mcp-for-i 0.1.13 → 0.3.0

package/dist/ibmi/CompileTools.js

@@ -58,7 +58,7 @@ export var CompileTools;
                     commandResult = await connection.sendQsh({
                         command: [
                             ...(options.noLibList ? [] : buildLiblistCommands(connection, ileSetup)),
-                            ...commands.map(cmd => `system \"${IBMiClient.escapeForShell(cmd)}\"`)
+                            ...commands.map(cmd => `system ${quoteForShell(cmd)}`)
                         ].join(` && `),
                         directory: cwd
                     });
@@ -75,6 +75,27 @@ export var CompileTools;
         };
     }
     CompileTools.runCommand = runCommand;
+    /**
+     * Validate a streamfile path used as an action target. The path is
+     * substituted into CL and shell commands, so quotes, shell metacharacters
+     * and control characters are refused.
+     */
+    function validateStreamfilePath(value) {
+        const target = String(value ?? "");
+        if (!target.trim())
+            throw new Error("targetPath is required for streamfile actions");
+        if (!target.startsWith("/"))
+            throw new Error("targetPath must be an absolute IFS path");
+        if (/[\u0000-\u001f\u007f]/.test(target))
+            throw new Error("targetPath must not contain control characters");
+        if (/['"`$\\;|&<>]/.test(target)) {
+            throw new Error("targetPath must not contain quotes, backticks, '$', backslash, ';', '|', '&', '<' or '>'");
+        }
+        if (target.split("/").some(segment => segment === ".."))
+            throw new Error("targetPath must not contain '..'");
+        return target;
+    }
+    CompileTools.validateStreamfilePath = validateStreamfilePath;
     function buildLibraryList(config) {
         return config.libraryList
             .slice(0)
@@ -107,3 +128,10 @@ function assertLibraryName(connection, value, context) {
     }
     return normalized;
 }
+/**
+ * Quote a value as a single POSIX shell word. Inside single quotes nothing is
+ * expanded, so `"`, backticks and `$` cannot break out of `system '...'`.
+ */
+export function quoteForShell(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}