cf-memory-mcp 3.9.6 → 3.9.8

package/README.md

@@ -137,6 +137,12 @@ That deploys the active worker and applies the simplified D1 schema and required
 - [bin/cf-memory-mcp.js](/Users/johnlam/cf-memory-mcp/bin/cf-memory-mcp.js)
 - [bin/cf-memory-mcp-indexer.js](/Users/johnlam/cf-memory-mcp/bin/cf-memory-mcp-indexer.js)
 
+## Security
+
+The bridge (`bin/cf-memory-mcp.js`) reads local files for several tools — `get_file_content`, `refresh_files`, `find_stale_files`, `refresh_stale`, and the staleness annotation pass on `retrieve_context` results. Every one of those code paths confines file access to the resolved project root via `fs.realpathSync` + relative-path check, so absolute paths, `..` traversal, and in-root symlinks pointing outside are all rejected before any read. Locked in by the test suite under `tests/bridge.test.ts`.
+
+If you find a path that escapes the project root despite this, please open an issue with a reproduction.
+
 ## Notes
 
 - The simplified worker is the active product path.

package/bin/cf-memory-mcp.js

@@ -867,11 +867,29 @@ class CFMemoryMCP {
 
         // Read each file locally. Note: uploadFileBatch expects `relativePath`
         // (not `path`) — it maps to `file_path` server-side.
+        //
+        // Confine each file to project_root with the same realpath-aware
+        // check used in maybeServeLocalFileContent. Without this, an
+        // attacker could pass file_paths: ["/etc/hosts"] and pollute the
+        // indexed corpus with arbitrary local files. Same vulnerability
+        // class as the get_file_content fix (codex review).
+        const normalizedRoot = (() => {
+            try { return fs.realpathSync(projectRoot); }
+            catch (_) { return projectRoot; }
+        })();
         const files = [];
         const skipped = [];
         for (const rel of filePaths) {
             try {
-                const full = path.resolve(projectRoot, rel);
+                const candidate = path.resolve(normalizedRoot, rel);
+                let full;
+                try { full = fs.realpathSync(candidate); }
+                catch (_) { skipped.push({ path: rel, reason: 'not readable' }); continue; }
+                const relInside = path.relative(normalizedRoot, full);
+                if (!relInside || relInside.startsWith('..') || path.isAbsolute(relInside)) {
+                    skipped.push({ path: rel, reason: 'path escapes project_root' });
+                    continue;
+                }
                 const stat = fs.statSync(full);
                 if (!stat.isFile()) {
                     skipped.push({ path: rel, reason: 'not a file' });
@@ -964,6 +982,15 @@ class CFMemoryMCP {
         // Each file in the list already carries file_hash + indexed_at
         // (list_files was extended to return them), so we don't need any
         // additional server roundtrips. Just hash the local files.
+        //
+        // Defense in depth: indexed file_paths SHOULD be relative-to-root,
+        // but if a previous-version bridge indexed an absolute path, this
+        // loop would have read /etc/hosts to compare hashes. Confine to the
+        // project root via realpath check just like get_file_content.
+        const normalizedRoot = (() => {
+            try { return fs.realpathSync(projectRoot); }
+            catch (_) { return projectRoot; }
+        })();
         const stale = [];
         const missing = [];
         const fresh = [];
@@ -973,7 +1000,18 @@ class CFMemoryMCP {
             const indexedAt = f.indexed_at;
             if (!indexedHash) continue;
 
-            const full = path.resolve(projectRoot, filePath);
+            const candidate = path.resolve(normalizedRoot, filePath);
+            let full;
+            try { full = fs.realpathSync(candidate); }
+            catch (_) {
+                missing.push({ file_path: filePath, indexed_at: indexedAt, reason: 'file missing locally' });
+                continue;
+            }
+            const relInside = path.relative(normalizedRoot, full);
+            if (!relInside || relInside.startsWith('..') || path.isAbsolute(relInside)) {
+                missing.push({ file_path: filePath, indexed_at: indexedAt, reason: 'indexed path escapes project_root (skipped for safety)' });
+                continue;
+            }
             let content;
             try {
                 content = fs.readFileSync(full, 'utf8');
@@ -1049,13 +1087,27 @@ class CFMemoryMCP {
             return respond({ error: 'Failed to list indexed files' });
         }
 
+        // Same defense as handleFindStaleFiles: confine indexed file_paths
+        // to the project root via realpath check.
+        const normalizedRoot = (() => {
+            try { return fs.realpathSync(projectRoot); }
+            catch (_) { return projectRoot; }
+        })();
         const staleFiles = [];
         const missing = [];
         for (const f of filesList) {
             const filePath = f.file_path;
             const indexedHash = f.file_hash;
             if (!indexedHash) continue;
-            const full = path.resolve(projectRoot, filePath);
+            const candidate = path.resolve(normalizedRoot, filePath);
+            let full;
+            try { full = fs.realpathSync(candidate); }
+            catch (_) { missing.push(filePath); continue; }
+            const relInside = path.relative(normalizedRoot, full);
+            if (!relInside || relInside.startsWith('..') || path.isAbsolute(relInside)) {
+                missing.push(filePath); // indexed path escapes root
+                continue;
+            }
             let content;
             try {
                 content = fs.readFileSync(full, 'utf8');
@@ -1116,7 +1168,24 @@ class CFMemoryMCP {
     }
 
     async handleIndexProject(message) {
-        const { project_path, project_name, include_patterns, exclude_patterns, force_reindex } = message.params.arguments;
+        const args = message.params?.arguments || {};
+        const { project_path, project_name, include_patterns, exclude_patterns, force_reindex } = args;
+
+        // Boundary validation: bad inputs were producing unhelpful Node errors
+        // ("path must be string"). Return a clean MCP error with the hint
+        // instead so the model can self-correct.
+        if (typeof project_path !== 'string' || !project_path.trim()) {
+            process.stdout.write(JSON.stringify({
+                jsonrpc: '2.0',
+                id: message.id,
+                result: { content: [{ type: 'text', text: JSON.stringify({
+                    error: 'project_path is required',
+                    hint: 'Pass project_path as an absolute or relative filesystem path to the project root (e.g., "/Users/me/code/myrepo" or ".").',
+                }, null, 2) }] },
+            }) + '\n');
+            return;
+        }
+
         const resolvedPath = path.resolve(project_path);
         const name = project_name || path.basename(resolvedPath);
 
@@ -1912,11 +1981,25 @@ class CFMemoryMCP {
 
             // Try to find a local project root. We watch CF_MEMORY_WATCH_PATH
             // (when auto-watch is on) or fall back to the cwd.
-            const root = process.env.CF_MEMORY_WATCH_PATH || process.cwd();
+            const rawRoot = process.env.CF_MEMORY_WATCH_PATH || process.cwd();
+            // Realpath + relative-path check — same defense as
+            // maybeServeLocalFileContent. Server-supplied file_paths SHOULD be
+            // relative-to-root, but if an old or buggy index stored an
+            // absolute or escaping path, we'd otherwise read it (and reveal
+            // its hash via the stale flag).
+            const root = (() => {
+                try { return fs.realpathSync(rawRoot); }
+                catch (_) { return rawRoot; }
+            })();
             const stalePaths = new Set();
             for (const r of results) {
                 if (!r || !r.file_path || !r.indexed_file_hash) continue;
-                const full = path.resolve(root, r.file_path);
+                const candidate = path.resolve(root, r.file_path);
+                let full;
+                try { full = fs.realpathSync(candidate); }
+                catch (_) { continue; }
+                const relInside = path.relative(root, full);
+                if (!relInside || relInside.startsWith('..') || path.isAbsolute(relInside)) continue;
                 let content;
                 try { content = fs.readFileSync(full, 'utf8'); } catch (_) { continue; }
                 // SHA-256 hex of UTF-8 content. Matches the server's hashContent().

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cf-memory-mcp",
-	"version": "3.9.6",
+	"version": "3.9.8",
 	"description": "Cloudflare-hosted MCP server for code indexing, retrieval, and assistant memory with a direct remote MCP endpoint and local stdio bridge.",
 	"main": "bin/cf-memory-mcp.js",
 	"bin": {