monomind 1.11.14 → 1.13.0

package/packages/@monomind/cli/dist/src/mcp-tools/monograph-compat.js

@@ -5,13 +5,22 @@
  * exported by the published @monoes/monograph@1.2.0. Everything else has been
  * moved to the real package.
  */
-import { join } from 'path';
-import { existsSync, readFileSync } from 'fs';
+import { join, resolve, relative } from 'path';
+import { existsSync, readFileSync, statSync } from 'fs';
 import { openDb, closeDb, countNodes } from '@monoes/monograph';
+const MAX_GROUP_CONFIG_BYTES = 1 * 1024 * 1024; // 1 MB
 function readGroupConfig(configPath) {
     if (!existsSync(configPath))
         return [];
     try {
+        // Guard: only allow paths within cwd to prevent traversal to /etc/passwd etc.
+        const resolved = resolve(configPath);
+        const rel = relative(process.cwd(), resolved);
+        if (rel.startsWith('..') || resolve(rel) === resolve('/'))
+            return [];
+        // OOM guard: skip files larger than 1 MB
+        if (statSync(configPath).size > MAX_GROUP_CONFIG_BYTES)
+            return [];
         const raw = readFileSync(configPath, 'utf-8');
         return JSON.parse(raw);
     }