pptx-viewer-mcp 1.1.4 → 1.1.5

package/dist/codec/index.js

@@ -195,7 +195,10 @@ var PptxCodec = class {
     for (const [prefixed, original] of Object.entries(REVERSE_COMPLEX_SLIDE_MAP)) {
       const value = slideMap.get(prefixed);
       if (value !== void 0) {
-        slide[original] = JSON.parse(value);
+        try {
+          slide[original] = JSON.parse(value);
+        } catch {
+        }
       }
     }
     const elementsArray = slideMap.get("elements");
@@ -228,7 +231,10 @@ var PptxCodec = class {
     const element = {};
     elemMap.forEach((value, key) => {
       if (REVERSE_COMPLEX_MAP[key]) {
-        element[REVERSE_COMPLEX_MAP[key]] = JSON.parse(value);
+        try {
+          element[REVERSE_COMPLEX_MAP[key]] = JSON.parse(value);
+        } catch {
+        }
       } else {
         element[key] = value;
       }

package/dist/codec/index.mjs

@@ -193,7 +193,10 @@ var PptxCodec = class {
     for (const [prefixed, original] of Object.entries(REVERSE_COMPLEX_SLIDE_MAP)) {
       const value = slideMap.get(prefixed);
       if (value !== void 0) {
-        slide[original] = JSON.parse(value);
+        try {
+          slide[original] = JSON.parse(value);
+        } catch {
+        }
       }
     }
     const elementsArray = slideMap.get("elements");
@@ -226,7 +229,10 @@ var PptxCodec = class {
     const element = {};
     elemMap.forEach((value, key) => {
       if (REVERSE_COMPLEX_MAP[key]) {
-        element[REVERSE_COMPLEX_MAP[key]] = JSON.parse(value);
+        try {
+          element[REVERSE_COMPLEX_MAP[key]] = JSON.parse(value);
+        } catch {
+        }
       } else {
         element[key] = value;
       }

package/dist/index.d.mts

@@ -468,6 +468,11 @@ interface ConvertToMarkdownParams {
     includeSpeakerNotes?: boolean;
     semanticMode?: boolean;
     sourceName?: string;
+    /**
+     * Root directory under which `outputDir` must resolve. Defaults to
+     * `process.env.PPTX_TOOLS_ROOT` if set, else `process.cwd()`.
+     */
+    rootDir?: string;
 }
 interface ConvertToMarkdownResult {
     markdown: string;

package/dist/index.d.ts

@@ -468,6 +468,11 @@ interface ConvertToMarkdownParams {
     includeSpeakerNotes?: boolean;
     semanticMode?: boolean;
     sourceName?: string;
+    /**
+     * Root directory under which `outputDir` must resolve. Defaults to
+     * `process.env.PPTX_TOOLS_ROOT` if set, else `process.cwd()`.
+     */
+    rootDir?: string;
 }
 interface ConvertToMarkdownResult {
     markdown: string;

package/dist/index.js

@@ -1,6 +1,7 @@
 'use strict';
 
 var pptxViewerCore = require('pptx-viewer-core');
+var path = require('path');
 
 // src/execution.ts
 var PPTX_MIME_TYPE = "application/vnd.openxmlformats-officedocument.presentationml.presentation";
@@ -1251,10 +1252,26 @@ function runAccessibilityCheck(ctx) {
     }
   };
 }
+var MAX_REGEX_LEN = 200;
+function hasNestedUnboundedQuantifier(pattern) {
+  return /\([^)]*[+*]\)[+*]/.test(pattern);
+}
 function buildSearchRegex(query, useRegex, caseSensitive) {
+  if (useRegex) {
+    if (query.length > MAX_REGEX_LEN) {
+      return null;
+    }
+    if (hasNestedUnboundedQuantifier(query)) {
+      return null;
+    }
+  }
   const pattern = useRegex ? query : query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const flags = caseSensitive ? "g" : "gi";
-  return new RegExp(pattern, flags);
+  try {
+    return new RegExp(pattern, flags);
+  } catch {
+    return null;
+  }
 }
 function findText(ctx, params) {
   const regex = buildSearchRegex(
@@ -1262,6 +1279,13 @@ function findText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, matchCount: 0, matches: [] }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   const matches = [];
   for (const si of targetIndexes) {
@@ -1346,6 +1370,13 @@ function replaceText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, replacement: params.replacement, replacementCount: 0 }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   let count = 0;
   for (const si of targetIndexes) {
@@ -1523,6 +1554,17 @@ function manageComments(ctx, params) {
     }
   }
 }
+function scopeOutputDir(outputDir, rootDir) {
+  const root = path.resolve(rootDir ?? process.env["PPTX_TOOLS_ROOT"] ?? process.cwd());
+  const resolved = path.isAbsolute(outputDir) ? path.resolve(outputDir) : path.resolve(root, outputDir);
+  const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+  if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+    throw new Error(
+      `convertToMarkdown: outputDir "${outputDir}" resolves outside the allowed root "${root}"`
+    );
+  }
+  return resolved;
+}
 async function convertToMarkdown(ctx, params) {
   const options = {
     mediaFolderName: params.mediaFolderName ?? "media",
@@ -1532,7 +1574,8 @@ async function convertToMarkdown(ctx, params) {
     semanticMode: params.semanticMode === true,
     sourceName: params.sourceName ?? "unknown"
   };
-  const converter = new pptxViewerCore.PptxMarkdownConverter(params.outputDir ?? ".", options);
+  const safeOutputDir = scopeOutputDir(params.outputDir ?? ".", params.rootDir);
+  const converter = new pptxViewerCore.PptxMarkdownConverter(safeOutputDir, options);
   const markdown = await converter.convert(ctx.pptxData);
   return {
     pptxData: ctx.pptxData,

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { PptxHandler, hasTextProperties, PptxMarkdownConverter } from 'pptx-viewer-core';
+import { resolve, isAbsolute, sep } from 'path';
 
 // src/execution.ts
 var PPTX_MIME_TYPE = "application/vnd.openxmlformats-officedocument.presentationml.presentation";
@@ -1249,10 +1250,26 @@ function runAccessibilityCheck(ctx) {
     }
   };
 }
+var MAX_REGEX_LEN = 200;
+function hasNestedUnboundedQuantifier(pattern) {
+  return /\([^)]*[+*]\)[+*]/.test(pattern);
+}
 function buildSearchRegex(query, useRegex, caseSensitive) {
+  if (useRegex) {
+    if (query.length > MAX_REGEX_LEN) {
+      return null;
+    }
+    if (hasNestedUnboundedQuantifier(query)) {
+      return null;
+    }
+  }
   const pattern = useRegex ? query : query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const flags = caseSensitive ? "g" : "gi";
-  return new RegExp(pattern, flags);
+  try {
+    return new RegExp(pattern, flags);
+  } catch {
+    return null;
+  }
 }
 function findText(ctx, params) {
   const regex = buildSearchRegex(
@@ -1260,6 +1277,13 @@ function findText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, matchCount: 0, matches: [] }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   const matches = [];
   for (const si of targetIndexes) {
@@ -1344,6 +1368,13 @@ function replaceText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, replacement: params.replacement, replacementCount: 0 }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   let count = 0;
   for (const si of targetIndexes) {
@@ -1521,6 +1552,17 @@ function manageComments(ctx, params) {
     }
   }
 }
+function scopeOutputDir(outputDir, rootDir) {
+  const root = resolve(rootDir ?? process.env["PPTX_TOOLS_ROOT"] ?? process.cwd());
+  const resolved = isAbsolute(outputDir) ? resolve(outputDir) : resolve(root, outputDir);
+  const rootWithSep = root.endsWith(sep) ? root : root + sep;
+  if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+    throw new Error(
+      `convertToMarkdown: outputDir "${outputDir}" resolves outside the allowed root "${root}"`
+    );
+  }
+  return resolved;
+}
 async function convertToMarkdown(ctx, params) {
   const options = {
     mediaFolderName: params.mediaFolderName ?? "media",
@@ -1530,7 +1572,8 @@ async function convertToMarkdown(ctx, params) {
     semanticMode: params.semanticMode === true,
     sourceName: params.sourceName ?? "unknown"
   };
-  const converter = new PptxMarkdownConverter(params.outputDir ?? ".", options);
+  const safeOutputDir = scopeOutputDir(params.outputDir ?? ".", params.rootDir);
+  const converter = new PptxMarkdownConverter(safeOutputDir, options);
   const markdown = await converter.convert(ctx.pptxData);
   return {
     pptxData: ctx.pptxData,

package/dist/mcp/index.js

@@ -5,6 +5,7 @@ var stdio_js = require('@modelcontextprotocol/sdk/server/stdio.js');
 var mcp_js = require('@modelcontextprotocol/sdk/server/mcp.js');
 var zod = require('zod');
 var pptxViewerCore = require('pptx-viewer-core');
+var path = require('path');
 var promises = require('fs/promises');
 
 var GetSlideSchema = zod.z.object({
@@ -369,10 +370,26 @@ function validateSlideIndex(slideIndex, slideCount) {
 }
 
 // src/tools/content-tools.ts
+var MAX_REGEX_LEN = 200;
+function hasNestedUnboundedQuantifier(pattern) {
+  return /\([^)]*[+*]\)[+*]/.test(pattern);
+}
 function buildSearchRegex(query, useRegex, caseSensitive) {
+  if (useRegex) {
+    if (query.length > MAX_REGEX_LEN) {
+      return null;
+    }
+    if (hasNestedUnboundedQuantifier(query)) {
+      return null;
+    }
+  }
   const pattern = useRegex ? query : query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const flags = caseSensitive ? "g" : "gi";
-  return new RegExp(pattern, flags);
+  try {
+    return new RegExp(pattern, flags);
+  } catch {
+    return null;
+  }
 }
 function findText(ctx, params) {
   const regex = buildSearchRegex(
@@ -380,6 +397,13 @@ function findText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, matchCount: 0, matches: [] }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   const matches = [];
   for (const si of targetIndexes) {
@@ -464,6 +488,13 @@ function replaceText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, replacement: params.replacement, replacementCount: 0 }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   let count = 0;
   for (const si of targetIndexes) {
@@ -641,6 +672,17 @@ function manageComments(ctx, params) {
     }
   }
 }
+function scopeOutputDir(outputDir, rootDir) {
+  const root = path.resolve(rootDir ?? process.env["PPTX_TOOLS_ROOT"] ?? process.cwd());
+  const resolved = path.isAbsolute(outputDir) ? path.resolve(outputDir) : path.resolve(root, outputDir);
+  const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+  if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+    throw new Error(
+      `convertToMarkdown: outputDir "${outputDir}" resolves outside the allowed root "${root}"`
+    );
+  }
+  return resolved;
+}
 async function convertToMarkdown(ctx, params) {
   const options = {
     mediaFolderName: params.mediaFolderName ?? "media",
@@ -650,7 +692,8 @@ async function convertToMarkdown(ctx, params) {
     semanticMode: params.semanticMode === true,
     sourceName: params.sourceName ?? "unknown"
   };
-  const converter = new pptxViewerCore.PptxMarkdownConverter(params.outputDir ?? ".", options);
+  const safeOutputDir = scopeOutputDir(params.outputDir ?? ".", params.rootDir);
+  const converter = new pptxViewerCore.PptxMarkdownConverter(safeOutputDir, options);
   const markdown = await converter.convert(ctx.pptxData);
   return {
     pptxData: ctx.pptxData,
@@ -1783,18 +1826,45 @@ async function executeToolWithContext(filePath, execCtx, toolFn) {
 }
 
 // src/mcp/handlers.ts
+var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".pptx", ".ppt"]);
+function resolveScopedFilePath(filePath, rootDir) {
+  if (typeof filePath !== "string" || filePath.length === 0) {
+    throw new Error("MCP tool: filePath must be a non-empty string");
+  }
+  const root = path.resolve(process.env["PPTX_TOOLS_ROOT"] ?? process.cwd());
+  const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(root, filePath);
+  const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+  if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+    throw new Error(`MCP tool: filePath "${filePath}" resolves outside the allowed root "${root}"`);
+  }
+  const lower = resolved.toLowerCase();
+  let isAllowed = false;
+  for (const ext of ALLOWED_EXTENSIONS) {
+    if (lower.endsWith(ext)) {
+      isAllowed = true;
+      break;
+    }
+  }
+  if (!isAllowed) {
+    throw new Error(
+      `MCP tool: filePath "${filePath}" must end with one of: ${Array.from(ALLOWED_EXTENSIONS).join(", ")}`
+    );
+  }
+  return resolved;
+}
 var nodeFs = {
   readFile: async (path) => new Uint8Array(await promises.readFile(path)),
   writeFile: async (path, data) => {
     await promises.writeFile(path, data);
   }
 };
-function createMcpContext() {
+function createMcpContext(_options) {
   return { filesystem: nodeFs };
 }
-async function runMcpTool(filePath, fn) {
+async function runMcpTool(filePath, fn, options) {
+  const safePath = resolveScopedFilePath(filePath);
   const ctx = createMcpContext();
-  return executeToolWithContext(filePath, ctx, fn);
+  return executeToolWithContext(safePath, ctx, fn);
 }
 
 // src/mcp/server.ts

package/dist/mcp/index.mjs

@@ -3,6 +3,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
 import { PptxHandler, hasTextProperties, PptxMarkdownConverter } from 'pptx-viewer-core';
+import { resolve, isAbsolute, sep } from 'path';
 import { writeFile, readFile } from 'fs/promises';
 
 var GetSlideSchema = z.object({
@@ -367,10 +368,26 @@ function validateSlideIndex(slideIndex, slideCount) {
 }
 
 // src/tools/content-tools.ts
+var MAX_REGEX_LEN = 200;
+function hasNestedUnboundedQuantifier(pattern) {
+  return /\([^)]*[+*]\)[+*]/.test(pattern);
+}
 function buildSearchRegex(query, useRegex, caseSensitive) {
+  if (useRegex) {
+    if (query.length > MAX_REGEX_LEN) {
+      return null;
+    }
+    if (hasNestedUnboundedQuantifier(query)) {
+      return null;
+    }
+  }
   const pattern = useRegex ? query : query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const flags = caseSensitive ? "g" : "gi";
-  return new RegExp(pattern, flags);
+  try {
+    return new RegExp(pattern, flags);
+  } catch {
+    return null;
+  }
 }
 function findText(ctx, params) {
   const regex = buildSearchRegex(
@@ -378,6 +395,13 @@ function findText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, matchCount: 0, matches: [] }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   const matches = [];
   for (const si of targetIndexes) {
@@ -462,6 +486,13 @@ function replaceText(ctx, params) {
     params.useRegex === true,
     params.caseSensitive === true
   );
+  if (!regex) {
+    return {
+      pptxData: ctx.pptxData,
+      dirty: false,
+      result: { query: params.query, replacement: params.replacement, replacementCount: 0 }
+    };
+  }
   const targetIndexes = params.slideIndexes ? params.slideIndexes : ctx.pptxData.slides.map((_, i) => i);
   let count = 0;
   for (const si of targetIndexes) {
@@ -639,6 +670,17 @@ function manageComments(ctx, params) {
     }
   }
 }
+function scopeOutputDir(outputDir, rootDir) {
+  const root = resolve(rootDir ?? process.env["PPTX_TOOLS_ROOT"] ?? process.cwd());
+  const resolved = isAbsolute(outputDir) ? resolve(outputDir) : resolve(root, outputDir);
+  const rootWithSep = root.endsWith(sep) ? root : root + sep;
+  if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+    throw new Error(
+      `convertToMarkdown: outputDir "${outputDir}" resolves outside the allowed root "${root}"`
+    );
+  }
+  return resolved;
+}
 async function convertToMarkdown(ctx, params) {
   const options = {
     mediaFolderName: params.mediaFolderName ?? "media",
@@ -648,7 +690,8 @@ async function convertToMarkdown(ctx, params) {
     semanticMode: params.semanticMode === true,
     sourceName: params.sourceName ?? "unknown"
   };
-  const converter = new PptxMarkdownConverter(params.outputDir ?? ".", options);
+  const safeOutputDir = scopeOutputDir(params.outputDir ?? ".", params.rootDir);
+  const converter = new PptxMarkdownConverter(safeOutputDir, options);
   const markdown = await converter.convert(ctx.pptxData);
   return {
     pptxData: ctx.pptxData,
@@ -1781,18 +1824,45 @@ async function executeToolWithContext(filePath, execCtx, toolFn) {
 }
 
 // src/mcp/handlers.ts
+var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".pptx", ".ppt"]);
+function resolveScopedFilePath(filePath, rootDir) {
+  if (typeof filePath !== "string" || filePath.length === 0) {
+    throw new Error("MCP tool: filePath must be a non-empty string");
+  }
+  const root = resolve(process.env["PPTX_TOOLS_ROOT"] ?? process.cwd());
+  const resolved = isAbsolute(filePath) ? resolve(filePath) : resolve(root, filePath);
+  const rootWithSep = root.endsWith(sep) ? root : root + sep;
+  if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+    throw new Error(`MCP tool: filePath "${filePath}" resolves outside the allowed root "${root}"`);
+  }
+  const lower = resolved.toLowerCase();
+  let isAllowed = false;
+  for (const ext of ALLOWED_EXTENSIONS) {
+    if (lower.endsWith(ext)) {
+      isAllowed = true;
+      break;
+    }
+  }
+  if (!isAllowed) {
+    throw new Error(
+      `MCP tool: filePath "${filePath}" must end with one of: ${Array.from(ALLOWED_EXTENSIONS).join(", ")}`
+    );
+  }
+  return resolved;
+}
 var nodeFs = {
   readFile: async (path) => new Uint8Array(await readFile(path)),
   writeFile: async (path, data) => {
     await writeFile(path, data);
   }
 };
-function createMcpContext() {
+function createMcpContext(_options) {
   return { filesystem: nodeFs };
 }
-async function runMcpTool(filePath, fn) {
+async function runMcpTool(filePath, fn, options) {
+  const safePath = resolveScopedFilePath(filePath);
   const ctx = createMcpContext();
-  return executeToolWithContext(filePath, ctx, fn);
+  return executeToolWithContext(safePath, ctx, fn);
 }
 
 // src/mcp/server.ts

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pptx-viewer-mcp",
-	"version": "1.1.4",
+	"version": "1.1.5",
 	"description": "PPTX manipulation tools, MCP server, and collaboration codec for pptx-viewer-core.",
 	"keywords": [
 		"ai",