appium-mcp 1.86.2 → 1.86.4

package/src/tools/ios/prepare-ios-simulator.ts

@@ -8,10 +8,8 @@ import { z } from 'zod';
 import { exec } from 'node:child_process';
 import { promisify } from 'node:util';
 import path from 'node:path';
-import { access, mkdir, unlink, readdir, stat, rm } from 'node:fs/promises';
-import { constants } from 'node:fs';
 import os from 'node:os';
-import { net, plist, zip } from '@appium/support';
+import { fs, net, plist, zip } from '@appium/support';
 import { Simctl } from 'node-simctl';
 import { IOSManager } from '../../devicemanager/ios-manager.js';
 import log from '../../logger.js';
@@ -44,19 +42,14 @@ interface WDAState {
 }
 
 async function fileExists(filePath: string): Promise<boolean> {
-  try {
-    await access(filePath, constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
+  return await fs.hasAccess(filePath);
 }
 
 // ── WDA download helpers ──
 
 async function cleanupFile(filePath: string): Promise<void> {
   try {
-    await unlink(filePath);
+    await fs.unlink(filePath);
   } catch (err: any) {
     if (err.code !== 'ENOENT') {
       throw err;
@@ -105,11 +98,11 @@ async function getLatestWDAVersionFromCache(): Promise<string | null> {
     return null;
   }
 
-  const entries = await readdir(wdaCacheDir);
+  const entries = await fs.readdir(wdaCacheDir);
   const versions = await Promise.all(
     entries.map(async (dir) => {
       const dirPath = path.join(wdaCacheDir, dir);
-      const stats = await stat(dirPath);
+      const stats = await fs.stat(dirPath);
       return stats.isDirectory() ? dir : null;
     })
   );
@@ -263,11 +256,11 @@ async function resolveWdaAppPath(
 
   // Clean any prior (possibly partial) extraction before downloading
   if (await fileExists(extractDir)) {
-    await rm(extractDir, { recursive: true, force: true });
+    await fs.rimraf(extractDir);
   }
 
-  await mkdir(versionCacheDir, { recursive: true });
-  await mkdir(extractDir, { recursive: true });
+  await fs.mkdirp(versionCacheDir);
+  await fs.mkdirp(extractDir);
 
   const downloadUrl = `https://github.com/appium/WebDriverAgent/releases/download/v${wdaVersion}/${artifactPrefix}-Build-Sim-${archStr}.zip`;
   log.info(`Downloading prebuilt WDA v${wdaVersion}...`);

package/src/tools/session/create-session.ts

@@ -1,5 +1,4 @@
-import { access, readFile } from 'node:fs/promises';
-import { constants } from 'node:fs';
+import { fs } from '@appium/support';
 import { URL } from 'node:url';
 import { getPortFromUrl } from '../../utils/url.js';
 import { AndroidUiautomator2Driver } from 'appium-uiautomator2-driver';
@@ -452,8 +451,12 @@ async function loadCapabilitiesConfig(): Promise<CapabilitiesConfig> {
   }
 
   try {
-    await access(configPath, constants.F_OK);
-    const configContent = await readFile(configPath, 'utf8');
+    if (!(await fs.hasAccess(configPath))) {
+      throw new Error(
+        `Capabilities config does not exist or is not accessible: ${configPath}`
+      );
+    }
+    const configContent = await fs.readFile(configPath, 'utf8');
     return JSON.parse(configContent);
   } catch (error: unknown) {
     log.warn(`Failed to parse capabilities config: ${toolErrorMessage(error)}`);

package/src/ui/mcp-ui-utils.ts

@@ -59,23 +59,29 @@ export function createDevicePickerUI(
       : 'Android Devices';
 
   const deviceCards = devices
-    .map(
-      (device, index) => `
-    <div class="device-card" data-udid="${device.udid}" data-index="${index}">
+    .map((device, index) => {
+      const udid = String(device.udid);
+      const name = device.name || udid;
+      const state = device.state ? String(device.state) : undefined;
+      const type = device.type ? String(device.type) : undefined;
+      const stateClass = state ? sanitizeClassName(state) : '';
+
+      return `
+    <div class="device-card" data-udid="${escapeHtml(udid)}" data-index="${index}">
       <div class="device-header">
-        <h3>${device.name || device.udid}</h3>
-        ${device.state ? `<span class="device-state ${device.state.toLowerCase()}">${device.state}</span>` : ''}
+        <h3>${escapeHtml(name)}</h3>
+        ${state ? `<span class="device-state ${stateClass}">${escapeHtml(state)}</span>` : ''}
       </div>
       <div class="device-details">
-        <p><strong>UDID:</strong> <code>${device.udid}</code></p>
-        ${device.type ? `<p><strong>Type:</strong> ${device.type}</p>` : ''}
+        <p><strong>UDID:</strong> <code>${escapeHtml(udid)}</code></p>
+        ${type ? `<p><strong>Type:</strong> ${escapeHtml(type)}</p>` : ''}
       </div>
-      <button class="select-device-btn" onclick="selectDevice('${device.udid}')">
+      <button class="select-device-btn" data-udid="${escapeHtml(udid)}" onclick="selectDevice(this.dataset.udid)">
         Select Device
       </button>
     </div>
-  `
-    )
+  `;
+    })
     .join('');
 
   return `
@@ -215,8 +221,8 @@ export function createDevicePickerUI(
         payload: {
           intent: 'select-device',
           params: {
-            platform: '${platform}',
-            ${deviceType ? `iosDeviceType: '${deviceType}',` : ''}
+            platform: ${escapeScriptValue(platform)},
+            ${deviceType ? `iosDeviceType: ${escapeScriptValue(deviceType)},` : ''}
             deviceUdid: udid
           }
         }
@@ -247,6 +253,8 @@ export function createScreenshotViewerUI(
   screenshotBase64: string,
   filepath: string
 ): string {
+  const downloadFilename = filepath.split('/').pop() || 'screenshot.png';
+
   return `
 <!DOCTYPE html>
 <html lang="en">
@@ -370,7 +378,7 @@ export function createScreenshotViewerUI(
     <div class="toolbar">
       <div class="toolbar-left">
         <span style="font-size: 14px; font-weight: 500;">📸 Screenshot</span>
-        <span class="filepath">${filepath}</span>
+        <span class="filepath">${escapeHtml(filepath)}</span>
       </div>
       <div class="toolbar-right">
         <button class="btn btn-secondary" onclick="downloadScreenshot()">Download</button>
@@ -378,7 +386,7 @@ export function createScreenshotViewerUI(
       </div>
     </div>
     <div class="image-container" id="imageContainer">
-      <img src="data:image/png;base64,${screenshotBase64}"
+      <img src="data:image/png;base64,${escapeHtml(screenshotBase64)}"
            alt="Screenshot"
            class="screenshot-img"
            id="screenshotImg"
@@ -420,7 +428,7 @@ export function createScreenshotViewerUI(
     function downloadScreenshot() {
       const link = document.createElement('a');
       link.href = img.src;
-      link.download = '${filepath.split('/').pop() || 'screenshot.png'}';
+      link.download = ${escapeScriptValue(downloadFilename)};
       link.click();
     }
 
@@ -470,6 +478,9 @@ export function createSessionDashboardUI(sessionInfo: {
     sessionIdStr.length > 8
       ? `${sessionIdStr.substring(0, 8)}...`
       : sessionIdStr;
+  const deviceName = sessionInfo.deviceName;
+  const platformVersion = sessionInfo.platformVersion;
+  const udid = sessionInfo.udid;
 
   return `
 <!DOCTYPE html>
@@ -590,42 +601,42 @@ export function createSessionDashboardUI(sessionInfo: {
       <div class="info-grid">
         <div class="info-card">
           <label>Session ID</label>
-          <value>${sessionIdDisplay}</value>
+          <value>${escapeHtml(sessionIdDisplay)}</value>
         </div>
         <div class="info-card">
           <label>Platform</label>
-          <value>${sessionInfo.platform}</value>
+          <value>${escapeHtml(sessionInfo.platform)}</value>
         </div>
         <div class="info-card">
           <label>Automation</label>
-          <value>${sessionInfo.automationName}</value>
+          <value>${escapeHtml(sessionInfo.automationName)}</value>
         </div>
         ${
-          sessionInfo.deviceName
+          deviceName
             ? `
         <div class="info-card">
           <label>Device</label>
-          <value>${sessionInfo.deviceName}</value>
+          <value>${escapeHtml(deviceName)}</value>
         </div>
         `
             : ''
         }
         ${
-          sessionInfo.platformVersion
+          platformVersion
             ? `
         <div class="info-card">
           <label>Platform Version</label>
-          <value>${sessionInfo.platformVersion}</value>
+          <value>${escapeHtml(platformVersion)}</value>
         </div>
         `
             : ''
         }
         ${
-          sessionInfo.udid
+          udid
             ? `
         <div class="info-card">
           <label>UDID</label>
-          <value><code style="font-size: 12px;">${sessionInfo.udid}</code></value>
+          <value><code style="font-size: 12px;">${escapeHtml(udid)}</code></value>
         </div>
         `
             : ''
@@ -1260,17 +1271,17 @@ export function createAppListUI(
   const appCards = apps
     .map(
       (app) => `
-    <div class="app-card" data-package="${app.packageName}">
+    <div class="app-card" data-package="${escapeHtml(app.packageName)}">
       <div class="app-header">
-        <h3>${app.appName || app.packageName}</h3>
+        <h3>${escapeHtml(app.appName || app.packageName)}</h3>
       </div>
       <div class="app-details">
-        <p><strong>Package:</strong> <code>${app.packageName}</code></p>
+        <p><strong>Package:</strong> <code>${escapeHtml(app.packageName)}</code></p>
       </div>
       <div class="app-actions">
-        <button class="btn btn-primary" onclick="activateApp('${app.packageName}')">Activate</button>
-        <button class="btn btn-secondary" onclick="terminateApp('${app.packageName}')">Terminate</button>
-        <button class="btn btn-danger" onclick="uninstallApp('${app.packageName}')">Uninstall</button>
+        <button class="btn btn-primary" data-package="${escapeHtml(app.packageName)}" onclick="activateApp(this.dataset.package)">Activate</button>
+        <button class="btn btn-secondary" data-package="${escapeHtml(app.packageName)}" onclick="terminateApp(this.dataset.package)">Terminate</button>
+        <button class="btn btn-danger" data-package="${escapeHtml(app.packageName)}" onclick="uninstallApp(this.dataset.package)">Uninstall</button>
       </div>
     </div>
   `
@@ -1652,3 +1663,21 @@ function escapeHtml(value: unknown): string {
     .replace(/"/g, '&quot;')
     .replace(/'/g, '&#039;');
 }
+
+function escapeScriptValue(value: unknown): string {
+  return JSON.stringify(String(value))
+    .replace(/</g, '\\u003C')
+    .replace(/>/g, '\\u003E')
+    .replace(/&/g, '\\u0026')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+}
+
+function sanitizeClassName(value: unknown): string {
+  return escapeHtml(
+    String(value)
+      .toLowerCase()
+      .replace(/[^a-z0-9_-]+/g, '-')
+      .replace(/^-+|-+$/g, '')
+  );
+}