@zereight/mcp-gitlab 2.1.68 → 2.1.69

package/build/tools/denied-regex.js

@@ -0,0 +1,38 @@
+const MAX_PATTERN_LENGTH = 200;
+const NESTED_QUANTIFIER_PATTERN = /(\(.*[+*?].*\)|\[.*\])[+*?]/;
+// Only allow safe characters in tool regex patterns to prevent regex injection (CodeQL)
+const SAFE_PATTERN_CHARS = /^[a-zA-Z0-9_|^$().*+?{}[\]\\:,\s-]+$/;
+export function compileDeniedToolsRegex(pattern) {
+    if (!pattern) {
+        return { regex: undefined, error: undefined };
+    }
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+        return {
+            regex: undefined,
+            error: `GITLAB_DENIED_TOOLS_REGEX pattern exceeds ${MAX_PATTERN_LENGTH} chars. Ignoring.`,
+        };
+    }
+    if (!SAFE_PATTERN_CHARS.test(pattern)) {
+        return {
+            regex: undefined,
+            error: "GITLAB_DENIED_TOOLS_REGEX contains invalid characters. Ignoring.",
+        };
+    }
+    if (NESTED_QUANTIFIER_PATTERN.test(pattern)) {
+        return {
+            regex: undefined,
+            error: "GITLAB_DENIED_TOOLS_REGEX contains potentially unsafe nested quantifiers. Ignoring.",
+        };
+    }
+    try {
+        const regex = new RegExp(pattern);
+        regex.test("sample_tool_name");
+        return { regex, error: undefined };
+    }
+    catch {
+        return {
+            regex: undefined,
+            error: `Invalid GITLAB_DENIED_TOOLS_REGEX pattern: "${pattern}". Ignoring.`,
+        };
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.1.68",
+  "version": "2.1.69",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [