trackly-cli 0.2.3 → 0.2.4

package/bin/trackly

@@ -512,11 +512,20 @@ async function cmdAsk(args) {
     }
 
     if (result.jobsUrl) {
-      console.log();
-      console.log(color('dim', `Fetching: ${result.jobsUrl}`));
-      const jobsResult = await apiRequest('GET', result.jobsUrl);
-      console.log();
-      outputJobs(jobsResult.jobs || jobsResult.data || []);
+      // Path allowlist: /ask can return any string for jobsUrl. normalizeEndpoint already
+      // blocks cross-origin fetches (baseUrl mismatch), but a compromised backend could
+      // still emit a same-origin path like `/api/admin/secret-dump`. Restrict to the two
+      // legitimate handlers that /ask is designed to route to.
+      const JOBS_URL_ALLOWLIST = /^\/api\/(v1|jobscout)\/jobs(\?|$)/;
+      if (!JOBS_URL_ALLOWLIST.test(result.jobsUrl)) {
+        console.log(color('dim', `Refusing to follow unexpected jobsUrl: ${result.jobsUrl}`));
+      } else {
+        console.log();
+        console.log(color('dim', `Fetching: ${result.jobsUrl}`));
+        const jobsResult = await apiRequest('GET', result.jobsUrl);
+        console.log();
+        outputJobs(jobsResult.jobs || jobsResult.data || []);
+      }
     }
   } catch (e) {
     if (e.status === 429) setErrorExit('Daily limit reached (20 natural language queries per day)');

package/lib/client.js

@@ -262,9 +262,34 @@ function apiRequest(method, endpoint, data = null, skipAuth = false, _isRetry =
     };
 
     const req = lib.request(options, (res) => {
+      // Hard cap on response body size. A compromised / misconfigured backend (or a user-set
+      // TRACKLY_BASE_URL pointing at a malicious host) could stream unbounded data and OOM
+      // the long-lived MCP process. 10 MB is orders of magnitude larger than any real
+      // Trackly response; jobs-list maxes out around ~200 KB for 50 items.
+      const MAX_BODY_BYTES = 10 * 1024 * 1024;
       let body = '';
-      res.on('data', chunk => body += chunk);
+      let bytesReceived = 0;
+      let aborted = false;
+      // Handle socket-torn-down errors during streaming (happens when req.destroy()
+      // fires to abort an oversized body). Without this, the orphan 'error' event on
+      // the response stream can surface as an uncaught exception and crash the long-
+      // lived MCP process. The request-level `req.on('error', reject)` below catches
+      // the same underlying socket error for the request side; this covers the response
+      // side. (CodeRabbit PR #21.)
+      res.on('error', reject);
+      res.on('data', (chunk) => {
+        if (aborted) return;
+        bytesReceived += chunk.length;
+        if (bytesReceived > MAX_BODY_BYTES) {
+          aborted = true;
+          req.destroy(new Error(`Trackly response body exceeded ${MAX_BODY_BYTES} bytes`));
+          return;
+        }
+        body += chunk;
+      });
       res.on('end', async () => {
+        if (aborted) return; // req.destroy already rejected via 'error' handler
+
         let json;
         try { json = body ? JSON.parse(body) : {}; } catch { json = { raw: body }; }
 

package/mcp/server.js

@@ -226,10 +226,27 @@ function createServer() {
     wrapTool(async ({ query }) => {
       const askResult = await apiRequest('GET', `/api/jobscout/ask?q=${encodeURIComponent(query)}`, null, false, false, MCP_USER_AGENT);
       if (askResult.jobsUrl) {
-        const jobsResult = await apiRequest('GET', askResult.jobsUrl, null, false, false, MCP_USER_AGENT);
+        // Path allowlist: /ask returns a jobsUrl string. normalizeEndpoint already blocks
+        // cross-origin fetches, but a compromised backend could emit a same-origin path
+        // like `/api/admin/secret-dump`. Only follow the two handlers /ask is designed to
+        // route to. Mirrors the same guard in bin/trackly:cmdAsk.
+        const JOBS_URL_ALLOWLIST = /^\/api\/(v1|jobscout)\/jobs(\?|$)/;
+        if (JOBS_URL_ALLOWLIST.test(askResult.jobsUrl)) {
+          const jobsResult = await apiRequest('GET', askResult.jobsUrl, null, false, false, MCP_USER_AGENT);
+          return {
+            ...askResult,
+            jobs: jobsResult.jobs || jobsResult.data || [],
+          };
+        }
+        // Untrusted jobsUrl. Strip it from the returned payload so the MCP client
+        // doesn't receive (and potentially act on) a path we just refused to follow
+        // ourselves. Include a telemetry breadcrumb so the agent sees the refusal.
+        // (Copilot finding #2 on PR #21.)
+        const { jobsUrl: _refused, ...safeAskResult } = askResult;
         return {
-          ...askResult,
-          jobs: jobsResult.jobs || jobsResult.data || [],
+          ...safeAskResult,
+          jobsUrl: null,
+          jobsUrlRefused: true,
         };
       }
       return askResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackly-cli",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "mcpName": "io.github.kevinastuhuaman/trackly",
   "description": "AI job search CLI + hosted MCP server with OAuth. 128K+ jobs, 1,900+ companies, 40+ ATS. Works with Claude, ChatGPT, Cursor, Windsurf, Codex via hosted streamable-http or local stdio.",
   "bin": {

package/server.json

@@ -17,12 +17,12 @@
       ]
     }
   ],
-  "version": "0.2.3",
+  "version": "0.2.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "trackly-cli",
-      "version": "0.2.3",
+      "version": "0.2.4",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {