        // response the caller of this helper reads as the downloaded body.
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+    });
+    test("restores credentials on a return to the origin only after a trusted hop", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === PUBLIC_HOST,
+            fetchImpl: stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"], calls),
+        });
+        // The trusted hop already received the token, so the return hop may carry it too.
+        assert.equal(calls[1].headers["Private-Token"], "secret");
+        assert.equal(calls[2].headers["Private-Token"], "secret");
+    });
+    test("stays without credentials across untrusted hops and returns without them", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/mid`, `http://${PUBLIC_HOST}/other`, "http://127.0.0.1:1/file"], calls)),
+        });
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+        assert.equal(calls[3].headers["Private-Token"], undefined);
+    });
+    test("a trusted hop after an untrusted one stays without credentials", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === "93.184.216.35",
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://93.184.216.35/storage", "http://127.0.0.1:1/file"], calls)),
+        });
+        // The untrusted hop chose the trusted URL, so trust must not re-attach the token.
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+        assert.equal(calls[3].headers["Private-Token"], undefined);
+    });
+    test("an untrusted hop cannot re-attach credentials via a second trusted host", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("https://gitlab.a/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === "gitlab.a" || host === "gitlab.b",
+            ...sameClientForEveryHop(stubRedirectChain([`https://${PUBLIC_HOST}/evil`, "https://gitlab.b/api/v4/user"], calls)),
+        });
+        assert.equal(calls[0].headers["Private-Token"], "secret");
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+    });
+    test("an untrusted hop cannot re-attach credentials via a scheme change on the origin host", async () => {
+        const calls = [];
+        await fetchWithValidatedRedirects("http://gitlab.a/start", {
+            headers: credentials,
+            isTrustedRedirectHost: host => host === "gitlab.a",
+            ...sameClientForEveryHop(stubRedirectChain([`http://${PUBLIC_HOST}/evil`, "https://gitlab.a/api/v4/user"], calls)),
+        });
+        assert.equal(calls[1].headers["Private-Token"], undefined);
+        assert.equal(calls[2].headers.Authorization, undefined);
+        assert.equal(calls[2].headers["Private-Token"], undefined);
+    });
+    test("uses the unauthenticated client once the credentials are withheld", async () => {
+        const authenticatedCalls = [];
+        const unauthenticatedCalls = [];
+        await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+            headers: credentials,
+            // A client that can add credentials by itself (cookie jar, OAuth 401 retry) must
+            // not see a hop the helper stripped.
+            fetchImpl: stubRedirectChain([`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"], authenticatedCalls),
+            // This stub answers from its own first call on, which is the untrusted hop.
+            unauthenticatedFetchImpl: stubRedirectChain(["http://127.0.0.1:1/file"], unauthenticatedCalls),
+        });
+        assert.deepEqual(authenticatedCalls.map(call => call.url), ["http://127.0.0.1:1/start"]);
+        assert.deepEqual(unauthenticatedCalls.map(call => call.url), [`http://${PUBLIC_HOST}/mid`, "http://127.0.0.1:1/file"]);
+        assert.equal(unauthenticatedCalls[0].headers["Private-Token"], undefined);
+        // ...including the hop back to the origin, which the caller reads as the download.
+        assert.equal(unauthenticatedCalls[1].headers["Private-Token"], undefined);
+    });
+    test("falls back to the plain client for stripped hops when only fetchImpl is given", async () => {
+        const calls = [];
+        // `undici`'s own client is observable through the dispatcher, so this asserts the
+        // default rather than trusting it: were the stripped hop routed to `fetchImpl`, the
+        // stub would answer and the mock pool would stay untouched.
+        const mockAgent = new MockAgent();
+        mockAgent.disableNetConnect();
+        mockAgent
+            .get(`http://${PUBLIC_HOST}`)
+            .intercept({ path: "/file", method: "GET" })
+            .reply(200, "from-plain-undici");
+        try {
+            const response = await fetchWithValidatedRedirects("http://127.0.0.1:1/start", {
+                headers: credentials,
+                dispatcher: mockAgent,
+                fetchImpl: stubRedirectFetch(`http://${PUBLIC_HOST}/file`, calls),
+            });
+            assert.equal(await response.text(), "from-plain-undici");
+            assert.deepEqual(calls.map(call => call.url), ["http://127.0.0.1:1/start"]);
+        }
+        finally {
+            await mockAgent.close();
+        }
+    });
+});

package/build/test/utils/tool-args.test.js

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { describe, test } from "node:test";
-import { cleanMutuallyExclusiveIdUsernameOptions, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "../../utils/tool-args.js";
+import { appendFilterParam, appendFilterParams, cleanMutuallyExclusiveIdUsernameOptions, dropBlankArrayEntries, isBlankFilterValue, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "../../utils/tool-args.js";
 describe("When sanitizeToolArguments runs", () => {
     describe("with top-level null optionals", () => {
         test("should omit null and undefined keys for generic tools", () => {
@@ -107,6 +107,38 @@ describe("When cleanMutuallyExclusiveIdUsernameOptions runs", () => {
                 assignee_username: [],
             });
         });
+        test("should keep assignee_id when assignee_username holds only blank entries", () => {
+            // The blank entries are dropped when the query is built, so counting them as a
+            // value here would delete the id filter and leave the request unfiltered.
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                assignee_id: "7",
+                assignee_username: ["", "   "],
+            });
+            assert.deepEqual(result, {
+                assignee_id: "7",
+                assignee_username: ["", "   "],
+            });
+        });
+        test("should drop assignee_id when a username survives the blank entries", () => {
+            const result = cleanMutuallyExclusiveIdUsernameOptions({
+                assignee_id: "7",
+                assignee_username: ["", "bob"],
+            });
+            assert.deepEqual(result, {
+                assignee_username: ["", "bob"],
+            });
+        });
+        test("should keep assignee_id when assignee_username is a blank scalar", () => {
+            // Boolean(" ") is true, so a whitespace-only scalar used to delete the id and then
+            // be dropped by the blank guard, leaving the request with no filter at all.
+            for (const blank of ["", " ", "  \t "]) {
+                const result = cleanMutuallyExclusiveIdUsernameOptions({
+                    assignee_id: "7",
+                    assignee_username: blank,
+                });
+                assert.deepEqual(result, { assignee_id: "7", assignee_username: blank }, `blank scalar ${JSON.stringify(blank)} must not drop the id`);
+            }
+        });
     });
     describe("with list_merge_requests reviewer filters", () => {
         test("should drop reviewer_id when reviewer_username is also set", () => {
@@ -120,3 +152,59 @@ describe("When cleanMutuallyExclusiveIdUsernameOptions runs", () => {
         });
     });
 });
+describe("When dropBlankArrayEntries runs", () => {
+    test("should drop blank string entries and keep meaningful ones", () => {
+        assert.deepEqual(dropBlankArrayEntries(["", "  ", "bug"]), ["bug"]);
+        assert.deepEqual(dropBlankArrayEntries(["\t", "alice", ""]), ["alice"]);
+    });
+    test("should leave non-array values untouched", () => {
+        assert.equal(dropBlankArrayEntries("bug"), "bug");
+        assert.equal(dropBlankArrayEntries("  "), "  ");
+        assert.equal(dropBlankArrayEntries(undefined), undefined);
+        assert.equal(dropBlankArrayEntries(false), false);
+    });
+    test("should keep non-string array entries", () => {
+        assert.deepEqual(dropBlankArrayEntries([0, "bug", false]), [0, "bug", false]);
+    });
+});
+describe("When isBlankFilterValue runs", () => {
+    test("should treat undefined, blank strings and empty arrays as blank", () => {
+        assert.equal(isBlankFilterValue(undefined), true);
+        assert.equal(isBlankFilterValue(""), true);
+        assert.equal(isBlankFilterValue(" \t\n"), true);
+        assert.equal(isBlankFilterValue([]), true);
+    });
+    test("should keep meaningful values, including false and zero", () => {
+        assert.equal(isBlankFilterValue("bug"), false);
+        assert.equal(isBlankFilterValue(["bug"]), false);
+        assert.equal(isBlankFilterValue(0), false);
+        assert.equal(isBlankFilterValue(false), false);
+    });
+});
+describe("When appendFilterParams runs", () => {
+    test("should omit blank scalars, blank array entries and empty arrays", () => {
+        const searchParams = new URLSearchParams();
+        appendFilterParams(searchParams, {
+            search: "",
+            ref: "  ",
+            labels: ["", "bug"],
+            iids: [],
+            omitted: undefined,
+        });
+        assert.deepEqual([...searchParams.entries()], [["labels", "bug"]]);
+    });
+    test("should keep booleans, zero and non-blank values", () => {
+        const searchParams = new URLSearchParams();
+        appendFilterParams(searchParams, { with_labels_details: false, page: 0, search: "bug" });
+        assert.deepEqual([...searchParams.entries()], [
+            ["with_labels_details", "false"],
+            ["page", "0"],
+            ["search", "bug"],
+        ]);
+    });
+    test("should append a single parameter without dropping a meaningful value", () => {
+        const searchParams = new URLSearchParams();
+        appendFilterParam(searchParams, "filter[environment_scope]", "production");
+        assert.deepEqual([...searchParams.entries()], [["filter[environment_scope]", "production"]]);
+    });
+});