sbuilder-mcp 0.82.0 → 0.82.1

package/CHANGELOG.md

@@ -6,6 +6,13 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.1] - 2026-10-10
+
+### Fixed
+- `sb_api_call` with `file` now refuses to read or write anything but catalogue spreadsheets (`.xlsx`, `.xls`, `.csv` for upload; `.xlsx`, `.csv`, `.pdf` for download), checked on the real file after symlinks resolve and only inside the working directory or a temp directory, and never a dotfile or dot-directory.
+- `sb_media_upload` with `path` accepts only media files judged on the real file rather than the `name` argument, with `.pdf` allowed only from the same two directories, so a secret file renamed to `x.png` no longer reaches the public CDN.
+- `sb_media_upload` with `url` fetches only public http(s) addresses when the platform cannot download them itself, refusing loopback, private-network, link-local and cloud-metadata hosts, and no longer takes the file type from `name`.
+
 ## [0.82.0] - 2026-10-10
 
 ### Added

package/CHANGELOG.vi.md

@@ -6,6 +6,13 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.1] - 2026-10-10
+
+### Fixed
+- `sb_api_call` với `file` từ chối đọc hoặc ghi mọi thứ ngoài bảng tính catalogue (`.xlsx`, `.xls`, `.csv` khi upload; `.xlsx`, `.csv`, `.pdf` khi tải về), kiểm tra trên file thật sau khi giải symlink, chỉ trong thư mục làm việc hoặc thư mục tạm, và không bao giờ nhận file hay thư mục bắt đầu bằng dấu chấm.
+- `sb_media_upload` với `path` chỉ nhận file media, xét trên file thật chứ không theo tham số `name`, và chỉ cho `.pdf` từ hai thư mục trên, nên file bí mật đổi tên thành `x.png` không còn lên được CDN công khai.
+- `sb_media_upload` với `url` chỉ tải các địa chỉ http(s) công khai khi platform không tự tải được, từ chối loopback, mạng riêng, link-local và metadata cloud, và không còn lấy kiểu file từ `name`.
+
 ## [0.82.0] - 2026-10-10
 
 ### Added

package/dist/tools/api.js

@@ -4,6 +4,7 @@ import { REQUEST_SHAPES } from '../catalog/shapes.generated.js';
 import { searchOperations, describeOperation, summarizeOperation, findOperation, } from '../catalog/search.js';
 import { readFile, stat, writeFile } from 'node:fs/promises';
 import { basename } from 'node:path';
+import { guardLocal } from '../transport/localfile.js';
 import { request, redact, ApiError } from '../transport/http.js';
 import { typeForName } from '../transport/media.js';
 import { restoreBodyFrom } from './undo.js';
@@ -36,6 +37,13 @@ const quoteVersion = (v) => {
 const SHIPPING_MOVED_FIX = ' — this site\'s shipping lives in the rules engine now: edit it with PATCH ' +
     '/api/sites/{siteId}/shipping-config (sb_api_call reads If-Match for you), then verify with ' +
     'POST /api/sites/{siteId}/shipping-config/preview.';
+/**
+ * `file` exists for one job — a catalogue spreadsheet in, a template out — and is
+ * no wider than that: see `guardLocal` for why a path argument is hostile input.
+ */
+const UPLOAD_EXT = new Set(['.xlsx', '.xls', '.csv']);
+// No .json (config files that run code) and no .xls (macros) on the way OUT.
+const DOWNLOAD_EXT = new Set(['.xlsx', '.csv', '.pdf']);
 const isPlain = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 /** `over` wins; objects merge key by key; arrays and scalars replace. */
 export function deepMerge(base, over) {
@@ -617,6 +625,10 @@ export async function callOperation(ctx, args) {
     // with `file` saves the answer's bytes (an xlsx template) rather than
     // pasting binary into the result.
     const download = !!args.file && (op.method === 'GET' || op.method === 'HEAD');
+    if (args.file) {
+        const path = await guardLocal(args.file.path, download ? DOWNLOAD_EXT : UPLOAD_EXT, { write: download, confine: true });
+        args.file = { ...args.file, path };
+    }
     if (download && !dryRun && (await stat(args.file.path).then(() => true, () => false))) {
         throw new Error(`sbuilder: ${args.file.path} already exists — nothing was overwritten; name a new path.`);
     }

package/dist/transport/localfile.js

@@ -0,0 +1,51 @@
+import { realpath } from 'node:fs/promises';
+import { basename, dirname, extname, join, relative, resolve, sep } from 'node:path';
+import { homedir, tmpdir } from 'node:os';
+/**
+ * EVERY DOOR FROM A TOOL ARGUMENT TO THE LOCAL DISK GOES THROUGH HERE.
+ *
+ * The agent driving these tools can be prompt-injected by content it reads — a
+ * page, a product, an order note — so a `path` argument is attacker-chosen. Read,
+ * it exfiltrates (`~/.ssh/id_rsa` uploaded under `name:"x.png"` gets a public CDN
+ * URL); written, it plants code (`.claude/settings.local.json`, `.mcp.json`,
+ * `.vscode/tasks.json` all run something, and `wx` stops only an overwrite).
+ *
+ * So: the extension is checked on the REAL file (symlinks resolved, never the
+ * caller's `name`), and the returned path is the resolved one, so what was
+ * checked is what is opened. `confine` additionally keeps the file under the
+ * working directory or the OS temp directory — not the working directory when it
+ * IS the home directory — with no dot-file or dot-folder below that root.
+ *
+ * ponytail: a local attacker racing a symlink swap between this check and the
+ * open is outside the threat model; O_NOFOLLOW on the open is the upgrade.
+ */
+export async function guardLocal(path, exts, opts = {}) {
+    const abs = resolve(path);
+    const shown = [...exts].join(', ');
+    let real;
+    try {
+        // A write names a file that does not exist yet: resolve its folder instead.
+        real = opts.write ? join(await realpath(dirname(abs)), basename(abs)) : await realpath(abs);
+    }
+    catch {
+        throw new Error(`sbuilder: ${opts.write ? `the folder for ${abs}` : abs} does not exist.`);
+    }
+    if (!exts.has(extname(real).toLowerCase())) {
+        throw new Error(`sbuilder: the file must be one of ${shown} — ${basename(real)} is not.`);
+    }
+    if (opts.confine) {
+        const home = await realpath(homedir()).catch(() => homedir());
+        const cwd = await realpath(process.cwd()).catch(() => process.cwd());
+        // Not cwd when it IS home, or holds it (`/Users`): that root would reach all of home.
+        const holdsHome = cwd === home || home.startsWith(cwd.endsWith(sep) ? cwd : cwd + sep);
+        const roots = [...(holdsHome ? [] : [cwd]), await realpath(tmpdir()).catch(() => tmpdir())];
+        const root = roots.find((r) => real.startsWith(r + sep));
+        if (!root) {
+            throw new Error(`sbuilder: this file must be under the working directory or ${tmpdir()} — not ${real}.`);
+        }
+        if (relative(root, real).split(sep).some((s) => s.startsWith('.'))) {
+            throw new Error('sbuilder: never a dot-file or a file in a dot-folder.');
+        }
+    }
+    return real;
+}

package/dist/transport/media.js

@@ -1,6 +1,7 @@
 import { identityHeaders } from './identity.js';
 import { readFile } from 'node:fs/promises';
-import { basename } from 'node:path';
+import { guardLocal } from './localfile.js';
+import { basename, extname } from 'node:path';
 import { ApiError } from './http.js';
 import { siteToken } from '../tools/credentialpick.js';
 /**
@@ -57,6 +58,8 @@ const TYPE_BY_EXT = {
     '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
     '.csv': 'text/csv',
 };
+/** What a local `path` may be: the media types this server names, nothing else. */
+const MEDIA_EXT = new Set(Object.keys(TYPE_BY_EXT).filter((e) => !['.xlsx', '.xls', '.csv'].includes(e)).concat('.pdf'));
 export function typeForName(name) {
     const dot = name.lastIndexOf('.');
     return dot < 0 ? '' : (TYPE_BY_EXT[name.slice(dot).toLowerCase()] ?? '');
@@ -145,10 +148,26 @@ export async function uploadMedia(ctx, siteId, source) {
     let filename;
     let declared = '';
     if (source.path) {
-        bytes = await readFile(source.path);
-        filename = source.name ?? basename(source.path);
+        // The type comes from the REAL file's name, never from `name` — otherwise
+        // {path:"~/.ssh/id_rsa", name:"x.png"} uploads a key as an image to a public
+        // URL. `name` still becomes the library's display name (the form field below).
+        // A PDF is where the sensitive documents live (a tax return, a passport scan),
+        // so it comes only from the working or temp directory; images from anywhere.
+        const real = await guardLocal(source.path, MEDIA_EXT, { confine: extname(source.path).toLowerCase() === '.pdf' });
+        bytes = await readFile(real);
+        filename = basename(real);
     }
     else if (source.url) {
+        // THIS fetch runs on the USER's machine (the server's own door was missing), so a
+        // private address here reaches their network — cloud metadata, a dev server —
+        // and re-uploads it to a public URL. Public http(s) only.
+        // ponytail: hostname check, not resolved-IP; DNS rebinding needs a resolve-and-check.
+        const u = new URL(source.url);
+        if (!/^https?:$/.test(u.protocol) ||
+            /^(localhost|127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.|0\.0\.0\.0|\[?::1\]?$|\[?f[cd][0-9a-f]{2}:|\[?fe80:)/i.test(u.hostname) ||
+            u.hostname.endsWith('.local') || u.hostname.endsWith('.internal')) {
+            throw new Error('sbuilder: a media url must be a public http(s) address.');
+        }
         const res = await doFetch(source.url);
         if (!res.ok) {
             throw new ApiError(res.status, 'source_unreachable', `could not fetch ${source.url}`);
@@ -158,7 +177,9 @@ export async function uploadMedia(ctx, siteId, source) {
         declared = (res.headers.get('content-type') ?? '').split(';')[0].trim();
         // A URL's last segment is usually the filename; when it is not (a query-only
         // CDN link), name it rather than uploading something called "".
-        filename = source.name ?? (new URL(source.url).pathname.split('/').pop() || 'image');
+        // The type comes from the response or the URL's own name, never from `name`
+        // (still sent as the display name below).
+        filename = u.pathname.split('/').pop() || 'image';
     }
     else {
         throw new Error('sbuilder: give sb_media_upload either a local path or a url');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.82.0",
+  "version": "0.82.1",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",