@zereight/mcp-gitlab 2.1.64 → 2.1.65

package/build/test/utils/url.test.js

@@ -0,0 +1,128 @@
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { encodeGitLabPath, encodeGitLabPathSegment, normalizeGitLabApiUrl, } from "../../utils/url.js";
+describe("When normalizeGitLabApiUrl runs", () => {
+    test("should default to gitlab.com", () => {
+        assert.equal(normalizeGitLabApiUrl(""), "https://gitlab.com/api/v4");
+    });
+    test("should append the API path", () => {
+        assert.equal(normalizeGitLabApiUrl("https://gitlab.example.com"), "https://gitlab.example.com/api/v4");
+    });
+});
+describe("When encodeGitLabPathSegment runs", () => {
+    describe("with ordinary values", () => {
+        test("should keep plain segments", () => {
+            assert.equal(encodeGitLabPathSegment("feature-branch"), "feature-branch");
+        });
+        test("should encode spaces and reserved characters", () => {
+            assert.equal(encodeGitLabPathSegment("a b"), "a%20b");
+            assert.equal(encodeGitLabPathSegment("a?b#c"), "a%3Fb%23c");
+        });
+        test("should keep an encoded separator inside one segment", () => {
+            // GitLab accepts percent-encoded slashes for branch names such as release/1.0
+            assert.equal(encodeGitLabPathSegment("release%2F1.0"), "release%2F1.0");
+        });
+        test("should keep values that only look like dot segments", () => {
+            assert.equal(encodeGitLabPathSegment("..."), "...");
+            assert.equal(encodeGitLabPathSegment("v1.0.0"), "v1.0.0");
+        });
+        test("should encode a project path as one segment", () => {
+            assert.equal(encodeGitLabPathSegment("group/project"), "group%2Fproject");
+        });
+    });
+    describe("with traversal payloads", () => {
+        const payloads = [
+            ".",
+            "..",
+            "../user",
+            "..%2F..%2Fuser",
+            "%2E%2E%2Fuser",
+            "..%5C..%5Cuser",
+            "/etc/passwd",
+            "a/../b",
+        ];
+        for (const payload of payloads) {
+            test(`should reject ${JSON.stringify(payload)}`, () => {
+                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/);
+            });
+        }
+    });
+    describe("with payloads that are not visible after one decode", () => {
+        // One decode is not enough to recognize these: "%252E" only becomes "." on the
+        // second pass, so a single-decode guard passes the payload through and the
+        // receiving server sees a traversal sequence.
+        const payloads = [
+            "..%252Fuser",
+            "%252E%252E%252Fuser",
+            "%252E%252E%252F%252E%252E%252Fuser",
+            "..%25252Fuser",
+            "..%252F..%252F..%252Fuser",
+        ];
+        for (const payload of payloads) {
+            test(`should reject ${JSON.stringify(payload)}`, () => {
+                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/);
+            });
+        }
+    });
+    describe("with control characters", () => {
+        const payloads = ["..%00", "%00../user", "a%0Ab", "%7F..%2Fuser"];
+        for (const payload of payloads) {
+            test(`should reject ${JSON.stringify(payload)}`, () => {
+                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/);
+            });
+        }
+    });
+    describe("with a literal percent sign", () => {
+        test("should encode a percent that starts no escape instead of rejecting it", () => {
+            // decodeURIComponent throws for these too, but a percent sign is valid in a
+            // file or branch name. Only a broken escape next to a valid one is a payload
+            // the guard cannot inspect.
+            assert.equal(encodeGitLabPathSegment("report-100%.pdf"), "report-100%25.pdf");
+            assert.equal(encodeGitLabPathSegment("100%"), "100%25");
+            assert.equal(encodeGitLabPathSegment("bad%zz/path"), "bad%25zz%2Fpath");
+            // The encoded form of such a name decodes back to the literal sign.
+            assert.equal(encodeGitLabPathSegment("save%20100%25.txt"), "save%20100%25.txt");
+        });
+    });
+    describe("with a value that cannot be decoded", () => {
+        test("should reject a malformed escape sequence next to a valid one", () => {
+            // These must not be treated as safe just because decodeURIComponent threw:
+            // the valid escape may still hide a separator or a dot segment.
+            for (const payload of ["%2E%2E%2F%ZZ", "%2E%2E%2F%..", "%2E%GG"]) {
+                assert.throws(() => encodeGitLabPathSegment(payload), /Cannot use value as a GitLab URL path segment/, payload);
+            }
+        });
+        test("should reject a value with more encoding layers than it will unwrap", () => {
+            assert.throws(() => encodeGitLabPathSegment("%25252525252F"), /Cannot use value as a GitLab URL path segment/);
+        });
+    });
+});
+describe("When encodeGitLabPath runs", () => {
+    test("should encode every slash-separated segment", () => {
+        assert.equal(encodeGitLabPath("docs/read me.txt"), "docs/read%20me.txt");
+    });
+    test("should keep an encoded separator", () => {
+        assert.equal(encodeGitLabPath("release%2F1.0"), "release%2F1.0");
+    });
+    test("should reject a traversal payload", () => {
+        for (const payload of [
+            "../../../user",
+            "1/../../../../admin/ci/variables",
+            "..%2F..%2Fuser",
+            "a/..%2F..%2Fb",
+            "a/..%252F..%252Fb",
+        ]) {
+            assert.throws(() => encodeGitLabPath(payload), /Cannot use value as a GitLab URL path segment/, payload);
+        }
+    });
+    test("should reject an absolute path instead of collapsing the leading segment", () => {
+        for (const payload of ["/etc/passwd", "/", "/project/-/raw/main/x"]) {
+            assert.throws(() => encodeGitLabPath(payload), /Cannot use value as a GitLab URL path/, payload);
+        }
+    });
+    test("should reject empty and empty-segment paths", () => {
+        for (const payload of ["", "a//b", "a/"]) {
+            assert.throws(() => encodeGitLabPath(payload), /Cannot use value as a GitLab URL path/, payload);
+        }
+    });
+});

package/build/test-note.js

@@ -3,6 +3,7 @@
  * with the fixed endpoint URL construction that uses plural resource names
  * (issues instead of issue, merge_requests instead of merge_request).
  */
+import { encodeGitLabPathSegment } from "./utils/url.js";
 // GitLab API configuration (replace with actual values when testing)
 const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
 const GITLAB_PERSONAL_ACCESS_TOKEN = process.env.GITLAB_TOKEN || "";
@@ -11,7 +12,7 @@ const ISSUE_IID = Number(process.env.ISSUE_IID || "1");
 async function testCreateIssueNote() {
     try {
         // Using plural form "issues" in the URL
-        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeURIComponent(PROJECT_ID)}/issues/${ISSUE_IID}/notes`);
+        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeGitLabPathSegment(PROJECT_ID)}/issues/${ISSUE_IID}/notes`);
         const response = await fetch(url.toString(), {
             method: "POST",
             headers: {

package/build/test-resolve-issue-note.js

@@ -3,6 +3,7 @@
  * It shows how to use the update_issue_note tool to resolve or unresolve
  * issue discussion threads.
  */
+import { encodeGitLabPathSegment } from "./utils/url.js";
 // GitLab API configuration (replace with actual values when testing)
 const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
 const GITLAB_PERSONAL_ACCESS_TOKEN = process.env.GITLAB_TOKEN || "";
@@ -15,7 +16,7 @@ const NOTE_ID = process.env.NOTE_ID || "your-note-id";
  */
 async function testResolveIssueNote() {
     try {
-        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeURIComponent(PROJECT_ID)}/issues/${ISSUE_IID}/discussions/${DISCUSSION_ID}/notes/${NOTE_ID}`);
+        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeGitLabPathSegment(PROJECT_ID)}/issues/${ISSUE_IID}/discussions/${DISCUSSION_ID}/notes/${NOTE_ID}`);
         const response = await fetch(url.toString(), {
             method: "PUT",
             headers: {
@@ -44,7 +45,7 @@ async function testResolveIssueNote() {
  */
 async function testUnresolveIssueNote() {
     try {
-        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeURIComponent(PROJECT_ID)}/issues/${ISSUE_IID}/discussions/${DISCUSSION_ID}/notes/${NOTE_ID}`);
+        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeGitLabPathSegment(PROJECT_ID)}/issues/${ISSUE_IID}/discussions/${DISCUSSION_ID}/notes/${NOTE_ID}`);
         const response = await fetch(url.toString(), {
             method: "PUT",
             headers: {
@@ -73,7 +74,7 @@ async function testUnresolveIssueNote() {
  */
 async function testUpdateIssueNoteBody() {
     try {
-        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeURIComponent(PROJECT_ID)}/issues/${ISSUE_IID}/discussions/${DISCUSSION_ID}/notes/${NOTE_ID}`);
+        const url = new URL(`${GITLAB_API_URL}/api/v4/projects/${encodeGitLabPathSegment(PROJECT_ID)}/issues/${ISSUE_IID}/discussions/${DISCUSSION_ID}/notes/${NOTE_ID}`);
         const response = await fetch(url.toString(), {
             method: "PUT",
             headers: {

package/build/tools/registry.js

@@ -1408,9 +1408,14 @@ export const readOnlyTools = new Set([
 export const destructiveTools = new Set([
     "delete_pipeline",
     "erase_pipeline_job",
+    // Teardown verbs without a `delete_` prefix tear down live pipelines/environments too.
+    "cancel_pipeline",
+    "cancel_pipeline_job",
     "delete_deployment",
     "approve_deployment",
     "delete_environment",
+    "stop_environment",
+    "stop_stale_environments",
     "delete_review_app_environments",
     "delete_pipeline_trigger",
     "delete_issue",
@@ -1444,8 +1449,10 @@ export const destructiveTools = new Set([
     "delete_pipeline_schedule_variable",
     "purge_dependency_proxy_cache",
 ]);
-// Tools that permanently delete resources — blocked in "modify" permission mode.
-// Narrower than destructiveTools: merge/protect/push are modifications, not deletions.
+// Tools blocked in "modify" permission mode: permanent deletions plus destructive
+// teardown verbs that do not start with `delete_` (see the comment inside).
+// Invariant: deleteTools is a subset of destructiveTools — every blocked tool is also
+// annotated with `destructiveHint`. Add new blocked tools to both sets.
 export const deleteTools = new Set([
     "delete_pipeline",
     "erase_pipeline_job",
@@ -1478,6 +1485,13 @@ export const deleteTools = new Set([
     "delete_work_item_emoji_reaction",
     "delete_work_item_note_emoji_reaction",
     "purge_dependency_proxy_cache",
+    // Destructive teardown operations whose names do not start with `delete_`:
+    // stopping/cancelling live pipelines and environments, and removing branch protection.
+    "cancel_pipeline",
+    "cancel_pipeline_job",
+    "stop_environment",
+    "stop_stale_environments",
+    "unprotect_branch",
 ]);
 // Define which tools are related to wiki and can be toggled by USE_GITLAB_WIKI
 export const wikiToolNames = new Set([

package/build/utils/graphql-query.js

@@ -88,14 +88,30 @@ export function graphqlQueryContainsWriteOperation(query) {
     }
     return false;
 }
-const DELETE_FIELD_PATTERN = /delete|destroy|remove|prune|purge/i;
-// Collects top-level selection field names (and aliases) of every mutation operation.
-// Content inside parentheses (arguments) is skipped so argument names like
-// removeSourceBranch do not count as delete fields. Returns null when a top-level
-// fragment spread is present, since the spread could hide a delete field.
+// Verbs that mark a mutation as destructive for GITLAB_PERMISSION_MODE=modify.
+// GitLab exposes many destructive mutations whose names do not contain "delete"
+// (environmentStop, pipelineCancel, clusterAgentTokenRevoke, jobUnschedule, ...), so
+// the ban covers teardown verbs as well as deletion verbs.
+const DESTRUCTIVE_FIELD_PATTERN = /delete|destroy|remove|prune|purge|erase|revoke|cancel|stop|terminate|unprotect|disable|deactivate|drop|unschedule/i;
+// GraphQL treats whitespace and commas as insignificant, including between an
+// alias and its colon (`stop : field` and `stop,: field` are both aliases).
+function skipInsignificantGraphQL(source, index) {
+    while (index < source.length && /[\s,]/.test(source[index])) {
+        index++;
+    }
+    return index;
+}
+// Collects top-level selection field names of every mutation operation. Aliases are
+// skipped: `stop: environmentStop(...)` must be judged by the field name, so a
+// harmless label on a harmless field (`stop : issueSetSeverity(...)`) is not mistaken
+// for a destructive mutation. Content inside parentheses (arguments) is skipped so
+// argument names like removeSourceBranch do not count as delete fields. Returns null
+// when a top-level fragment spread is present, since the spread could hide a delete
+// field. Commas between operations are insignificant in GraphQL, so they are accepted
+// as operation separators alongside `;` and `}`.
 function extractTopLevelMutationFields(normalized) {
     const fields = [];
-    const mutationRegex = /(?:^|[};]\s*)mutation\b[^({]*(?:\([^)]*\))?\s*\{/g;
+    const mutationRegex = /(?:^|[;},]\s*)mutation\b[^({]*(?:\([^)]*\))?\s*\{/g;
     let match;
     while ((match = mutationRegex.exec(normalized)) !== null) {
         let i = mutationRegex.lastIndex;
@@ -123,7 +139,11 @@ function extractTopLevelMutationFields(normalized) {
                 }
             }
             if (current) {
-                fields.push(current);
+                // Only the actual field name is tested. Skip insignificant tokens so a
+                // teardown-verb alias does not look like a destructive mutation.
+                if (normalized[skipInsignificantGraphQL(normalized, i)] !== ":") {
+                    fields.push(current);
+                }
                 current = "";
             }
             i++;
@@ -134,9 +154,11 @@ function extractTopLevelMutationFields(normalized) {
     }
     return fields;
 }
+// Kept as `...DeleteOperation` for callers, but the guard now covers every
+// destructive mutation verb, not only delete-named ones.
 export function graphqlQueryContainsDeleteOperation(query) {
     const normalized = stripGraphQLCommentsAndStrings(query).trim();
-    if (!normalized || !/(?:^|[};]\s*)mutation\b/.test(normalized)) {
+    if (!normalized || !/(?:^|[;},]\s*)mutation\b/.test(normalized)) {
         return false;
     }
     const fields = extractTopLevelMutationFields(normalized);
@@ -145,5 +167,5 @@ export function graphqlQueryContainsDeleteOperation(query) {
         // could not be located (exotic syntax): be conservative and treat as delete
         return true;
     }
-    return fields.some(field => DELETE_FIELD_PATTERN.test(field));
+    return fields.some(field => DESTRUCTIVE_FIELD_PATTERN.test(field));
 }

package/build/utils/safe-redirect-fetch.js

@@ -0,0 +1,321 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { fetch as undiciFetch } from "undici";
+/** Maximum number of redirect hops an outbound download request may follow. */
+export const DEFAULT_MAX_REDIRECTS = 5;
+/**
+ * Request headers that carry GitLab credentials. They are sent to the origin the
+ * request started on and to operator-declared GitLab hosts, but never to any
+ * other redirect target (object storage, CDNs, arbitrary public hosts).
+ */
+export const CREDENTIAL_HEADERS = [
+    "authorization",
+    "private-token",
+    "job-token",
+    "proxy-authorization",
+    "cookie",
+];
+/**
+ * Thrown when an outbound request would follow a redirect to a destination the
+ * server refuses to reach (non-public address, unsupported scheme, too many hops).
+ */
+export class UnsafeRedirectError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsafeRedirectError";
+    }
+}
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Splits a dotted-quad into its four octets, or null when it is not one. */
+function parseIpv4Octets(value) {
+    const parts = value.split(".");
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const octet = Number.parseInt(part, 10);
+        if (octet > 255)
+            return null;
+        octets.push(octet);
+    }
+    return octets;
+}
+/**
+ * Expands an IPv6 literal into its eight 16-bit groups, handling `::` compression
+ * and a trailing dotted-quad. Returns null when the literal cannot be expanded.
+ */
+function parseIpv6Groups(value) {
+    const normalized = value.toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+    if (!normalized.includes(":"))
+        return null;
+    const halves = normalized.split("::");
+    if (halves.length > 2)
+        return null;
+    const toGroups = (text) => {
+        if (!text)
+            return [];
+        const tokens = text.split(":");
+        const groups = [];
+        for (const [index, token] of tokens.entries()) {
+            if (token.includes(".")) {
+                // A dotted-quad is only valid as the trailing token of the literal.
+                if (index !== tokens.length - 1)
+                    return null;
+                const octets = parseIpv4Octets(token);
+                if (!octets)
+                    return null;
+                groups.push((octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]);
+                continue;
+            }
+            if (!/^[0-9a-f]{1,4}$/.test(token))
+                return null;
+            groups.push(Number.parseInt(token, 16));
+        }
+        return groups;
+    };
+    const head = toGroups(halves[0]);
+    const tail = halves.length === 2 ? toGroups(halves[1]) : [];
+    if (!head || !tail)
+        return null;
+    if (halves.length === 2) {
+        const zeroGroups = 8 - head.length - tail.length;
+        // `::` stands for at least one group.
+        if (zeroGroups < 1)
+            return null;
+        return [...head, ...new Array(zeroGroups).fill(0), ...tail];
+    }
+    return head.length === 8 ? head : null;
+}
+/**
+ * The IPv4 address embedded in an IPv6 transition/translation format, or null when
+ * the address does not carry one.
+ *
+ * These formats are unwrapped so the IPv4 policy below applies to them: the WHATWG
+ * URL parser canonicalizes `http://[::ffff:169.254.169.254]/` to the hex form
+ * `::ffff:a9fe:a9fe`, which a dotted-quad match alone would miss.
+ */
+function embeddedIpv4Octets(groups) {
+    const [g0, g1, g2, g3, g4, g5, g6, g7] = groups;
+    const low32 = () => [(g6 >> 8) & 0xff, g6 & 0xff, (g7 >> 8) & 0xff, g7 & 0xff];
+    const leadingZeroGroups = g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0;
+    // IPv4-mapped `::ffff:a.b.c.d` and IPv4-translated `::ffff:0:a.b.c.d`.
+    if (leadingZeroGroups && g4 === 0 && g5 === 0xffff)
+        return low32();
+    if (leadingZeroGroups && g4 === 0xffff && g5 === 0)
+        return low32();
+    // IPv4-compatible `::a.b.c.d` (deprecated; `::` and `::1` land here too).
+    if (leadingZeroGroups && g4 === 0 && g5 === 0)
+        return low32();
+    // NAT64 well-known prefix `64:ff9b::/96` and local-use prefix `64:ff9b:1::/48`.
+    if (g0 === 0x64 && g1 === 0xff9b && (g2 === 0 || g2 === 1))
+        return low32();
+    // 6to4 `2002::/16`, which tunnels to the IPv4 address held by the next two groups.
+    if (g0 === 0x2002) {
+        return [(g1 >> 8) & 0xff, g1 & 0xff, (g2 >> 8) & 0xff, g2 & 0xff];
+    }
+    return null;
+}
+/** True for the IPv4 ranges that must never be reached by following a redirect. */
+function isNonPublicIpv4Octets(octets) {
+    const [first, second] = octets;
+    return (first === 0 ||
+        first === 10 ||
+        first === 127 ||
+        (first === 100 && second >= 64 && second <= 127) ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168) ||
+        (first === 192 && second === 0) ||
+        (first === 198 && (second === 18 || second === 19)) ||
+        first >= 224);
+}
+/**
+ * Classifies by parsed bits rather than by matching prefixes of the compressed
+ * string, so `fe80::/10` covers `fea0::` and `febf::`, and every address format
+ * carrying an embedded IPv4 address is judged by that address.
+ */
+function isNonPublicIpv6Groups(groups) {
+    const embedded = embeddedIpv4Octets(groups);
+    if (embedded)
+        return isNonPublicIpv4Octets(embedded);
+    const [first] = groups;
+    return ((first & 0xffc0) === 0xfe80 || // fe80::/10 link-local
+        (first & 0xffc0) === 0xfec0 || // fec0::/10 site-local (deprecated)
+        (first & 0xfe00) === 0xfc00 || // fc00::/7 unique local
+        (first & 0xff00) === 0xff00 || // ff00::/8 multicast
+        (first & 0xff00) === 0x0000 // 0000::/8 reserved
+    );
+}
+/**
+ * True for addresses that must never be reached by following a redirect:
+ * unspecified, loopback, private, link-local (including cloud instance metadata),
+ * CGNAT, benchmarking, multicast and IPv6 unique-local ranges.
+ */
+export function isNonPublicAddress(address) {
+    const version = isIP(address);
+    if (version === 4) {
+        const octets = parseIpv4Octets(address);
+        return octets ? isNonPublicIpv4Octets(octets) : true;
+    }
+    if (version === 6) {
+        const groups = parseIpv6Groups(address);
+        // Unparseable addresses fail closed.
+        return groups ? isNonPublicIpv6Groups(groups) : true;
+    }
+    // Not a literal address we understand — treat as unsafe.
+    return true;
+}
+/**
+ * Whether a hop's destination is an operator-declared GitLab host. Such a host is
+ * reachable even when it resolves to a private address and keeps receiving the
+ * request credentials unless an earlier untrusted hop withheld them.
+ */
+function isTrustedRedirectTarget(target, options) {
+    return options.isTrustedRedirectHost?.(target.host) === true;
+}
+/**
+ * The request headers stripped of every credential header. Used for redirect hops
+ * that leave the origin that issued the credentials, so a GitLab 302 to object
+ * storage (or any other host) cannot leak a token.
+ */
+function withoutCredentialHeaders(options) {
+    const credentialHeaders = new Set((options.credentialHeaders ?? CREDENTIAL_HEADERS).map(name => name.toLowerCase()));
+    return Object.fromEntries(Object.entries(options.headers).filter(([name]) => !credentialHeaders.has(name.toLowerCase())));
+}
+/**
+ * Refuses a hop whose address the server must never reach: anything that resolves
+ * to a non-public address, and any name that does not resolve at all. Trusted hosts
+ * are exempt, because an operator-declared GitLab instance may live on a private
+ * network.
+ *
+ * Runs on every redirect hop, so an upstream cannot steer the request to loopback,
+ * link-local instance metadata, or a private-range host.
+ */
+async function assertRedirectTargetAllowed(target, trusted, options) {
+    if (trusted) {
+        return;
+    }
+    const host = target.hostname.replace(/^\[/, "").replace(/\]$/, "");
+    if (isIP(host)) {
+        if (isNonPublicAddress(host)) {
+            throw new UnsafeRedirectError(`Refusing to follow redirect to non-public address: ${host}`);
+        }
+        return;
+    }
+    let records;
+    try {
+        records = await lookup(host, { all: true, verbatim: true });
+    }
+    catch {
+        throw new UnsafeRedirectError(`Refusing to follow redirect to unresolvable host: ${host}`);
+    }
+    if (records.length === 0) {
+        throw new UnsafeRedirectError(`Refusing to follow redirect to unresolvable host: ${host}`);
+    }
+    const blocked = records.find(record => isNonPublicAddress(record.address));
+    if (blocked) {
+        throw new UnsafeRedirectError(`Refusing to follow redirect to non-public address ${blocked.address} for host ${host}. ` +
+            "Add the host to GITLAB_ALLOWED_HOSTS if the redirect target is trusted.");
+    }
+}
+/**
+ * Perform a GET request that validates every redirect hop before following it.
+ *
+ * The HTTP client default follows redirects without re-validating the destination,
+ * which lets an upstream response redirect the server to an arbitrary host
+ * (including loopback and link-local addresses). This helper fetches with
+ * `redirect: "manual"` and re-applies the destination check on each `Location`
+ * value, to every address form the URL parser can produce (compressed IPv6,
+ * IPv4-mapped, NAT64, ...).
+ *
+ * Credential headers are withheld from any hop that leaves the initial origin
+ * unless the destination is a trusted host, so redirects to object storage or any
+ * other host cannot exfiltrate the GitLab token. Once withheld they stay off every
+ * later hop, including a hop to a trusted host or back to the initial origin: the
+ * caller reads that response as the downloaded file, so an authenticated request there
+ * would be one the redirect target chose. A hop that would downgrade HTTPS to cleartext HTTP
+ * is refused before the credentials are considered at all.
+ *
+ * Residual risk: the destination host is resolved twice — once for the check and
+ * again when the connection is opened — so a DNS name with a short TTL can answer
+ * with a public address first and a non-public address on connect. Closing that
+ * window needs the connection to use the address that was validated, which is not
+ * reachable from here: rewriting the request origin to an IP literal drops the TLS
+ * `servername` (`undici` derives it from the request host) and would also bypass the
+ * proxy routing that `GitLabClientPool` applies per origin, so downloads through a
+ * proxy would break or lose hostname verification. The durable fix is a validating
+ * `connect.lookup` on the pool's own `Agent`s, which keeps the hostname as the
+ * origin; that covers every outbound request rather than this helper alone. The
+ * outbound request stays otherwise unrestricted towards public addresses, which
+ * GitLab object storage requires.
+ */
+export async function fetchWithValidatedRedirects(url, options) {
+    const authenticatedFetch = options.fetchImpl ?? undiciFetch;
+    // Not `authenticatedFetch`: a caller that passes a client able to add credentials —
+    // and forgets this option — must not hand it a hop with the credentials stripped.
+    const unauthenticatedFetch = options.unauthenticatedFetchImpl ?? undiciFetch;
+    const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+    const initialOrigin = new URL(url).origin;
+    let currentUrl = url;
+    let currentProtocol = new URL(url).protocol;
+    let currentHeaders = options.headers;
+    // Set once a hop outside the origin has been followed without the credentials, so a
+    // later hop back to the origin cannot re-attach them.
+    let credentialsWithheld = false;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+        // A stripped hop must not go through a client that can add credentials again.
+        const hopFetch = credentialsWithheld ? unauthenticatedFetch : authenticatedFetch;
+        const response = await hopFetch(currentUrl, {
+            method: "GET",
+            headers: currentHeaders,
+            dispatcher: options.dispatcher,
+            signal: options.signal,
+            redirect: "manual",
+        });
+        if (!REDIRECT_STATUSES.has(response.status)) {
+            return response;
+        }
+        const location = response.headers.get("location");
+        if (!location) {
+            return response;
+        }
+        // Release the redirect response so the connection can be reused.
+        try {
+            await response.body?.cancel();
+        }
+        catch {
+            // A body that is already closed needs no cleanup.
+        }
+        const target = new URL(location, currentUrl);
+        if (target.protocol !== "http:" && target.protocol !== "https:") {
+            throw new UnsafeRedirectError(`Refusing to follow redirect to unsupported protocol: ${target.protocol}`);
+        }
+        // A downgrade would put the request — including any credential a trusted host
+        // keeps — on the wire in cleartext, so it is refused before the destination is
+        // evaluated and before any trust decision can re-enable the credentials.
+        if (currentProtocol === "https:" && target.protocol === "http:") {
+            throw new UnsafeRedirectError(`Refusing to follow redirect from ${currentUrl} to cleartext ${target.toString()}`);
+        }
+        // A hop that stays on the originating origin needs no destination check. It keeps
+        // the credentials only when they were not withheld on the way here: a target that
+        // sends the request back to the origin would otherwise receive an authenticated
+        // response — for a URL it chose — that the caller of this helper then reads as the
+        // downloaded body. A hop that returns after only *trusted* hops keeps them.
+        if (target.origin === initialOrigin) {
+            currentHeaders = credentialsWithheld ? withoutCredentialHeaders(options) : options.headers;
+        }
+        else {
+            const trusted = isTrustedRedirectTarget(target, options);
+            await assertRedirectTargetAllowed(target, trusted, options);
+            // Trust exempts the destination check but cannot undo a withhold: the untrusted
+            // hop chose this URL, and the caller reads its response as the download.
+            credentialsWithheld ||= !trusted;
+            currentHeaders = credentialsWithheld ? withoutCredentialHeaders(options) : options.headers;
+        }
+        currentUrl = target.toString();
+        currentProtocol = target.protocol;
+    }
+    throw new UnsafeRedirectError(`Too many redirects (limit ${maxRedirects})`);
+}

package/build/utils/tool-args.js

@@ -64,11 +64,20 @@ export const LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS = [
     ...LIST_ISSUES_ID_USERNAME_PAIRS,
     ["reviewer_id", "reviewer_username"],
 ];
+/**
+ * Whether a username filter actually selects anything.
+ *
+ * Judged with the same helpers the list query serializers use, so the two agree: a blank
+ * value is not a value. Treating `[""]` or `"  "` as one here would drop the id filter and
+ * then have the blank guard drop the username too, leaving no filter at all.
+ */
 function hasUsernameFilterValue(value) {
-    if (Array.isArray(value)) {
-        return value.length > 0;
+    // null never reaches here from tools (sanitizeToolArguments strips it);
+    // keep the old Boolean(null) === false behavior.
+    if (value === null) {
+        return false;
     }
-    return Boolean(value);
+    return !isBlankFilterValue(dropBlankArrayEntries(value));
 }
 /**
  * When both id and username filters are set, GitLab returns 400. Prefer username and drop id.