actual-mcp-server 0.19.1 → 0.19.2

package/README.md

@@ -778,7 +778,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.19.1 | **Tool Count:** 77 (verified LibreChat-compatible)
+**Version:** 0.19.2 | **Tool Count:** 77 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/lib/actual-adapter/query.js

@@ -8,6 +8,50 @@ import { getFieldType } from '../actual-schema.js';
 function _stripWhereQuotes(s) {
     return s.trim().replace(/^['"]|['"]$/g, '');
 }
+// #421: split an IN-list body on commas that are OUTSIDE quoted literals, so a legitimate value
+// containing a comma (e.g. 'Smith, John') stays ONE element. A naive split(',') both broke such
+// values and, with the element check below, turned them into a confusing rejection.
+function _splitInList(valuesStr) {
+    const out = [];
+    let cur = '';
+    let quote = null;
+    for (const ch of valuesStr) {
+        if (quote) {
+            cur += ch;
+            if (ch === quote)
+                quote = null;
+        }
+        else if (ch === "'" || ch === '"') {
+            quote = ch;
+            cur += ch;
+        }
+        else if (ch === ',') {
+            out.push(cur);
+            cur = '';
+        }
+        else {
+            cur += ch;
+        }
+    }
+    out.push(cur);
+    return out;
+}
+// #421: whether an IN-list element is safe to feed into upstream's `$oneof`, which stringifies each
+// element as `'${id}'` with NO escaping. Two conditions, and both matter:
+//   1. It must be WELL FORMED: a number, or a single-/double-quoted string with no embedded quote of
+//      the same kind, so a crafted element like `'b') UNION SELECT 1 --'` (unbalanced) is rejected.
+//   2. The value that ACTUALLY REACHES `$oneof` must contain no single quote. `_stripWhereQuotes`
+//      removes the outer pair of EITHER quote kind and upstream always re-wraps in SINGLE quotes, so
+//      a double-quoted element hiding a single quote (`"x' UNION SELECT 1 --"`) is well formed by (1)
+//      yet its inner `'` would terminate upstream's wrapper. Checking the stripped value closes that.
+// A legitimate `'groceries'`, `'Smith, John'`, `"cash"`, `100` or `-5.5` passes both.
+function _isSafeInListElement(raw) {
+    const t = raw.trim();
+    const wellFormed = /^'[^']*'$/.test(t) || /^"[^"]*"$/.test(t) || /^-?\d+(?:\.\d+)?$/.test(t);
+    if (!wellFormed)
+        return false;
+    return !_stripWhereQuotes(t).includes("'");
+}
 // Coerce a SQL value literal to a number when it looks numeric, else keep the
 // (unquoted) string. Used for IN lists and comparison operands. Empty stays a
 // string so an empty literal is not silently turned into 0.
@@ -100,7 +144,7 @@ export function parseWhereClause(query, whereClause, tableName) {
         const inMatch = trimmedCondition.match(/^([\w.]+)\s+IN\s+\((.+)\)$/i);
         if (inMatch) {
             const [, field, valuesStr] = inMatch;
-            const rawValues = valuesStr.split(',');
+            const rawValues = _splitInList(valuesStr);
             if (_isBooleanField(tableName, field)) {
                 // #420: `$oneof` STRINGIFIES every element (upstream `compiler.ts` emits
                 // `'${String(id)}'`), so `is_parent IN (true, false)` would compile to
@@ -112,6 +156,15 @@ export function parseWhereClause(query, whereClause, tableName) {
                 query = query.filter({ $or: orConditions });
             }
             else {
+                // #421: every element must be safe before it reaches upstream's unescaped `$oneof`. Reject a
+                // value that could terminate its own quote (single- OR double-quote wrapped) and smuggle
+                // trailing SQL.
+                for (const raw of rawValues) {
+                    if (!_isSafeInListElement(raw)) {
+                        throw new Error(`Invalid value in IN list for column "${field}": ${JSON.stringify(raw.trim())}. ` +
+                            `Each value must be a number or a quoted string with no embedded quote.`);
+                    }
+                }
                 query = query.filter({ [field]: { $oneof: rawValues.map(_coerceWhereValue) } });
             }
             continue;

package/dist/src/lib/query-validator.js

@@ -67,17 +67,29 @@ function extractWhereFields(sql) {
     if (!whereMatch)
         return fields;
     const whereClause = whereMatch[1];
-    // Find field references (table.field or field)
-    const fieldMatches = whereClause.matchAll(/(\w+)\.(\w+)|(?:^|\s)(\w+)\s*[=<>!]/g);
+    // Find field references (table.field or field).
+    // #421: a bare column must be extracted (and therefore schema-validated) not only before a
+    // comparison operator, but also before IN / LIKE / IS / BETWEEN (with their NOT forms). Before
+    // this, `bogus_col IN ('a')`, `bogus_col LIKE '%a%'` and `bogus_col IS NULL` extracted no field
+    // and so skipped the allowlist check entirely, while `bogus_col = 'a'` was correctly rejected.
+    const fieldMatches = whereClause.matchAll(/(\w+)\.(\w+)|(?:^|\s)(\w+)\s*[=<>!]|(?:^|\s)(\w+)\s+(?:NOT\s+)?(?:IN|LIKE|BETWEEN)\b|(?:^|\s)(\w+)\s+IS\b/gi);
     for (const match of fieldMatches) {
         if (match[1] && match[2]) {
             // table.field
             fields.push({ table: match[1], field: match[2] });
         }
         else if (match[3]) {
-            // simple field
+            // simple field before a comparison operator
             fields.push({ field: match[3] });
         }
+        else if (match[4]) {
+            // simple field before IN / LIKE / BETWEEN (optionally negated)
+            fields.push({ field: match[4] });
+        }
+        else if (match[5]) {
+            // simple field before IS (NULL / NOT NULL)
+            fields.push({ field: match[5] });
+        }
     }
     return fields;
 }
@@ -243,6 +255,21 @@ export function validateQueryShape(query) {
     if (/;\s*\S/.test(stripped)) {
         throw new Error('actual_query_run does not allow stacked statements (multiple statements separated by ";").');
     }
+    // #421: SQL comments. Checked on the literal-blanked `stripped`, so a `--` or `/*` INSIDE a
+    // string literal is already gone and cannot false-trigger. A comment left in the query is a
+    // trailing-SQL smuggling vector (it comments out the tombstone filter this server relies on),
+    // and a read tool has no legitimate use for one, so it is rejected outright.
+    if (/--/.test(stripped) || /\/\*/.test(stripped)) {
+        throw new Error('actual_query_run does not allow SQL comments ("--" or "/* */").');
+    }
+    // #421: compound-query set operators. parseWhereClause translates a SINGLE WHERE clause, so a
+    // UNION/EXCEPT/INTERSECT can never be handled correctly, and left unrejected it lets a crafted
+    // IN-list value append a second SELECT past the validated clause. Rejected on the blanked string
+    // so the word inside a literal (e.g. notes = 'union dues') stays allowed.
+    const COMPOUND = /\b(UNION|EXCEPT|INTERSECT)\b/i;
+    if (COMPOUND.test(stripped)) {
+        throw new Error('actual_query_run does not allow compound queries (UNION, EXCEPT, INTERSECT).');
+    }
     // Data- and schema-modification keywords.
     const FORBIDDEN = /\b(INSERT|UPDATE|DELETE|DROP|ALTER|ATTACH|DETACH|PRAGMA|CREATE|REPLACE|EXEC|EXECUTE|VACUUM|TRUNCATE|GRANT|REVOKE|MERGE|INTO)\b/i;
     if (FORBIDDEN.test(stripped)) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"