@zereight/mcp-gitlab 2.2.0 → 2.2.2

package/build/utils/redact-sensitive.js

@@ -4,25 +4,35 @@
  * never be forwarded to the model.
  */
 const SENSITIVE_GITLAB_FIELDS = ["runners_token", "import_url", "token"];
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 /**
  * Strip known sensitive fields from a GitLab API response object before it is
  * returned as an MCP tool result. Mutates and returns the same object.
- * Recurses into arrays (e.g. list responses) since those hold one object per item.
+ * Walks arrays and nested objects so a runner's embedded project cannot leak
+ * runners_token or token.
  *
  * Used for raw passthrough responses (get_project / update_project,
- * list/get_pipeline_trigger) that do not go through a Zod schema, since Zod
- * would otherwise strip unknown keys for us. Do NOT apply to
+ * list/get_pipeline_trigger, runner tools) that do not go through a Zod schema,
+ * since Zod would otherwise strip unknown keys for us. Do NOT apply to
  * create_pipeline_trigger: its response carries the newly issued token once.
  */
 export function redactSensitiveGitLabFields(data) {
     if (Array.isArray(data)) {
-        for (const item of data)
+        for (const item of data) {
             redactSensitiveGitLabFields(item);
-    }
-    else if (data && typeof data === "object") {
-        for (const key of SENSITIVE_GITLAB_FIELDS) {
-            delete data[key];
         }
+        return data;
+    }
+    if (!isPlainRecord(data)) {
+        return data;
+    }
+    for (const key of SENSITIVE_GITLAB_FIELDS) {
+        delete data[key];
+    }
+    for (const value of Object.values(data)) {
+        redactSensitiveGitLabFields(value);
     }
     return data;
 }

package/build/utils/redact-url.js

@@ -0,0 +1,141 @@
+const SENSITIVE_QUERY_NAMES = new Set([
+    "access_token",
+    "private_token",
+    "job_token",
+    "password",
+    "token",
+]);
+/**
+ * Removes userinfo from a GitLab API URL before it is returned to the client.
+ * A password with an unencoded slash is not a valid WHATWG URL, so that form
+ * uses the same text redaction as transport error messages.
+ */
+export function redactGitLabUrlCredentials(url) {
+    try {
+        const parsed = new URL(url);
+        const hadUserinfo = parsed.username.length > 0 || parsed.password.length > 0;
+        if (hadUserinfo) {
+            parsed.username = "";
+            parsed.password = "";
+        }
+        const serialized = hadUserinfo ? parsed.toString() : url;
+        return redactSensitiveQuery(serialized);
+    }
+    catch {
+        return redactSensitiveQuery(redactUrlUserinfoInText(url));
+    }
+}
+/**
+ * Log text can contain several URLs. A parseable URL keeps `[REDACTED]@`
+ * where userinfo was. redactGitLabUrlCredentials strips that userinfo instead,
+ * because the value is returned to the client as a URL.
+ */
+export function redactUrlSecretsInText(text) {
+    return redactSensitiveQuery(redactUrlUserinfoInText(redactParseableUrlUserinfo(text)));
+}
+function redactSensitiveQuery(url) {
+    return url.replace(/([?&])([^=&\s#]+)=[^&\s#]+/g, (match, separator, rawName) => {
+        if (!isSensitiveQueryName(rawName)) {
+            return match;
+        }
+        return `${separator}${rawName}=[REDACTED]`;
+    });
+}
+function isSensitiveQueryName(rawName) {
+    return SENSITIVE_QUERY_NAMES.has(decodeQueryName(rawName).toLowerCase());
+}
+function decodeQueryName(rawName) {
+    try {
+        return decodeURIComponent(rawName);
+    }
+    catch {
+        return rawName;
+    }
+}
+function redactUrlUserinfoInText(message) {
+    const withoutCompactUserinfo = message.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s]+/gi, urlToken => redactCompactUserinfo(urlToken));
+    return withoutCompactUserinfo.replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@.]+(?::[^\s/:@.]+)+(?:\s+[^\s/:@.]+)+)@/gi, (match, scheme, userinfo, offset, source) => {
+        if (looksLikeHostPort(userinfo, source.slice(offset + match.length))) {
+            return match;
+        }
+        return `${scheme}[REDACTED]@`;
+    });
+}
+function redactParseableUrlUserinfo(text) {
+    const trimmed = text.trim();
+    const parsed = tryParseUrl(trimmed);
+    if (parsed === null || (parsed.username.length === 0 && parsed.password.length === 0)) {
+        return text;
+    }
+    const split = splitAuthorityUserinfo(trimmed);
+    if (split === null) {
+        return text;
+    }
+    const leadingLength = text.length - text.trimStart().length;
+    const trailing = text.slice(text.trimEnd().length);
+    return `${text.slice(0, leadingLength)}${split.scheme}[REDACTED]@${split.afterAt}${trailing}`;
+}
+function tryParseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+function splitAuthorityUserinfo(url) {
+    // WHATWG special schemes still expose userinfo for "https:user:pass@host".
+    const schemeMatch = /^([a-z][a-z0-9+.-]*:)(\/\/)?/i.exec(url);
+    if (schemeMatch === null) {
+        return null;
+    }
+    const schemeEnd = schemeMatch[0].length;
+    const rest = url.slice(schemeEnd);
+    const slash = rest.indexOf("/");
+    const query = rest.indexOf("?");
+    const hash = rest.indexOf("#");
+    const ends = [slash, query, hash].filter(index => index >= 0);
+    const authorityEnd = ends.length === 0 ? rest.length : Math.min(...ends);
+    const authority = rest.slice(0, authorityEnd);
+    const atIndex = authority.lastIndexOf("@");
+    if (atIndex <= 0) {
+        return null;
+    }
+    return {
+        scheme: url.slice(0, schemeEnd),
+        afterAt: `${authority.slice(atIndex + 1)}${rest.slice(authorityEnd)}`,
+    };
+}
+function redactCompactUserinfo(urlToken) {
+    const schemeIndex = urlToken.indexOf("://");
+    const rest = urlToken.slice(schemeIndex + 3);
+    const atIndex = rest.lastIndexOf("@");
+    if (atIndex <= 0) {
+        return urlToken;
+    }
+    return `${urlToken.slice(0, schemeIndex + 3)}[REDACTED]@${rest.slice(atIndex + 1)}`;
+}
+// "user:pa ss@host" is a password. "localhost:3000 a@b.com" is a host, then an email.
+// A numeric port counts only when one token follows it and the text after "@" is an email domain.
+function looksLikeHostPort(userinfo, afterAt) {
+    const colon = userinfo.indexOf(":");
+    if (colon <= 0) {
+        return false;
+    }
+    const host = userinfo.slice(0, colon);
+    const portMatch = /^([^\s]+)/.exec(userinfo.slice(colon + 1));
+    const port = portMatch?.[1] ?? "";
+    if (port.length === 0) {
+        return false;
+    }
+    if (/^\d+$/.test(port)) {
+        const remainder = userinfo.slice(colon + 1 + port.length).trim();
+        const firstTokenEnd = afterAt.search(/\s/);
+        const firstToken = firstTokenEnd === -1 ? afterAt : afterAt.slice(0, firstTokenEnd);
+        return (remainder.length > 0 &&
+            !/\s/.test(remainder) &&
+            firstToken.length > 0 &&
+            !/[/:@]/.test(firstToken));
+    }
+    return host.toLowerCase() === "localhost";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zereight/mcp-gitlab",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "mcpName": "io.github.zereight/gitlab-mcp",
   "description": "GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more",
   "keywords": [