sbuilder-mcp 0.82.0 → 0.82.2

package/CHANGELOG.md

@@ -6,6 +6,20 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.2] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` with `url` resolves the host's DNS and refuses the fetch if any address is private, loopback, link-local, cloud-metadata or otherwise special (IPv4 and IPv6, including `::ffff:127.0.0.1`, 6to4 and Teredo forms).
+- `sb_media_upload` with `url` follows redirects one step at a time, re-checking every hop against the same address rules and stopping after four.
+- `sb_media_upload` with `path` restricts `.pdf` files to the allowed directories by the real file name rather than the name given.
+
+## [0.82.1] - 2026-10-10
+
+### Fixed
+- `sb_api_call` with `file` now refuses to read or write anything but catalogue spreadsheets (`.xlsx`, `.xls`, `.csv` for upload; `.xlsx`, `.csv`, `.pdf` for download), checked on the real file after symlinks resolve and only inside the working directory or a temp directory, and never a dotfile or dot-directory.
+- `sb_media_upload` with `path` accepts only media files judged on the real file rather than the `name` argument, with `.pdf` allowed only from the same two directories, so a secret file renamed to `x.png` no longer reaches the public CDN.
+- `sb_media_upload` with `url` fetches only public http(s) addresses when the platform cannot download them itself, refusing loopback, private-network, link-local and cloud-metadata hosts, and no longer takes the file type from `name`.
+
 ## [0.82.0] - 2026-10-10
 
 ### Added

package/CHANGELOG.vi.md

@@ -6,6 +6,20 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.2] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` với `url` phân giải DNS của host và từ chối tải nếu bất kỳ địa chỉ nào thuộc mạng riêng, loopback, link-local, metadata cloud hoặc dải đặc biệt khác (IPv4 và IPv6, gồm `::ffff:127.0.0.1`, 6to4 và Teredo).
+- `sb_media_upload` với `url` đi theo redirect từng bước, kiểm tra lại mỗi bước theo cùng quy tắc địa chỉ và dừng sau bốn lần.
+- `sb_media_upload` với `path` giới hạn file `.pdf` trong các thư mục được phép theo tên file thật chứ không theo tên được truyền vào.
+
+## [0.82.1] - 2026-10-10
+
+### Fixed
+- `sb_api_call` với `file` từ chối đọc hoặc ghi mọi thứ ngoài bảng tính catalogue (`.xlsx`, `.xls`, `.csv` khi upload; `.xlsx`, `.csv`, `.pdf` khi tải về), kiểm tra trên file thật sau khi giải symlink, chỉ trong thư mục làm việc hoặc thư mục tạm, và không bao giờ nhận file hay thư mục bắt đầu bằng dấu chấm.
+- `sb_media_upload` với `path` chỉ nhận file media, xét trên file thật chứ không theo tham số `name`, và chỉ cho `.pdf` từ hai thư mục trên, nên file bí mật đổi tên thành `x.png` không còn lên được CDN công khai.
+- `sb_media_upload` với `url` chỉ tải các địa chỉ http(s) công khai khi platform không tự tải được, từ chối loopback, mạng riêng, link-local và metadata cloud, và không còn lấy kiểu file từ `name`.
+
 ## [0.82.0] - 2026-10-10
 
 ### Added

package/dist/tools/api.js

@@ -4,6 +4,7 @@ import { REQUEST_SHAPES } from '../catalog/shapes.generated.js';
 import { searchOperations, describeOperation, summarizeOperation, findOperation, } from '../catalog/search.js';
 import { readFile, stat, writeFile } from 'node:fs/promises';
 import { basename } from 'node:path';
+import { guardLocal } from '../transport/localfile.js';
 import { request, redact, ApiError } from '../transport/http.js';
 import { typeForName } from '../transport/media.js';
 import { restoreBodyFrom } from './undo.js';
@@ -36,6 +37,13 @@ const quoteVersion = (v) => {
 const SHIPPING_MOVED_FIX = ' — this site\'s shipping lives in the rules engine now: edit it with PATCH ' +
     '/api/sites/{siteId}/shipping-config (sb_api_call reads If-Match for you), then verify with ' +
     'POST /api/sites/{siteId}/shipping-config/preview.';
+/**
+ * `file` exists for one job — a catalogue spreadsheet in, a template out — and is
+ * no wider than that: see `guardLocal` for why a path argument is hostile input.
+ */
+const UPLOAD_EXT = new Set(['.xlsx', '.xls', '.csv']);
+// No .json (config files that run code) and no .xls (macros) on the way OUT.
+const DOWNLOAD_EXT = new Set(['.xlsx', '.csv', '.pdf']);
 const isPlain = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 /** `over` wins; objects merge key by key; arrays and scalars replace. */
 export function deepMerge(base, over) {
@@ -617,6 +625,10 @@ export async function callOperation(ctx, args) {
     // with `file` saves the answer's bytes (an xlsx template) rather than
     // pasting binary into the result.
     const download = !!args.file && (op.method === 'GET' || op.method === 'HEAD');
+    if (args.file) {
+        const path = await guardLocal(args.file.path, download ? DOWNLOAD_EXT : UPLOAD_EXT, { write: download, confine: true });
+        args.file = { ...args.file, path };
+    }
     if (download && !dryRun && (await stat(args.file.path).then(() => true, () => false))) {
         throw new Error(`sbuilder: ${args.file.path} already exists — nothing was overwritten; name a new path.`);
     }

package/dist/transport/localfile.js

@@ -0,0 +1,51 @@
+import { realpath } from 'node:fs/promises';
+import { basename, dirname, extname, join, relative, resolve, sep } from 'node:path';
+import { homedir, tmpdir } from 'node:os';
+/**
+ * EVERY DOOR FROM A TOOL ARGUMENT TO THE LOCAL DISK GOES THROUGH HERE.
+ *
+ * The agent driving these tools can be prompt-injected by content it reads — a
+ * page, a product, an order note — so a `path` argument is attacker-chosen. Read,
+ * it exfiltrates (`~/.ssh/id_rsa` uploaded under `name:"x.png"` gets a public CDN
+ * URL); written, it plants code (`.claude/settings.local.json`, `.mcp.json`,
+ * `.vscode/tasks.json` all run something, and `wx` stops only an overwrite).
+ *
+ * So: the extension is checked on the REAL file (symlinks resolved, never the
+ * caller's `name`), and the returned path is the resolved one, so what was
+ * checked is what is opened. `confine` additionally keeps the file under the
+ * working directory or the OS temp directory — not the working directory when it
+ * IS the home directory — with no dot-file or dot-folder below that root.
+ *
+ * ponytail: a local attacker racing a symlink swap between this check and the
+ * open is outside the threat model; O_NOFOLLOW on the open is the upgrade.
+ */
+export async function guardLocal(path, exts, opts = {}) {
+    const abs = resolve(path);
+    const shown = [...exts].join(', ');
+    let real;
+    try {
+        // A write names a file that does not exist yet: resolve its folder instead.
+        real = opts.write ? join(await realpath(dirname(abs)), basename(abs)) : await realpath(abs);
+    }
+    catch {
+        throw new Error(`sbuilder: ${opts.write ? `the folder for ${abs}` : abs} does not exist.`);
+    }
+    if (!exts.has(extname(real).toLowerCase())) {
+        throw new Error(`sbuilder: the file must be one of ${shown} — ${basename(real)} is not.`);
+    }
+    if (opts.confine) {
+        const home = await realpath(homedir()).catch(() => homedir());
+        const cwd = await realpath(process.cwd()).catch(() => process.cwd());
+        // Not cwd when it IS home, or holds it (`/Users`): that root would reach all of home.
+        const holdsHome = cwd === home || home.startsWith(cwd.endsWith(sep) ? cwd : cwd + sep);
+        const roots = [...(holdsHome ? [] : [cwd]), await realpath(tmpdir()).catch(() => tmpdir())];
+        const root = roots.find((r) => real.startsWith(r + sep));
+        if (!root) {
+            throw new Error(`sbuilder: this file must be under the working directory or ${tmpdir()} — not ${real}.`);
+        }
+        if (relative(root, real).split(sep).some((s) => s.startsWith('.'))) {
+            throw new Error('sbuilder: never a dot-file or a file in a dot-folder.');
+        }
+    }
+    return real;
+}

package/dist/transport/media.js

@@ -1,6 +1,9 @@
 import { identityHeaders } from './identity.js';
 import { readFile } from 'node:fs/promises';
-import { basename } from 'node:path';
+import { guardLocal } from './localfile.js';
+import { basename, extname } from 'node:path';
+import { lookup } from 'node:dns/promises';
+import { BlockList, isIP } from 'node:net';
 import { ApiError } from './http.js';
 import { siteToken } from '../tools/credentialpick.js';
 /**
@@ -57,6 +60,9 @@ const TYPE_BY_EXT = {
     '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
     '.csv': 'text/csv',
 };
+const PDF_EXT = new Set(['.pdf']);
+/** What a local `path` may be: the media types this server names, nothing else. */
+const MEDIA_EXT = new Set(Object.keys(TYPE_BY_EXT).filter((e) => !['.xlsx', '.xls', '.csv'].includes(e)).concat('.pdf'));
 export function typeForName(name) {
     const dot = name.lastIndexOf('.');
     return dot < 0 ? '' : (TYPE_BY_EXT[name.slice(dot).toLowerCase()] ?? '');
@@ -126,6 +132,59 @@ async function fromUrl(ctx, siteId, url, source) {
     }
     return uploaded(parsed);
 }
+/**
+ * WHEN THE PLATFORM CANNOT FETCH A URL ITSELF, THIS MACHINE DOES — and an agent can
+ * be talked into naming any URL. A private address here reaches the user's own
+ * network (cloud metadata at 169.254.169.254, a dev server on localhost) and the
+ * bytes are re-uploaded to a public CDN. So every address the host resolves to is
+ * checked — a hostname regex is beaten by `[::ffff:127.0.0.1]` or a DNS name that
+ * points inward — and a redirect is followed by hand, each hop checked again.
+ *
+ * ponytail: resolve-then-fetch leaves a DNS-rebinding window between the two
+ * lookups; pinning the checked IP into the connection (an undici dispatcher) is the
+ * upgrade.
+ */
+// No ::ffff:0:0/96 rule: Node's BlockList already applies the IPv4 rules to an
+// IPv4-mapped address, and that rule would match EVERY IPv4 address (measured).
+const PRIVATE = new BlockList();
+for (const [net, bits] of [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16],
+    ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['224.0.0.0', 3],
+])
+    PRIVATE.addSubnet(net, bits, 'ipv4');
+for (const [net, bits] of [
+    // ::/96 (IPv4-compatible), 6to4, Teredo and old site-local carry or reach an IPv4 inside.
+    ['::', 96], ['2002::', 16], ['2001::', 32], ['fec0::', 10], ['64:ff9b::', 96], ['fc00::', 7], ['fe80::', 10], ['ff00::', 8],
+])
+    PRIVATE.addSubnet(net, bits, 'ipv6');
+async function assertPublic(ctx, raw) {
+    const u = new URL(raw);
+    const host = u.hostname.replace(/^\[|\]$/g, '');
+    const refuse = () => new Error('sbuilder: a media url must be a public http(s) address.');
+    if (!/^https?:$/.test(u.protocol))
+        throw refuse();
+    const addrs = isIP(host)
+        ? [host]
+        : await (ctx.lookupHost ?? (async (h) => (await lookup(h, { all: true })).map((a) => a.address)))(host).catch(() => {
+            throw new Error(`sbuilder: could not resolve ${host}.`);
+        });
+    for (const a of addrs) {
+        if (PRIVATE.check(a, isIP(a) === 6 ? 'ipv6' : 'ipv4'))
+            throw refuse();
+    }
+}
+async function fetchPublic(ctx, doFetch, url) {
+    let at = url;
+    for (let hop = 0; hop < 4; hop++) {
+        await assertPublic(ctx, at);
+        const res = await doFetch(at, { redirect: 'manual' });
+        const next = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+        if (!next)
+            return res;
+        at = new URL(next, at).toString();
+    }
+    throw new Error('sbuilder: too many redirects fetching the media url.');
+}
 export async function uploadMedia(ctx, siteId, source) {
     const doFetch = ctx.fetchImpl ?? fetch;
     // THE SERVER'S OWN DOOR FIRST, when the source is a URL.
@@ -145,11 +204,20 @@ export async function uploadMedia(ctx, siteId, source) {
     let filename;
     let declared = '';
     if (source.path) {
-        bytes = await readFile(source.path);
-        filename = source.name ?? basename(source.path);
+        // The type comes from the REAL file's name, never from `name` — otherwise
+        // {path:"~/.ssh/id_rsa", name:"x.png"} uploads a key as an image to a public
+        // URL. `name` still becomes the library's display name (the form field below).
+        // A PDF is where the sensitive documents live (a tax return, a passport scan),
+        // so it comes only from the working or temp directory; images from anywhere.
+        let real = await guardLocal(source.path, MEDIA_EXT);
+        // Decided on the REAL name: a `pic.png` symlink to a PDF is a PDF.
+        if (extname(real).toLowerCase() === '.pdf')
+            real = await guardLocal(real, PDF_EXT, { confine: true });
+        bytes = await readFile(real);
+        filename = basename(real);
     }
     else if (source.url) {
-        const res = await doFetch(source.url);
+        const res = await fetchPublic(ctx, doFetch, source.url);
         if (!res.ok) {
             throw new ApiError(res.status, 'source_unreachable', `could not fetch ${source.url}`);
         }
@@ -158,7 +226,9 @@ export async function uploadMedia(ctx, siteId, source) {
         declared = (res.headers.get('content-type') ?? '').split(';')[0].trim();
         // A URL's last segment is usually the filename; when it is not (a query-only
         // CDN link), name it rather than uploading something called "".
-        filename = source.name ?? (new URL(source.url).pathname.split('/').pop() || 'image');
+        // The type comes from the response or the URL's own name, never from `name`
+        // (still sent as the display name below).
+        filename = new URL(source.url).pathname.split('/').pop() || 'image';
     }
     else {
         throw new Error('sbuilder: give sb_media_upload either a local path or a url');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.82.0",
+  "version": "0.82.2",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",