cf-memory-mcp 3.9.5 → 3.9.6

package/bin/cf-memory-mcp.js

@@ -1808,11 +1808,27 @@ class CFMemoryMCP {
             // files because path.resolve treats absolute file_paths as-is and
             // doesn't enforce ancestry. This is a security finding from codex
             // review; fix before reading anything off disk.
-            const normalizedRoot = path.resolve(projectRoot);
-            const resolvedFull = path.resolve(normalizedRoot, filePath);
-            // Path must be strictly under the project root. `relative` returns
-            // an empty string for the root itself and a `..`-prefixed string
-            // for anything outside.
+            //
+            // Also dereference symlinks via fs.realpathSync — without this,
+            // an attacker could create a symlink inside the project root
+            // pointing at /etc/passwd and the relative-path check would
+            // still pass (the symlink itself is in-root). realpath gives
+            // the underlying target which we then check the same way.
+            const normalizedRoot = (() => {
+                try { return fs.realpathSync(path.resolve(projectRoot)); }
+                catch (_) { return path.resolve(projectRoot); }
+            })();
+            const candidateFull = path.resolve(normalizedRoot, filePath);
+            let resolvedFull;
+            try {
+                resolvedFull = fs.realpathSync(candidateFull);
+            } catch (_) {
+                return false; // doesn't exist or unreadable
+            }
+            // Path must be strictly under the (real) project root. `relative`
+            // returns an empty string for the root itself and a `..`-prefixed
+            // string for anything outside. Use the realpath of both sides so
+            // symlinks can't smuggle the target out of the root.
             const relative = path.relative(normalizedRoot, resolvedFull);
             if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
                 _mcpTrace('GFC_LOCAL_REJECT_ESCAPE', `${filePath} -> ${resolvedFull} escapes root ${normalizedRoot}`);
@@ -1856,7 +1872,11 @@ class CFMemoryMCP {
             const language = extToLang[ext] || null;
 
             const payload = {
-                file_path: path.relative(projectRoot, resolvedFull) || path.basename(resolvedFull),
+                // Use normalizedRoot (the realpath'd root) to match resolvedFull
+                // (also realpath'd). Using the original projectRoot here gave
+                // weird relative paths on macOS where /tmp is a symlink to
+                // /private/tmp.
+                file_path: path.relative(normalizedRoot, resolvedFull) || path.basename(resolvedFull),
                 language,
                 total_lines: totalLines,
                 size_bytes: stat.size,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cf-memory-mcp",
-	"version": "3.9.5",
+	"version": "3.9.6",
 	"description": "Cloudflare-hosted MCP server for code indexing, retrieval, and assistant memory with a direct remote MCP endpoint and local stdio bridge.",
 	"main": "bin/cf-memory-mcp.js",
 	"bin": {