coding-friend-cli 1.26.0 → 1.26.1

package/lib/learn-mcp/package.json

@@ -9,7 +9,9 @@
     "build": "tsc",
     "dev": "tsx src/index.ts",
     "dev:watch": "tsc --watch --preserveWatchOutput",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.0",
@@ -19,6 +21,7 @@
   "devDependencies": {
     "@types/node": "^22.0.0",
     "tsx": "^4.0.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "vitest": "^4.0.0"
   }
 }

package/lib/learn-mcp/src/__tests__/docs.test.ts

@@ -0,0 +1,117 @@
+import fs from "node:fs";
+import matter from "gray-matter";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { createDoc, readDoc, updateDoc } from "../lib/docs.js";
+
+/**
+ * Place a valid .md file outside docsDir so traversal attempts
+ * actually find a file — this proves the guard blocks the read,
+ * not just "file not found".
+ */
+function placeTrapFile(dir: string, name: string): string {
+  fs.mkdirSync(dir, { recursive: true });
+  const filePath = path.join(dir, name);
+  const content = matter.stringify("SECRET CONTENT", {
+    title: "Trap",
+    category: "trap",
+    tags: [],
+    created: "2026-01-01",
+    updated: "2026-01-01",
+  });
+  fs.writeFileSync(filePath, content, "utf-8");
+  return filePath;
+}
+
+describe("docs path traversal protection", () => {
+  let tmpDir: string;
+  let docsDir: string;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "learn-mcp-test-"));
+    docsDir = path.join(tmpDir, "docs");
+    fs.mkdirSync(docsDir, { recursive: true });
+
+    // Create a legitimate doc for testing
+    createDoc(docsDir, "javascript", "test-doc", ["test"], "Hello world");
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  describe("readDoc", () => {
+    it("reads legitimate docs normally", () => {
+      const doc = readDoc(docsDir, "javascript", "test-doc");
+      expect(doc).not.toBeNull();
+      expect(doc!.content).toContain("Hello world");
+    });
+
+    it("rejects path traversal in category", () => {
+      // Place a trap file at tmpDir/secret.md (one level above docsDir)
+      placeTrapFile(tmpDir, "secret.md");
+      const doc = readDoc(docsDir, "..", "secret");
+      expect(doc).toBeNull();
+    });
+
+    it("rejects path traversal in slug", () => {
+      placeTrapFile(tmpDir, "secret.md");
+      const doc = readDoc(docsDir, "javascript", "../../secret");
+      expect(doc).toBeNull();
+    });
+
+    it("rejects path traversal with nested sequences", () => {
+      placeTrapFile(tmpDir, "secret.md");
+      const doc = readDoc(docsDir, "javascript/../../..", "secret");
+      expect(doc).toBeNull();
+    });
+  });
+
+  describe("createDoc", () => {
+    it("creates legitimate docs normally", () => {
+      const filePath = createDoc(
+        docsDir,
+        "python",
+        "New Doc",
+        ["tag1"],
+        "Content",
+      );
+      expect(filePath).toContain(docsDir);
+      expect(fs.existsSync(filePath)).toBe(true);
+    });
+
+    it("rejects path traversal in category", () => {
+      expect(() =>
+        createDoc(docsDir, "../escape", "title", [], "content"),
+      ).toThrow();
+      // Verify no file was created outside docsDir
+      expect(fs.existsSync(path.join(tmpDir, "escape"))).toBe(false);
+    });
+  });
+
+  describe("updateDoc", () => {
+    it("updates legitimate docs normally", () => {
+      const result = updateDoc(docsDir, "javascript", "test-doc", {
+        title: "Updated",
+      });
+      expect(result).not.toBeNull();
+    });
+
+    it("rejects path traversal in category", () => {
+      placeTrapFile(tmpDir, "secret.md");
+      const result = updateDoc(docsDir, "..", "secret", {
+        title: "hack",
+      });
+      expect(result).toBeNull();
+    });
+
+    it("rejects path traversal in slug", () => {
+      placeTrapFile(tmpDir, "secret.md");
+      const result = updateDoc(docsDir, "javascript", "../../secret", {
+        title: "hack",
+      });
+      expect(result).toBeNull();
+    });
+  });
+});

package/lib/learn-mcp/src/lib/docs.ts

@@ -3,6 +3,17 @@ import path from "node:path";
 import matter from "gray-matter";
 import type { CategoryInfo, Doc, DocFrontmatter, DocMeta } from "./types.js";
 
+function safePath(docsDir: string, ...segments: string[]): string | null {
+  const resolved = path.resolve(docsDir, ...segments);
+  if (
+    !resolved.startsWith(path.resolve(docsDir) + path.sep) &&
+    resolved !== path.resolve(docsDir)
+  ) {
+    return null;
+  }
+  return resolved;
+}
+
 function isMarkdownDoc(filePath: string): boolean {
   const name = path.basename(filePath);
   return name.endsWith(".md") && name !== "README.md";
@@ -92,8 +103,8 @@ export function readDoc(
   category: string,
   slug: string,
 ): Doc | null {
-  const filePath = path.join(docsDir, category, `${slug}.md`);
-  if (!fs.existsSync(filePath)) return null;
+  const filePath = safePath(docsDir, category, `${slug}.md`);
+  if (!filePath || !fs.existsSync(filePath)) return null;
 
   const raw = matter(fs.readFileSync(filePath, "utf-8"));
   const frontmatter = parseFrontmatter(raw);
@@ -147,13 +158,19 @@ export function createDoc(
   tags: string[],
   content: string,
 ): string {
-  const catDir = path.join(docsDir, category);
+  const catDir = safePath(docsDir, category);
+  if (!catDir) {
+    throw new Error(`Invalid category path: ${category}`);
+  }
   if (!fs.existsSync(catDir)) {
     fs.mkdirSync(catDir, { recursive: true });
   }
 
   const slug = slugify(title);
-  const filePath = path.join(catDir, `${slug}.md`);
+  const filePath = safePath(docsDir, category, `${slug}.md`);
+  if (!filePath) {
+    throw new Error(`Invalid doc path: ${category}/${slug}`);
+  }
   const today = new Date().toISOString().split("T")[0];
 
   const doc = matter.stringify(content, {
@@ -174,8 +191,8 @@ export function updateDoc(
   slug: string,
   updates: { content?: string; tags?: string[]; title?: string },
 ): string | null {
-  const filePath = path.join(docsDir, category, `${slug}.md`);
-  if (!fs.existsSync(filePath)) return null;
+  const filePath = safePath(docsDir, category, `${slug}.md`);
+  if (!filePath || !fs.existsSync(filePath)) return null;
 
   const raw = matter(fs.readFileSync(filePath, "utf-8"));
   const today = new Date().toISOString().split("T")[0];

package/lib/learn-mcp/src/tools/create-doc.ts

@@ -15,15 +15,27 @@ export function registerCreateDoc(server: McpServer, docsDir: string): void {
       content: z.string().describe("Markdown content (without frontmatter)"),
     },
     async ({ category, title, tags, content }) => {
-      const filePath = createDoc(docsDir, category, title, tags, content);
-      return {
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify({ path: filePath, created: true }, null, 2),
-          },
-        ],
-      };
+      try {
+        const filePath = createDoc(docsDir, category, title, tags, content);
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ path: filePath, created: true }, null, 2),
+            },
+          ],
+        };
+      } catch (err) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: err instanceof Error ? err.message : String(err),
+            },
+          ],
+          isError: true,
+        };
+      }
     },
   );
 }

package/lib/learn-mcp/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    exclude: ["dist/**", "node_modules/**"],
+  },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-friend-cli",
-  "version": "1.26.0",
+  "version": "1.26.1",
   "description": "CLI for coding-friend — host learning docs, setup MCP server, initialize projects",
   "type": "module",
   "bin": {