ssh-mcp 2.0.0 → 2.0.1

package/build/policy/classifier.js

@@ -28,25 +28,34 @@ const READ_ONLY_ALLOWLIST = new Set([
  * pattern was narrower). Anything here is also destructive for classification
  * purposes; see DESTRUCTIVE_DENYLIST below.
  */
+/*
+ * Every `\s+` here is followed by a literal. Where a `.*` or `[^|]*` comes
+ * next, the quantifier before it is a single `\s`: `\s+.*` lets both halves
+ * claim the same run of spaces, so a non-matching command is retried from every
+ * split and the match goes quadratic. sanitizeCommand caps commands at
+ * profile.maxChars (5000 by default) long before this runs, which is what keeps
+ * that cheap — but a policy check should not depend on a limit set three layers
+ * away and configurable to any value.
+ */
 const FORBIDDEN_PATTERNS = [
     /rm\s+-rf?\s+\/(\s|$)/, // rm -rf / — the filesystem root itself
     /mkfs\./,
-    /dd\s+.*\bof=\/dev\//,
+    /dd\s.*\bof=\/dev\//,
     />\s*\/dev\/sd/,
     /\bshutdown\b/,
     /\breboot\b/,
     /\bhalt\b/,
     /\bpoweroff\b/,
     /:\(\)\s*\{\s*:\|:\&\s*\}\s*;\s*:/, // fork bomb
-    /curl\s+.*\|\s*(sh|bash|zsh)/,
-    /wget\s+.*\|\s*(sh|bash|zsh)/,
+    /curl\s[^|]*\|\s*(sh|bash|zsh)/,
+    /wget\s[^|]*\|\s*(sh|bash|zsh)/,
     /\beval\b/,
     />\s*\/etc\/cron/,
     />\s*\/etc\/systemd/,
     />\s*~\/.ssh\/authorized_keys/,
     /\biptables\s+-F\b/,
     /\bchmod\s+-R\s+777\s+\//,
-    /\bchown\s+-R\s+.*\s+\/\s*$/,
+    /\bchown\s+-R\s.*\s\/\s*$/,
 ];
 /**
  * Commands that are destructive but legitimate under approval — e.g.

package/build/ssh/host-key.js

@@ -1,7 +1,11 @@
 import { createHash } from 'crypto';
 export function fingerprintPublicKey(key) {
     const hash = createHash('sha256').update(key).digest('base64');
-    return `SHA256:${hash.replace(/=+$/, '')}`;
+    // `={0,2}` rather than `=+`: base64 padding is never longer than two
+    // characters, and the bounded form cannot backtrack. Not reachable here — the
+    // input is always a 44-character digest — but an unbounded trailing
+    // quantifier is the shape worth not copying elsewhere.
+    return `SHA256:${hash.replace(/={0,2}$/, '')}`;
 }
 export function verifyHostKey(host, port, fingerprint, knownHosts, mode) {
     if (mode === 'insecure')

package/build/ssh/session.js

@@ -1,8 +1,45 @@
+import { randomBytes } from 'crypto';
 import { tracer } from '../observability/tracer.js';
 const ANSI_REGEX = /\x1b\[[0-9;?]*[a-zA-Z]|\x1b\][^\x07]*\x07|\r/g;
 export function stripAnsi(text) {
     return text.replace(ANSI_REGEX, '');
 }
+/**
+ * Trim leading and trailing newlines by index rather than with /^\n+/ and
+ * /\n+$/.
+ *
+ * The trailing pattern is unanchored at the start, so on output that is mostly
+ * newlines but does not end in one the engine retries `\n+` from every offset:
+ * quadratic in the length of the output. That output is whatever the remote
+ * command printed and the session buffer holds up to 2 MB of it, which measured
+ * at roughly 25 minutes of blocked event loop — and the loop is shared by every
+ * session and connection this server has open.
+ */
+/**
+ * A per-command marker separating the command's own output from the trailer
+ * carrying `$?` and `$PWD`.
+ *
+ * Guessing one is enough to forge an exit code or a working directory — a
+ * failed command reported as successful, in a server whose whole claim is an
+ * auditable record of what ran. Every marker is written to the remote host in
+ * the clear, so anything watching that session collects a stream of them, and
+ * Math.random() is reconstructible from such a stream.
+ *
+ * base64url keeps the value safe both inside the single-quoted printf that
+ * emits it and inside the RegExp built from it: no quotes, no metacharacters.
+ */
+export function generateSessionMarker() {
+    return randomBytes(12).toString('base64url');
+}
+export function trimNewlines(text) {
+    let start = 0;
+    let end = text.length;
+    while (start < end && text.charCodeAt(start) === 10)
+        start++;
+    while (end > start && text.charCodeAt(end - 1) === 10)
+        end--;
+    return start === 0 && end === text.length ? text : text.slice(start, end);
+}
 export class Session {
     id;
     name;
@@ -143,7 +180,7 @@ export class InteractiveSession extends Session {
                         : cleaned;
                     const endIdx = afterBegin.indexOf(endMarker);
                     const between = endIdx >= 0 ? afterBegin.slice(0, endIdx) : afterBegin;
-                    const output = between.replace(/^\n+/, '').replace(/\n+$/, '');
+                    const output = trimNewlines(between);
                     if (reportedCwd)
                         this.cwd = reportedCwd;
                     this.touch();
@@ -205,7 +242,7 @@ export class InteractiveSession extends Session {
         });
     }
     generateMarker() {
-        return Math.random().toString(36).substring(2, 14) + Date.now().toString(36);
+        return generateSessionMarker();
     }
     async close() {
         try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "type": "module",
   "bin": {