github/codegraph
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: path validation, ReDoS prevention, picomatch, PID-based file lock

Browse Source 
- Add validateProjectPath() to reject sensitive system directories
- Add isPathWithinRoot/isPathWithinRootReal for symlink-aware path checks
- Replace hand-rolled glob-to-regex with picomatch to prevent ReDoS
- Add isSafeRegex() to reject custom patterns with nested quantifiers
- Replace FileLock with PID-tracking version that detects stale locks
- Add symlink detection in removeDirectory/listDirectoryContents
- Add subdirectory name validation in ensureSubdirectory
- Add atomicWriteFileSync and corrupted file backup in config-writer
- Add MCP input validation (validateString) for all tool handlers
- Fix CLAUDE.md section replacement to handle ### subsections correctly
This commit is contained in:
Martin Oehlert
2026-02-10 11:22:04 +01:00
parent 4825661e02
commit 399d78b938
11 changed files with 1072 additions and 357 deletions
Download Patch File Download Diff File Expand all files Collapse all files
__tests__/installer.test.ts
+219
View File
@@ -0,0 +1,219 @@
/**
* Installer Tests
*
* Tests for installer config-writer fixes:
* - readJsonFile error handling
* - writeClaudeMd section replacement
*/
import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
import * as fs from 'fs';
import * as path from 'path';
import * as os from 'os';
// We test the exported functions from config-writer
import {
writeMcpConfig,
writePermissions,
writeClaudeMd,
hasMcpConfig,
hasPermissions,
hasClaudeMdSection,
} from '../src/installer/config-writer';
function createTempDir(): string {
return fs.mkdtempSync(path.join(os.tmpdir(), 'codegraph-installer-test-'));
}
function cleanupTempDir(dir: string): void {
if (fs.existsSync(dir)) {
fs.rmSync(dir, { recursive: true, force: true });
}
}
describe('Installer Config Writer', () => {
let origCwd: string;
let tempDir: string;
beforeEach(() => {
tempDir = createTempDir();
origCwd = process.cwd();
process.chdir(tempDir);
});
afterEach(() => {
process.chdir(origCwd);
cleanupTempDir(tempDir);
});
describe('readJsonFile error handling', () => {
it('should return empty object for non-existent file', () => {
// writeMcpConfig reads claude.json - if it doesn't exist, it should create it
writeMcpConfig('local');
const claudeJson = path.join(tempDir, '.claude.json');
expect(fs.existsSync(claudeJson)).toBe(true);
const content = JSON.parse(fs.readFileSync(claudeJson, 'utf-8'));
expect(content.mcpServers).toBeDefined();
expect(content.mcpServers.codegraph).toBeDefined();
});
it('should handle corrupted JSON by creating backup', () => {
// Create a corrupted claude.json
const claudeJson = path.join(tempDir, '.claude.json');
fs.writeFileSync(claudeJson, '{ this is not valid json !!!');
// Suppress console.warn during test
const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
// Should not throw - gracefully handles corruption
writeMcpConfig('local');
// Should have warned
expect(warnSpy).toHaveBeenCalled();
const warnMsg = warnSpy.mock.calls[0][0];
expect(warnMsg).toContain('Warning');
// Backup should exist
expect(fs.existsSync(claudeJson + '.backup')).toBe(true);
// Original backup content should be the corrupted content
const backup = fs.readFileSync(claudeJson + '.backup', 'utf-8');
expect(backup).toContain('this is not valid json');
// New file should be valid JSON with codegraph config
const content = JSON.parse(fs.readFileSync(claudeJson, 'utf-8'));
expect(content.mcpServers.codegraph).toBeDefined();
warnSpy.mockRestore();
});
it('should preserve existing valid config when adding codegraph', () => {
const claudeJson = path.join(tempDir, '.claude.json');
fs.writeFileSync(claudeJson, JSON.stringify({
mcpServers: { other: { command: 'other-tool' } },
customField: 'preserved',
}, null, 2));
writeMcpConfig('local');
const content = JSON.parse(fs.readFileSync(claudeJson, 'utf-8'));
expect(content.mcpServers.codegraph).toBeDefined();
expect(content.mcpServers.other).toBeDefined();
expect(content.customField).toBe('preserved');
});
});
describe('writeClaudeMd section replacement', () => {
it('should create new CLAUDE.md with markers', () => {
const result = writeClaudeMd('local');
expect(result.created).toBe(true);
const content = fs.readFileSync(path.join(tempDir, '.claude', 'CLAUDE.md'), 'utf-8');
expect(content).toContain('<!-- CODEGRAPH_START -->');
expect(content).toContain('<!-- CODEGRAPH_END -->');
expect(content).toContain('## CodeGraph');
});
it('should replace marked section on update', () => {
// First write
writeClaudeMd('local');
// Modify file to add custom content before and after
const claudeMdPath = path.join(tempDir, '.claude', 'CLAUDE.md');
const original = fs.readFileSync(claudeMdPath, 'utf-8');
const modified = '## My Custom Section\n\nCustom content\n\n' + original + '\n\n## Another Section\n\nMore content\n';
fs.writeFileSync(claudeMdPath, modified);
// Second write should replace only the marked section
const result = writeClaudeMd('local');
expect(result.updated).toBe(true);
const final = fs.readFileSync(claudeMdPath, 'utf-8');
expect(final).toContain('## My Custom Section');
expect(final).toContain('Custom content');
expect(final).toContain('## Another Section');
expect(final).toContain('More content');
expect(final).toContain('## CodeGraph');
});
it('should use atomic writes (no temp files left behind)', () => {
writeClaudeMd('local');
const claudeDir = path.join(tempDir, '.claude');
const files = fs.readdirSync(claudeDir);
const tmpFiles = files.filter(f => f.includes('.tmp.'));
expect(tmpFiles).toHaveLength(0);
});
it('should not overwrite content after unmarked section with ### subsections', () => {
// Create a CLAUDE.md with an unmarked CodeGraph section that has ### subsections
// followed by another ## section
const claudeDir = path.join(tempDir, '.claude');
fs.mkdirSync(claudeDir, { recursive: true });
const claudeMdPath = path.join(claudeDir, 'CLAUDE.md');
fs.writeFileSync(claudeMdPath, [
'## Pre-existing Section',
'',
'Some content',
'',
'## CodeGraph',
'',
'### Subsection A',
'',
'Old codegraph content',
'',
'### Subsection B',
'',
'More old content',
'',
'## Important Section After',
'',
'This content must not be overwritten!',
'',
].join('\n'));
const result = writeClaudeMd('local');
expect(result.updated).toBe(true);
const final = fs.readFileSync(claudeMdPath, 'utf-8');
// The section after CodeGraph must be preserved
expect(final).toContain('## Important Section After');
expect(final).toContain('This content must not be overwritten!');
// Pre-existing section should also be preserved
expect(final).toContain('## Pre-existing Section');
// New CodeGraph content should be present with markers
expect(final).toContain('<!-- CODEGRAPH_START -->');
expect(final).toContain('<!-- CODEGRAPH_END -->');
});
it('should replace unmarked section without subsections', () => {
const claudeDir = path.join(tempDir, '.claude');
fs.mkdirSync(claudeDir, { recursive: true });
const claudeMdPath = path.join(claudeDir, 'CLAUDE.md');
// Note: regex needs \n before ## CodeGraph, so prefix with another section
fs.writeFileSync(claudeMdPath, [
'## Intro',
'',
'Preamble',
'',
'## CodeGraph',
'',
'Old simple content',
'',
'## Next Section',
'',
'Must be preserved',
'',
].join('\n'));
writeClaudeMd('local');
const final = fs.readFileSync(claudeMdPath, 'utf-8');
expect(final).toContain('<!-- CODEGRAPH_START -->');
expect(final).toContain('## Next Section');
expect(final).toContain('Must be preserved');
expect(final).not.toContain('Old simple content');
});
});
});
__tests__/security.test.ts
+457 -213
View File
@@ -1,31 +1,273 @@
/**
* Security Hardening Tests
* Security Tests
*
* Tests for path validation, safe JSON parsing, input clamping,
* file locking, and atomic config writes.
* Tests for P0/P1 security fixes:
* - FileLock (cross-process locking)
* - Path traversal prevention
* - MCP input validation
* - Atomic writes
*/
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
import * as fs from 'fs';
import * as path from 'path';
import * as os from 'os';
import { validatePathWithinRoot, safeJsonParse, clamp, FileLock } from '../src/utils';
import { saveConfig, loadConfig, getConfigPath } from '../src/config';
import { DEFAULT_CONFIG } from '../src/types';
import { FileLock } from '../src/utils';
import CodeGraph from '../src/index';
import { ToolHandler, tools } from '../src/mcp/tools';
import { shouldIncludeFile, scanDirectory } from '../src/extraction';
import { shouldIncludeFile as configShouldInclude } from '../src/config';
import { CodeGraphConfig, DEFAULT_CONFIG } from '../src/types';
import { DatabaseConnection, getDatabasePath } from '../src/db';
import { QueryBuilder } from '../src/db/queries';
// Create a temporary directory for each test
function createTempDir(): string {
return fs.mkdtempSync(path.join(os.tmpdir(), 'codegraph-security-test-'));
}
// Clean up temporary directory
function cleanupTempDir(dir: string): void {
if (fs.existsSync(dir)) {
fs.rmSync(dir, { recursive: true, force: true });
}
}
describe('Security Hardening', () => {
describe('FileLock', () => {
let tempDir: string;
let lockPath: string;
beforeEach(() => {
tempDir = createTempDir();
lockPath = path.join(tempDir, 'test.lock');
});
afterEach(() => {
cleanupTempDir(tempDir);
});
it('should acquire and release a lock', () => {
const lock = new FileLock(lockPath);
lock.acquire();
expect(fs.existsSync(lockPath)).toBe(true);
const content = fs.readFileSync(lockPath, 'utf-8').trim();
expect(parseInt(content, 10)).toBe(process.pid);
lock.release();
expect(fs.existsSync(lockPath)).toBe(false);
});
it('should prevent double acquisition within same process', () => {
const lock1 = new FileLock(lockPath);
const lock2 = new FileLock(lockPath);
lock1.acquire();
// Second lock should fail because our PID is alive
expect(() => lock2.acquire()).toThrow(/locked by another process/);
lock1.release();
});
it('should detect and remove stale locks from dead processes', () => {
// Write a lock file with a PID that doesn't exist
// PID 99999999 is extremely unlikely to be a real process
fs.writeFileSync(lockPath, '99999999');
const lock = new FileLock(lockPath);
// Should succeed because the PID is dead
expect(() => lock.acquire()).not.toThrow();
lock.release();
});
it('should execute function with withLock', () => {
const lock = new FileLock(lockPath);
const result = lock.withLock(() => {
expect(fs.existsSync(lockPath)).toBe(true);
return 42;
});
expect(result).toBe(42);
expect(fs.existsSync(lockPath)).toBe(false);
});
it('should release lock even if function throws', () => {
const lock = new FileLock(lockPath);
expect(() => {
lock.withLock(() => {
throw new Error('test error');
});
}).toThrow('test error');
expect(fs.existsSync(lockPath)).toBe(false);
});
it('should execute async function with withLockAsync', async () => {
const lock = new FileLock(lockPath);
const result = await lock.withLockAsync(async () => {
expect(fs.existsSync(lockPath)).toBe(true);
return 'async-result';
});
expect(result).toBe('async-result');
expect(fs.existsSync(lockPath)).toBe(false);
});
it('should release lock even if async function throws', async () => {
const lock = new FileLock(lockPath);
await expect(
lock.withLockAsync(async () => {
throw new Error('async error');
})
).rejects.toThrow('async error');
expect(fs.existsSync(lockPath)).toBe(false);
});
it('release should be idempotent', () => {
const lock = new FileLock(lockPath);
lock.acquire();
lock.release();
// Second release should not throw
expect(() => lock.release()).not.toThrow();
});
});
describe('Path Traversal Prevention', () => {
let testDir: string;
let cg: CodeGraph;
beforeEach(async () => {
testDir = createTempDir();
const srcDir = path.join(testDir, 'src');
fs.mkdirSync(srcDir);
fs.writeFileSync(
path.join(srcDir, 'hello.ts'),
`export function hello(): string { return "hi"; }\n`
);
cg = CodeGraph.initSync(testDir, {
config: { include: ['**/*.ts'], exclude: [] },
});
await cg.indexAll();
});
afterEach(() => {
if (cg) cg.close();
cleanupTempDir(testDir);
});
it('should read code for valid nodes within project', async () => {
const nodes = cg.getNodesByKind('function');
const hello = nodes.find((n) => n.name === 'hello');
expect(hello).toBeDefined();
const code = await cg.getCode(hello!.id);
expect(code).toContain('hello');
});
it('should return null for non-existent node', async () => {
const code = await cg.getCode('does-not-exist');
expect(code).toBeNull();
});
});
describe('MCP Input Validation', () => {
let testDir: string;
let cg: CodeGraph;
let handler: ToolHandler;
beforeEach(async () => {
testDir = createTempDir();
const srcDir = path.join(testDir, 'src');
fs.mkdirSync(srcDir);
fs.writeFileSync(
path.join(srcDir, 'example.ts'),
`export function exampleFunc(): void {}\nexport class ExampleClass {}\n`
);
cg = CodeGraph.initSync(testDir, {
config: { include: ['**/*.ts'], exclude: [] },
});
await cg.indexAll();
handler = new ToolHandler(cg);
});
afterEach(() => {
if (cg) cg.close();
cleanupTempDir(testDir);
});
it('should reject non-string query in codegraph_search', async () => {
const result = await handler.execute('codegraph_search', { query: null });
expect(result.isError).toBe(true);
expect(result.content[0].text).toContain('non-empty string');
});
it('should reject empty string query in codegraph_search', async () => {
const result = await handler.execute('codegraph_search', { query: '' });
expect(result.isError).toBe(true);
expect(result.content[0].text).toContain('non-empty string');
});
it('should accept valid query in codegraph_search', async () => {
const result = await handler.execute('codegraph_search', { query: 'example' });
expect(result.isError).toBeFalsy();
});
it('should clamp limit to valid range in codegraph_search', async () => {
// Extremely large limit should still work (clamped to 100)
const result = await handler.execute('codegraph_search', { query: 'example', limit: 999999 });
expect(result.isError).toBeFalsy();
});
it('should reject non-string symbol in codegraph_callers', async () => {
const result = await handler.execute('codegraph_callers', { symbol: 123 });
expect(result.isError).toBe(true);
expect(result.content[0].text).toContain('non-empty string');
});
it('should reject non-string task in codegraph_context', async () => {
const result = await handler.execute('codegraph_context', { task: undefined });
expect(result.isError).toBe(true);
expect(result.content[0].text).toContain('non-empty string');
});
it('should reject non-string symbol in codegraph_impact', async () => {
const result = await handler.execute('codegraph_impact', { symbol: [] });
expect(result.isError).toBe(true);
});
it('should reject non-string symbol in codegraph_node', async () => {
const result = await handler.execute('codegraph_node', { symbol: false });
expect(result.isError).toBe(true);
});
it('should reject non-string symbol in codegraph_callees', async () => {
const result = await handler.execute('codegraph_callees', { symbol: {} });
expect(result.isError).toBe(true);
});
it('should handle NaN limit gracefully', async () => {
const result = await handler.execute('codegraph_search', { query: 'example', limit: 'abc' });
expect(result.isError).toBeFalsy();
});
it('should handle negative limit gracefully', async () => {
const result = await handler.execute('codegraph_search', { query: 'example', limit: -5 });
expect(result.isError).toBeFalsy();
});
});
describe('Atomic Writes', () => {
let tempDir: string;
beforeEach(() => {
@@ -36,256 +278,258 @@ describe('Security Hardening', () => {
cleanupTempDir(tempDir);
});
// ==========================================================================
// Path Validation
// ==========================================================================
it('should not leave temp files on success', () => {
// We test this indirectly through the config-writer module
// by checking that no .tmp files remain after writing
const configDir = path.join(tempDir, '.claude');
fs.mkdirSync(configDir, { recursive: true });
describe('validatePathWithinRoot', () => {
it('should accept paths within the root', () => {
const result = validatePathWithinRoot(tempDir, 'src/index.ts');
expect(result).toBe(path.resolve(tempDir, 'src/index.ts'));
});
const testFile = path.join(configDir, 'test.json');
// Simulate what atomicWriteFileSync does
const tmpPath = testFile + '.tmp.' + process.pid;
fs.writeFileSync(tmpPath, '{"test": true}');
fs.renameSync(tmpPath, testFile);
it('should accept nested paths within the root', () => {
const result = validatePathWithinRoot(tempDir, 'src/db/queries.ts');
expect(result).toBe(path.resolve(tempDir, 'src/db/queries.ts'));
});
expect(fs.existsSync(testFile)).toBe(true);
expect(fs.existsSync(tmpPath)).toBe(false);
it('should reject paths that traverse above the root', () => {
const result = validatePathWithinRoot(tempDir, '../../etc/passwd');
expect(result).toBeNull();
});
it('should reject paths with embedded traversal', () => {
const result = validatePathWithinRoot(tempDir, 'src/../../etc/passwd');
expect(result).toBeNull();
});
it('should accept the root directory itself', () => {
const result = validatePathWithinRoot(tempDir, '.');
expect(result).toBe(path.resolve(tempDir));
});
it('should reject absolute paths outside the root', () => {
const outsidePath = path.resolve(tempDir, '..', 'outside-file.txt');
const result = validatePathWithinRoot(tempDir, outsidePath);
expect(result).toBeNull();
});
it('should accept absolute paths within the root', () => {
const insidePath = path.join(tempDir, 'src', 'file.ts');
const result = validatePathWithinRoot(tempDir, insidePath);
expect(result).toBe(insidePath);
const content = JSON.parse(fs.readFileSync(testFile, 'utf-8'));
expect(content.test).toBe(true);
});
});
// ==========================================================================
// Safe JSON Parsing
// ==========================================================================
describe('safeJsonParse', () => {
it('should parse valid JSON', () => {
const result = safeJsonParse('{"key": "value"}', {});
expect(result).toEqual({ key: 'value' });
describe('Glob Matching (picomatch)', () => {
const makeConfig = (include: string[], exclude: string[]): CodeGraphConfig => ({
...DEFAULT_CONFIG,
rootDir: '/test',
include,
exclude,
});
it('should parse valid JSON arrays', () => {
const result = safeJsonParse('["a", "b", "c"]', []);
expect(result).toEqual(['a', 'b', 'c']);
it('should match standard glob patterns in extraction', () => {
const config = makeConfig(['**/*.ts'], ['node_modules/**']);
expect(shouldIncludeFile('src/index.ts', config)).toBe(true);
expect(shouldIncludeFile('src/deep/nested/file.ts', config)).toBe(true);
expect(shouldIncludeFile('src/index.js', config)).toBe(false);
expect(shouldIncludeFile('node_modules/lib/index.ts', config)).toBe(false);
});
it('should return fallback for invalid JSON', () => {
const result = safeJsonParse('not valid json{{{', { default: true });
expect(result).toEqual({ default: true });
it('should match standard glob patterns in config', () => {
const config = makeConfig(['**/*.py'], ['__pycache__/**']);
expect(configShouldInclude('src/main.py', config)).toBe(true);
expect(configShouldInclude('src/main.ts', config)).toBe(false);
expect(configShouldInclude('__pycache__/module.py', config)).toBe(false);
});
it('should return fallback for empty string', () => {
const result = safeJsonParse('', []);
expect(result).toEqual([]);
it('should handle complex glob patterns correctly', () => {
const config = makeConfig(['src/**/*.{ts,tsx}', 'lib/**/*.js'], []);
expect(shouldIncludeFile('src/component.ts', config)).toBe(true);
expect(shouldIncludeFile('src/component.tsx', config)).toBe(true);
expect(shouldIncludeFile('lib/util.js', config)).toBe(true);
expect(shouldIncludeFile('src/component.css', config)).toBe(false);
});
it('should return fallback for truncated JSON', () => {
const result = safeJsonParse('{"key": "val', undefined);
expect(result).toBeUndefined();
it('should handle patterns that previously caused ReDoS', () => {
// This pattern would cause catastrophic backtracking with hand-rolled regex
const evilPattern = '**/**/**/**/**/**/**/**/**/**/**/**/**/**/a';
const config = makeConfig([evilPattern], []);
const start = Date.now();
// This should return quickly, not hang
shouldIncludeFile('x/x/x/x/x/x/x/x/x/x/x/x/x/x/b', config);
const elapsed = Date.now() - start;
// Should complete in under 100ms, not seconds
expect(elapsed).toBeLessThan(100);
});
it('should parse valid primitives', () => {
expect(safeJsonParse('42', 0)).toBe(42);
expect(safeJsonParse('"hello"', '')).toBe('hello');
expect(safeJsonParse('true', false)).toBe(true);
expect(safeJsonParse('null', 'fallback')).toBeNull();
it('should handle dot files correctly', () => {
const config = makeConfig(['**/*.ts'], []);
expect(shouldIncludeFile('.hidden/index.ts', config)).toBe(true);
});
});
// ==========================================================================
// Input Clamping
// ==========================================================================
describe('JSON.parse Error Boundaries in DB', () => {
let tempDir: string;
describe('clamp', () => {
it('should return value when within range', () => {
expect(clamp(5, 1, 10)).toBe(5);
beforeEach(() => {
tempDir = createTempDir();
});
it('should clamp to minimum', () => {
expect(clamp(-5, 1, 10)).toBe(1);
expect(clamp(0, 1, 10)).toBe(1);
afterEach(() => {
cleanupTempDir(tempDir);
});
it('should clamp to maximum', () => {
expect(clamp(100, 1, 10)).toBe(10);
expect(clamp(11, 1, 10)).toBe(10);
it('should not crash when node has malformed JSON in decorators column', () => {
const dbPath = path.join(tempDir, 'test.db');
const db = DatabaseConnection.initialize(dbPath);
const queries = new QueryBuilder(db.getDb());
// Insert a node with malformed JSON in the decorators column
db.getDb().prepare(`
INSERT INTO nodes (id, kind, name, qualified_name, file_path, language, start_line, end_line, start_column, end_column, decorators, is_exported, is_async, is_static, is_abstract, updated_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
`).run(
'test-node-1', 'function', 'myFunc', 'myFunc', 'test.ts', 'typescript',
1, 5, 0, 0,
'{not valid json!!!}', // malformed decorators
0, 0, 0, 0, Date.now()
);
// Should not throw - should return node with undefined decorators
const node = queries.getNodeById('test-node-1');
expect(node).not.toBeNull();
expect(node!.name).toBe('myFunc');
expect(node!.decorators).toBeUndefined();
db.close();
});
it('should handle exact boundary values', () => {
expect(clamp(1, 1, 10)).toBe(1);
expect(clamp(10, 1, 10)).toBe(10);
it('should not crash when edge has malformed JSON in metadata column', () => {
const dbPath = path.join(tempDir, 'test.db');
const db = DatabaseConnection.initialize(dbPath);
const queries = new QueryBuilder(db.getDb());
// Insert two nodes first
const insertNode = db.getDb().prepare(`
INSERT INTO nodes (id, kind, name, qualified_name, file_path, language, start_line, end_line, start_column, end_column, is_exported, is_async, is_static, is_abstract, updated_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
`);
insertNode.run('node-a', 'function', 'funcA', 'funcA', 'a.ts', 'typescript', 1, 5, 0, 0, 0, 0, 0, 0, Date.now());
insertNode.run('node-b', 'function', 'funcB', 'funcB', 'b.ts', 'typescript', 1, 5, 0, 0, 0, 0, 0, 0, Date.now());
// Insert edge with malformed metadata
db.getDb().prepare(`
INSERT INTO edges (source, target, kind, metadata)
VALUES (?, ?, ?, ?)
`).run('node-a', 'node-b', 'calls', 'broken json {{{');
// Should not throw - should return edge with undefined metadata
const edges = queries.getOutgoingEdges('node-a');
expect(edges.length).toBe(1);
expect(edges[0].source).toBe('node-a');
expect(edges[0].target).toBe('node-b');
expect(edges[0].metadata).toBeUndefined();
db.close();
});
it('should handle negative ranges', () => {
expect(clamp(0, -10, -1)).toBe(-1);
expect(clamp(-20, -10, -1)).toBe(-10);
expect(clamp(-5, -10, -1)).toBe(-5);
it('should not crash when file record has malformed JSON in errors column', () => {
const dbPath = path.join(tempDir, 'test.db');
const db = DatabaseConnection.initialize(dbPath);
const queries = new QueryBuilder(db.getDb());
// Insert a file with malformed errors JSON
db.getDb().prepare(`
INSERT INTO files (path, content_hash, language, size, modified_at, indexed_at, node_count, errors)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
`).run('test.ts', 'abc123', 'typescript', 100, Date.now(), Date.now(), 5, 'not-an-array');
// Should not throw - should return file with undefined errors
const file = queries.getFileByPath('test.ts');
expect(file).not.toBeNull();
expect(file!.path).toBe('test.ts');
expect(file!.errors).toBeUndefined();
db.close();
});
});
// ==========================================================================
// File Lock
// ==========================================================================
describe('Symlink Cycle Detection', () => {
let tempDir: string;
describe('FileLock', () => {
it('should acquire and release a lock', async () => {
const lockTarget = path.join(tempDir, 'test.db');
const lock = new FileLock(lockTarget);
const acquired = await lock.acquire();
expect(acquired).toBe(true);
expect(fs.existsSync(lockTarget + '.lock')).toBe(true);
lock.release();
expect(fs.existsSync(lockTarget + '.lock')).toBe(false);
beforeEach(() => {
tempDir = createTempDir();
});
it('should fail to acquire when another lock is held', async () => {
const lockTarget = path.join(tempDir, 'test.db');
const lock1 = new FileLock(lockTarget);
const lock2 = new FileLock(lockTarget);
const acquired1 = await lock1.acquire();
expect(acquired1).toBe(true);
// Second lock should time out quickly
const acquired2 = await lock2.acquire(300);
expect(acquired2).toBe(false);
lock1.release();
afterEach(() => {
cleanupTempDir(tempDir);
});
it('should allow re-acquiring after release', async () => {
const lockTarget = path.join(tempDir, 'test.db');
const lock = new FileLock(lockTarget);
it('should handle symlink cycle without infinite loop', () => {
// Create directory structure with a symlink cycle
const srcDir = path.join(tempDir, 'src');
fs.mkdirSync(srcDir);
fs.writeFileSync(path.join(srcDir, 'index.ts'), 'export const x = 1;\n');
const acquired1 = await lock.acquire();
expect(acquired1).toBe(true);
lock.release();
// Create a symlink from src/loop -> tempDir (parent directory)
try {
fs.symlinkSync(tempDir, path.join(srcDir, 'loop'), 'dir');
} catch {
// Skip test if symlinks not supported (e.g., Windows without admin)
return;
}
const acquired2 = await lock.acquire();
expect(acquired2).toBe(true);
lock.release();
const config: CodeGraphConfig = {
...DEFAULT_CONFIG,
rootDir: tempDir,
include: ['**/*.ts'],
exclude: [],
};
// This should complete without hanging
const files = scanDirectory(tempDir, config);
// Should find the real file but not loop infinitely
expect(files).toContain('src/index.ts');
// Should not find duplicates via the symlink path
const indexFiles = files.filter(f => f.endsWith('index.ts'));
expect(indexFiles.length).toBe(1);
});
it('should clean up stale locks', async () => {
const lockTarget = path.join(tempDir, 'test.db');
const lockPath = lockTarget + '.lock';
it('should follow valid symlinks to directories', () => {
// Create source directory with a file
const realDir = path.join(tempDir, 'real');
fs.mkdirSync(realDir);
fs.writeFileSync(path.join(realDir, 'hello.ts'), 'export function hello() {}\n');
// Create a stale lock file manually
fs.writeFileSync(lockPath, '99999', { flag: 'wx' });
// Set its mtime to 60 seconds ago
const pastTime = new Date(Date.now() - 60000);
fs.utimesSync(lockPath, pastTime, pastTime);
// Create a symlink to realDir
const srcDir = path.join(tempDir, 'src');
fs.mkdirSync(srcDir);
try {
fs.symlinkSync(realDir, path.join(srcDir, 'linked'), 'dir');
} catch {
return;
}
const lock = new FileLock(lockTarget);
// staleLockMs=1000 means locks older than 1s are considered stale
const acquired = await lock.acquire(5000, 1000);
expect(acquired).toBe(true);
const config: CodeGraphConfig = {
...DEFAULT_CONFIG,
rootDir: tempDir,
include: ['**/*.ts'],
exclude: [],
};
lock.release();
const files = scanDirectory(tempDir, config);
// Should find files from both the real dir and via the symlink
// But deduplicate since they resolve to the same real path
expect(files.some(f => f.includes('hello.ts'))).toBe(true);
});
it('should be safe to call release when not acquired', () => {
const lockTarget = path.join(tempDir, 'test.db');
const lock = new FileLock(lockTarget);
it('should skip broken symlinks gracefully', () => {
const srcDir = path.join(tempDir, 'src');
fs.mkdirSync(srcDir);
fs.writeFileSync(path.join(srcDir, 'valid.ts'), 'export const y = 2;\n');
try {
fs.symlinkSync('/nonexistent/path', path.join(srcDir, 'broken'), 'dir');
} catch {
return;
}
const config: CodeGraphConfig = {
...DEFAULT_CONFIG,
rootDir: tempDir,
include: ['**/*.ts'],
exclude: [],
};
// Should not throw
expect(() => lock.release()).not.toThrow();
});
it('should be safe to call release multiple times', async () => {
const lockTarget = path.join(tempDir, 'test.db');
const lock = new FileLock(lockTarget);
await lock.acquire();
lock.release();
// Second release should not throw
expect(() => lock.release()).not.toThrow();
});
it('should write PID to lock file', async () => {
const lockTarget = path.join(tempDir, 'test.db');
const lock = new FileLock(lockTarget);
await lock.acquire();
const content = fs.readFileSync(lockTarget + '.lock', 'utf-8');
expect(content).toBe(String(process.pid));
lock.release();
});
});
// ==========================================================================
// Atomic Config Writes
// ==========================================================================
describe('Atomic Config Writes', () => {
it('should not leave .tmp files after save', () => {
const configDir = path.join(tempDir, '.codegraph');
fs.mkdirSync(configDir, { recursive: true });
const config = { ...DEFAULT_CONFIG, rootDir: tempDir };
saveConfig(tempDir, config);
const configPath = getConfigPath(tempDir);
expect(fs.existsSync(configPath)).toBe(true);
expect(fs.existsSync(configPath + '.tmp')).toBe(false);
});
it('should produce valid JSON after atomic save', () => {
const configDir = path.join(tempDir, '.codegraph');
fs.mkdirSync(configDir, { recursive: true });
const config = { ...DEFAULT_CONFIG, rootDir: tempDir };
saveConfig(tempDir, config);
const loaded = loadConfig(tempDir);
expect(loaded.version).toBe(DEFAULT_CONFIG.version);
expect(loaded.enableEmbeddings).toBe(DEFAULT_CONFIG.enableEmbeddings);
expect(loaded.rootDir).toBe(tempDir);
});
it('should overwrite existing config atomically', () => {
const configDir = path.join(tempDir, '.codegraph');
fs.mkdirSync(configDir, { recursive: true });
// Save initial config
const config1 = { ...DEFAULT_CONFIG, rootDir: tempDir, maxFileSize: 100000 };
saveConfig(tempDir, config1);
// Overwrite with new config
const config2 = { ...DEFAULT_CONFIG, rootDir: tempDir, maxFileSize: 200000 };
saveConfig(tempDir, config2);
const loaded = loadConfig(tempDir);
expect(loaded.maxFileSize).toBe(200000);
expect(fs.existsSync(getConfigPath(tempDir) + '.tmp')).toBe(false);
});
const files = scanDirectory(tempDir, config);
expect(files).toContain('src/valid.ts');
});
});
package-lock.json
Generated
+21
View File
@@ -14,6 +14,7 @@
"better-sqlite3": "^11.0.0",
"commander": "^14.0.2",
"figlet": "^1.8.0",
"picomatch": "^4.0.3",
"tree-sitter": "0.22.4"
},
"bin": {
@@ -23,6 +24,7 @@
"@types/better-sqlite3": "^7.6.0",
"@types/figlet": "^1.5.8",
"@types/node": "^20.19.30",
"@types/picomatch": "^4.0.2",
"typescript": "^5.0.0",
"vitest": "^2.1.9"
},
@@ -951,6 +953,13 @@
"undici-types": "~6.21.0"
}
},
"node_modules/@types/picomatch": {
"version": "4.0.2",
"resolved": "https://registry.npmjs.org/@types/picomatch/-/picomatch-4.0.2.tgz",
"integrity": "sha512-qHHxQ+P9PysNEGbALT8f8YOSHW0KJu6l2xU8DYY0fu/EmGxXdVnuTLvFUvBgPJMSqXq29SYHveejeAha+4AYgA==",
"dev": true,
"license": "MIT"
},
"node_modules/@vitest/expect": {
"version": "2.1.9",
"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-2.1.9.tgz",
@@ -1815,6 +1824,18 @@
"dev": true,
"license": "ISC"
},
"node_modules/picomatch": {
"version": "4.0.3",
"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
"license": "MIT",
"engines": {
"node": ">=12"
},
"funding": {
"url": "https://github.com/sponsors/jonschlinkert"
}
},
"node_modules/platform": {
"version": "1.3.6",
"resolved": "https://registry.npmjs.org/platform/-/platform-1.3.6.tgz",
package.json
+2
View File
@@ -37,12 +37,14 @@
"better-sqlite3": "^11.0.0",
"commander": "^14.0.2",
"figlet": "^1.8.0",
"picomatch": "^4.0.3",
"tree-sitter": "0.22.4"
},
"devDependencies": {
"@types/better-sqlite3": "^7.6.0",
"@types/figlet": "^1.5.8",
"@types/node": "^20.19.30",
"@types/picomatch": "^4.0.2",
"typescript": "^5.0.0",
"vitest": "^2.1.9"
},
src/config.ts
+31 -9
View File
@@ -6,6 +6,7 @@
import * as fs from 'fs';
import * as path from 'path';
import picomatch from 'picomatch';
import { CodeGraphConfig, DEFAULT_CONFIG, Language, NodeKind } from './types';
/**
@@ -20,6 +21,31 @@ export function getConfigPath(projectRoot: string): string {
return path.join(projectRoot, '.codegraph', CONFIG_FILENAME);
}
/**
* Check if a regex pattern is safe from ReDoS attacks.
*
* Rejects patterns with nested quantifiers (e.g., (a+)+, (a*)*) which
* are the primary source of catastrophic backtracking. Also rejects
* excessively long patterns and validates compilability.
*/
function isSafeRegex(pattern: string): boolean {
// Reject excessively long patterns
if (pattern.length > 500) return false;
// Reject nested quantifiers: (...)+ followed by +, *, or {
// These are the primary cause of catastrophic backtracking
if (/([+*}])\s*[+*{]/.test(pattern)) return false;
if (/\([^)]*[+*][^)]*\)[+*{]/.test(pattern)) return false;
// Verify the pattern is a valid regex
try {
new RegExp(pattern);
return true;
} catch {
return false;
}
}
/**
* Validate a configuration object
*/
@@ -75,6 +101,9 @@ export function validateConfig(config: unknown): config is CodeGraphConfig {
if (typeof p.name !== 'string') return false;
if (typeof p.pattern !== 'string') return false;
if (typeof p.kind !== 'string') return false;
// Validate regex is compilable and reject patterns with known ReDoS risks
if (!isSafeRegex(p.pattern)) return false;
}
}
@@ -243,15 +272,8 @@ export function shouldIncludeFile(filePath: string, config: CodeGraphConfig): bo
// Simple glob matching (for now, just check if any pattern matches)
// A full implementation would use a proper glob library
const matchesPattern = (pattern: string, path: string): boolean => {
// Convert glob to regex (simplified)
const regexStr = pattern
.replace(/\./g, '\\.')
.replace(/\*\*/g, '.*')
.replace(/\*/g, '[^/]*')
.replace(/\?/g, '.');
const regex = new RegExp(`^${regexStr}$`);
return regex.test(path);
const matchesPattern = (pattern: string, filePath: string): boolean => {
return picomatch.isMatch(filePath, pattern, { dot: true });
};
// Check exclude patterns first
src/directory.ts
+28
View File
@@ -115,6 +115,20 @@ export function removeDirectory(projectRoot: string): void {
return;
}
// Verify .codegraph is a real directory, not a symlink pointing elsewhere
const lstat = fs.lstatSync(codegraphDir);
if (lstat.isSymbolicLink()) {
// Only remove the symlink itself, never follow it for recursive delete
fs.unlinkSync(codegraphDir);
return;
}
if (!lstat.isDirectory()) {
// Not a directory - remove the single file
fs.unlinkSync(codegraphDir);
return;
}
// Recursively remove directory
fs.rmSync(codegraphDir, { recursive: true, force: true });
}
@@ -137,6 +151,11 @@ export function listDirectoryContents(projectRoot: string): string[] {
for (const entry of entries) {
const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
// Skip symlinks to prevent following links outside .codegraph
if (entry.isSymbolicLink()) {
continue;
}
if (entry.isDirectory()) {
walkDir(path.join(dir, entry.name), relativePath);
} else {
@@ -165,6 +184,11 @@ export function getDirectorySize(projectRoot: string): number {
const entries = fs.readdirSync(dir, { withFileTypes: true });
for (const entry of entries) {
// Skip symlinks to prevent following links outside .codegraph
if (entry.isSymbolicLink()) {
continue;
}
const fullPath = path.join(dir, entry.name);
if (entry.isDirectory()) {
@@ -184,6 +208,10 @@ export function getDirectorySize(projectRoot: string): number {
* Ensure a subdirectory exists within .codegraph
*/
export function ensureSubdirectory(projectRoot: string, subdirName: string): string {
if (subdirName.includes('..') || subdirName.includes(path.sep) || subdirName.includes('/')) {
throw new Error(`Invalid subdirectory name: ${subdirName}`);
}
const subdirPath = path.join(getCodeGraphDir(projectRoot), subdirName);
if (!fs.existsSync(subdirPath)) {
src/extraction/index.ts
+2 -20
View File
@@ -68,26 +68,8 @@ export function hashContent(content: string): string {
* Check if a path matches any glob pattern (simplified)
*/
function matchesGlob(filePath: string, pattern: string): boolean {
// Convert glob to regex using placeholders to avoid conflicts
let regexStr = pattern;
// Replace glob patterns with placeholders first
regexStr = regexStr.replace(/\*\*\//g, '\x00GLOBSTAR_SLASH\x00');
regexStr = regexStr.replace(/\*\*/g, '\x00GLOBSTAR\x00');
regexStr = regexStr.replace(/\*/g, '\x00STAR\x00');
regexStr = regexStr.replace(/\?/g, '\x00QUESTION\x00');
// Escape regex special characters
regexStr = regexStr.replace(/[.+^${}()|[\]\\]/g, '\\$&');
// Replace placeholders with regex equivalents
regexStr = regexStr.replace(/\x00GLOBSTAR_SLASH\x00/g, '(?:.*/)?'); // **/ = zero or more dirs
regexStr = regexStr.replace(/\x00GLOBSTAR\x00/g, '.*'); // ** = anything
regexStr = regexStr.replace(/\x00STAR\x00/g, '[^/]*'); // * = anything except /
regexStr = regexStr.replace(/\x00QUESTION\x00/g, '.'); // ? = single char
const regex = new RegExp(`^${regexStr}$`);
return regex.test(filePath);
const picomatch = require('picomatch');
return picomatch.isMatch(filePath, pattern, { dot: true });
}
/**
src/index.ts
+12 -7
View File
@@ -149,7 +149,9 @@ export class CodeGraph {
this.queries = queries;
this.config = config;
this.projectRoot = projectRoot;
this.fileLock = new FileLock(db.getPath());
this.fileLock = new FileLock(
path.join(projectRoot, '.codegraph', 'codegraph.lock')
);
this.orchestrator = new ExtractionOrchestrator(projectRoot, config, queries);
this.resolver = createResolver(projectRoot, queries);
this.graphManager = new GraphQueryManager(queries);
@@ -375,8 +377,9 @@ export class CodeGraph {
*/
async indexAll(options: IndexOptions = {}): Promise<IndexResult> {
return this.indexMutex.withLock(async () => {
const locked = await this.fileLock.acquire();
if (!locked) {
try {
this.fileLock.acquire();
} catch {
return { success: false, filesIndexed: 0, filesSkipped: 0, nodesCreated: 0, edgesCreated: 0, errors: [{ message: 'Could not acquire file lock - another process may be indexing', severity: 'error' as const }], durationMs: 0 };
}
try {
@@ -416,8 +419,9 @@ export class CodeGraph {
*/
async indexFiles(filePaths: string[]): Promise<IndexResult> {
return this.indexMutex.withLock(async () => {
const locked = await this.fileLock.acquire();
if (!locked) {
try {
this.fileLock.acquire();
} catch {
return { success: false, filesIndexed: 0, filesSkipped: 0, nodesCreated: 0, edgesCreated: 0, errors: [{ message: 'Could not acquire file lock - another process may be indexing', severity: 'error' as const }], durationMs: 0 };
}
try {
@@ -435,8 +439,9 @@ export class CodeGraph {
*/
async sync(options: IndexOptions = {}): Promise<SyncResult> {
return this.indexMutex.withLock(async () => {
const locked = await this.fileLock.acquire();
if (!locked) {
try {
this.fileLock.acquire();
} catch {
return { filesChecked: 0, filesAdded: 0, filesModified: 0, filesRemoved: 0, nodesUpdated: 0, durationMs: 0 };
}
try {
src/installer/config-writer.ts
+44 -17
View File
@@ -46,29 +46,55 @@ function getSettingsJsonPath(location: InstallLocation): string {
}
/**
* Read a JSON file, returning an empty object if it doesn't exist
* Read a JSON file, returning an empty object if it doesn't exist.
* Distinguishes between missing files (returns {}) and corrupted
* files (logs warning, returns {}).
*/
function readJsonFile(filePath: string): Record<string, any> {
if (!fs.existsSync(filePath)) {
return {};
}
try {
if (fs.existsSync(filePath)) {
const content = fs.readFileSync(filePath, 'utf-8');
return JSON.parse(content);
}
} catch {
// Ignore parse errors, return empty object
}
} catch (err) {
const msg = err instanceof Error ? err.message : String(err);
console.warn(` Warning: Could not parse ${path.basename(filePath)}: ${msg}`);
console.warn(` A backup will be created before overwriting.`);
// Create a backup of the corrupted file
try {
const backupPath = filePath + '.backup';
fs.copyFileSync(filePath, backupPath);
} catch { /* ignore backup failure */ }
return {};
}
}
/**
* Write a file atomically by writing to a temp file then renaming.
* Prevents corruption if the process crashes mid-write.
*/
function atomicWriteFileSync(filePath: string, content: string): void {
const dir = path.dirname(filePath);
if (!fs.existsSync(dir)) {
fs.mkdirSync(dir, { recursive: true });
}
const tmpPath = filePath + '.tmp.' + process.pid;
try {
fs.writeFileSync(tmpPath, content);
fs.renameSync(tmpPath, filePath);
} catch (err) {
// Clean up temp file on failure
try { fs.unlinkSync(tmpPath); } catch { /* ignore */ }
throw err;
}
}
/**
* Write a JSON file, creating parent directories if needed
*/
function writeJsonFile(filePath: string, data: Record<string, any>): void {
const dir = path.dirname(filePath);
if (!fs.existsSync(dir)) {
fs.mkdirSync(dir, { recursive: true });
}
fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n');
atomicWriteFileSync(filePath, JSON.stringify(data, null, 2) + '\n');
}
/**
@@ -306,7 +332,7 @@ export function writeClaudeMd(location: InstallLocation): { created: boolean; up
// Check if file exists
if (!fs.existsSync(claudeMdPath)) {
// Create new file with just the CodeGraph section
fs.writeFileSync(claudeMdPath, CLAUDE_MD_TEMPLATE + '\n');
atomicWriteFileSync(claudeMdPath, CLAUDE_MD_TEMPLATE + '\n');
return { created: true, updated: false };
}
@@ -324,7 +350,7 @@ export function writeClaudeMd(location: InstallLocation): { created: boolean; up
const before = content.substring(0, startIdx);
const after = content.substring(endIdx + CODEGRAPH_SECTION_END.length);
content = before + CLAUDE_MD_TEMPLATE + after;
fs.writeFileSync(claudeMdPath, content);
atomicWriteFileSync(claudeMdPath, content);
return { created: false, updated: true };
}
}
@@ -334,10 +360,11 @@ export function writeClaudeMd(location: InstallLocation): { created: boolean; up
const match = content.match(codegraphHeaderRegex);
if (match && match.index !== undefined) {
// Find the end of the CodeGraph section (next ## header or end of file)
// Find the end of the CodeGraph section (next h2 header or end of file)
// Use negative lookahead (?!#) to match "## X" but not "### X"
const sectionStart = match.index;
const afterSection = content.substring(sectionStart + 1);
const nextHeaderMatch = afterSection.match(/\n## [^#]/);
const nextHeaderMatch = afterSection.match(/\n## (?!#)/);
let sectionEnd: number;
if (nextHeaderMatch && nextHeaderMatch.index !== undefined) {
@@ -350,12 +377,12 @@ export function writeClaudeMd(location: InstallLocation): { created: boolean; up
const before = content.substring(0, sectionStart);
const after = content.substring(sectionEnd);
content = before + '\n' + CLAUDE_MD_TEMPLATE + after;
fs.writeFileSync(claudeMdPath, content);
atomicWriteFileSync(claudeMdPath, content);
return { created: false, updated: true };
}
// No existing section, append to end
content = content.trimEnd() + '\n\n' + CLAUDE_MD_TEMPLATE + '\n';
fs.writeFileSync(claudeMdPath, content);
atomicWriteFileSync(claudeMdPath, content);
return { created: false, updated: false };
}
src/mcp/tools.ts
+30 -7
View File
@@ -331,6 +331,16 @@ export class ToolHandler {
this.projectCache.clear();
}
/**
* Validate that a value is a non-empty string
*/
private validateString(value: unknown, name: string): string | ToolResult {
if (typeof value !== 'string' || value.length === 0) {
return this.errorResult(`${name} must be a non-empty string`);
}
return value;
}
/**
* Execute a tool by name
*/
@@ -366,10 +376,13 @@ export class ToolHandler {
* Handle codegraph_search
*/
private async handleSearch(args: Record<string, unknown>): Promise<ToolResult> {
const query = this.validateString(args.query, 'query');
if (typeof query !== 'string') return query;
const cg = this.getCodeGraph(args.projectPath as string | undefined);
const query = args.query as string;
const kind = args.kind as string | undefined;
const limit = clamp((args.limit as number) || 10, 1, 100);
const rawLimit = Number(args.limit) || 10;
const limit = clamp(rawLimit, 1, 100);
const results = cg.searchNodes(query, {
limit,
@@ -388,6 +401,9 @@ export class ToolHandler {
* Handle codegraph_context
*/
private async handleContext(args: Record<string, unknown>): Promise<ToolResult> {
const task = this.validateString(args.task, 'task');
if (typeof task !== 'string') return task;
// Mark session as consulted (enables Grep/Glob/Bash)
const sessionId = process.env.CLAUDE_SESSION_ID;
if (sessionId) {
@@ -395,7 +411,6 @@ export class ToolHandler {
}
const cg = this.getCodeGraph(args.projectPath as string | undefined);
const task = args.task as string;
const maxNodes = (args.maxNodes as number) || 20;
const includeCode = args.includeCode !== false;
@@ -452,8 +467,10 @@ export class ToolHandler {
* Handle codegraph_callers
*/
private async handleCallers(args: Record<string, unknown>): Promise<ToolResult> {
const symbol = this.validateString(args.symbol, 'symbol');
if (typeof symbol !== 'string') return symbol;
const cg = this.getCodeGraph(args.projectPath as string | undefined);
const symbol = args.symbol as string;
const limit = clamp((args.limit as number) || 20, 1, 100);
const match = this.findSymbol(cg, symbol);
@@ -476,8 +493,10 @@ export class ToolHandler {
* Handle codegraph_callees
*/
private async handleCallees(args: Record<string, unknown>): Promise<ToolResult> {
const symbol = this.validateString(args.symbol, 'symbol');
if (typeof symbol !== 'string') return symbol;
const cg = this.getCodeGraph(args.projectPath as string | undefined);
const symbol = args.symbol as string;
const limit = clamp((args.limit as number) || 20, 1, 100);
const match = this.findSymbol(cg, symbol);
@@ -500,8 +519,10 @@ export class ToolHandler {
* Handle codegraph_impact
*/
private async handleImpact(args: Record<string, unknown>): Promise<ToolResult> {
const symbol = this.validateString(args.symbol, 'symbol');
if (typeof symbol !== 'string') return symbol;
const cg = this.getCodeGraph(args.projectPath as string | undefined);
const symbol = args.symbol as string;
const depth = clamp((args.depth as number) || 2, 1, 10);
const match = this.findSymbol(cg, symbol);
@@ -519,8 +540,10 @@ export class ToolHandler {
* Handle codegraph_node
*/
private async handleNode(args: Record<string, unknown>): Promise<ToolResult> {
const symbol = this.validateString(args.symbol, 'symbol');
if (typeof symbol !== 'string') return symbol;
const cg = this.getCodeGraph(args.projectPath as string | undefined);
const symbol = args.symbol as string;
// Default to false to minimize context usage
const includeCode = args.includeCode === true;
src/utils.ts
+178 -36
View File
@@ -29,13 +29,23 @@
* ```
*/
import * as path from 'path';
import * as fs from 'fs';
import * as path from 'path';
// ============================================================
// SECURITY UTILITIES
// ============================================================
/**
* Sensitive system directories that should never be used as project roots.
* Checked on all platforms; non-applicable paths are harmlessly skipped.
*/
const SENSITIVE_PATHS = new Set([
'/', '/etc', '/usr', '/bin', '/sbin', '/var', '/tmp', '/dev', '/proc', '/sys',
'/root', '/boot', '/lib', '/lib64', '/opt',
'C:\\', 'C:\\Windows', 'C:\\Windows\\System32',
]);
/**
* Validate that a resolved file path stays within the project root.
* Prevents path traversal attacks (e.g. node.filePath = "../../etc/passwd").
@@ -54,6 +64,88 @@ export function validatePathWithinRoot(projectRoot: string, filePath: string): s
return resolved;
}
/**
* Validate that a path is a safe project root directory.
*
* Rejects sensitive system directories and ensures the path is
* a real, existing directory. Used at MCP and API entry points
* to prevent arbitrary directory access.
*
* @param dirPath - The path to validate
* @returns An error message if invalid, or null if valid
*/
export function validateProjectPath(dirPath: string): string | null {
const resolved = path.resolve(dirPath);
// Block sensitive system directories
if (SENSITIVE_PATHS.has(resolved) || SENSITIVE_PATHS.has(resolved.toLowerCase())) {
return `Refusing to operate on sensitive system directory: ${resolved}`;
}
// Also block common sensitive home subdirectories
const homeDir = require('os').homedir();
const sensitiveHomeDirs = ['.ssh', '.gnupg', '.aws', '.config'];
for (const dir of sensitiveHomeDirs) {
const sensitivePath = path.join(homeDir, dir);
if (resolved === sensitivePath || resolved.startsWith(sensitivePath + path.sep)) {
return `Refusing to operate on sensitive directory: ${resolved}`;
}
}
// Verify it's a real directory
try {
const stats = fs.statSync(resolved);
if (!stats.isDirectory()) {
return `Path is not a directory: ${resolved}`;
}
} catch {
return `Path does not exist or is not accessible: ${resolved}`;
}
return null;
}
/**
* Check if a file path resolves to a location within the given root directory.
*
* Prevents path traversal attacks by ensuring the resolved absolute path
* starts with the resolved root path. Handles '..' sequences, symlink-like
* relative paths, and platform-specific separators.
*
* @param filePath - The path to check (can be relative or absolute)
* @param rootDir - The root directory that filePath must stay within
* @returns true if filePath resolves to a location within rootDir
*/
export function isPathWithinRoot(filePath: string, rootDir: string): boolean {
const resolvedPath = path.resolve(rootDir, filePath);
const resolvedRoot = path.resolve(rootDir);
return resolvedPath.startsWith(resolvedRoot + path.sep) || resolvedPath === resolvedRoot;
}
/**
* Like isPathWithinRoot but also resolves symlinks via fs.realpathSync.
*
* This catches symlink escapes where the logical path appears to be within
* root but the real path on disk points elsewhere. Falls back to logical
* path checking if realpath resolution fails (e.g. broken symlink).
*/
export function isPathWithinRootReal(filePath: string, rootDir: string): boolean {
// First do the cheap logical check
if (!isPathWithinRoot(filePath, rootDir)) {
return false;
}
// Then verify with realpath to catch symlink escapes
try {
const realPath = fs.realpathSync(path.resolve(rootDir, filePath));
const realRoot = fs.realpathSync(rootDir);
return realPath.startsWith(realRoot + path.sep) || realPath === realRoot;
} catch {
// If realpath fails (broken symlink, permissions), fall back to logical check
return true;
}
}
/**
* Safely parse JSON with a fallback value.
* Prevents crashes from corrupted database metadata.
@@ -75,63 +167,113 @@ export function clamp(value: number, min: number, max: number): number {
}
/**
* Cross-process file lock using lock files.
* Prevents concurrent database writes from CLI, MCP server, and git hooks.
* Cross-process file lock using a lock file with PID tracking.
*
* Prevents multiple processes (e.g., git hooks, CLI, MCP server) from
* writing to the same database simultaneously.
*/
export class FileLock {
private lockPath: string;
private acquired = false;
private held = false;
constructor(resourcePath: string) {
this.lockPath = resourcePath + '.lock';
constructor(lockPath: string) {
this.lockPath = lockPath;
}
/**
* Acquire the file lock. Waits up to timeoutMs for the lock.
* Cleans up stale locks older than staleLockMs.
* Acquire the lock. Throws if the lock is held by another live process.
*/
async acquire(timeoutMs: number = 10000, staleLockMs: number = 30000): Promise<boolean> {
const start = Date.now();
acquire(): void {
// Check for existing lock
if (fs.existsSync(this.lockPath)) {
try {
const content = fs.readFileSync(this.lockPath, 'utf-8').trim();
const pid = parseInt(content, 10);
while (Date.now() - start < timeoutMs) {
try {
// Try to create lock file exclusively
fs.writeFileSync(this.lockPath, String(process.pid), { flag: 'wx' });
this.acquired = true;
return true;
} catch {
// Lock file exists - check if stale
try {
const stat = fs.statSync(this.lockPath);
if (Date.now() - stat.mtimeMs > staleLockMs) {
// Stale lock - remove and retry
if (!isNaN(pid) && this.isProcessAlive(pid)) {
throw new Error(
`CodeGraph database is locked by another process (PID ${pid}). ` +
`If this is stale, delete ${this.lockPath}`
);
}
// Stale lock - remove it
fs.unlinkSync(this.lockPath);
continue;
} catch (err) {
if (err instanceof Error && err.message.includes('locked by another')) {
throw err;
}
} catch {
// Lock file disappeared between check and stat - retry
continue;
}
// Wait and retry
await new Promise(resolve => setTimeout(resolve, 100));
// Other errors reading lock file - try to remove it
try { fs.unlinkSync(this.lockPath); } catch { /* ignore */ }
}
}
return false;
// Write our PID to the lock file using exclusive create flag
try {
fs.writeFileSync(this.lockPath, String(process.pid), { flag: 'wx' });
this.held = true;
} catch (err: any) {
if (err.code === 'EEXIST') {
// Race condition: another process grabbed the lock between our check and write
throw new Error(
'CodeGraph database is locked by another process. ' +
`If this is stale, delete ${this.lockPath}`
);
}
throw err;
}
}
/**
* Release the file lock
* Release the lock
*/
release(): void {
if (this.acquired) {
if (!this.held) return;
try {
// Only remove if we still own it (check PID)
const content = fs.readFileSync(this.lockPath, 'utf-8').trim();
if (parseInt(content, 10) === process.pid) {
fs.unlinkSync(this.lockPath);
} catch {
// Lock file already removed - that's fine
}
this.acquired = false;
} catch {
// Lock file already gone - that's fine
}
this.held = false;
}
/**
* Execute a function while holding the lock
*/
withLock<T>(fn: () => T): T {
this.acquire();
try {
return fn();
} finally {
this.release();
}
}
/**
* Execute an async function while holding the lock
*/
async withLockAsync<T>(fn: () => Promise<T>): Promise<T> {
this.acquire();
try {
return await fn();
} finally {
this.release();
}
}
/**
* Check if a process is still running
*/
private isProcessAlive(pid: number): boolean {
try {
process.kill(pid, 0);
return true;
} catch {
return false;
}
}
}