2ad87b4c78
Some checks failed
Test / rust-fmt-check (pull_request) Successful in 1m30s
Test / frontend-typecheck (pull_request) Successful in 2m6s
Test / frontend-tests (pull_request) Successful in 2m6s
Test / rust-clippy (pull_request) Successful in 3m46s
PR Review Automation / review (pull_request) Successful in 4m45s
Test / rust-tests (pull_request) Failing after 5m12s
Add defense-in-depth security validation for stdio transport to reject environment variables that could be used for privilege escalation attacks. Blocks the following dangerous variables (case-insensitive): - LD_PRELOAD (Linux) - LD_LIBRARY_PATH (Linux) - DYLD_INSERT_LIBRARIES (macOS) - DYLD_LIBRARY_PATH (macOS) - DYLD_FRAMEWORK_PATH (macOS) - DYLD_FALLBACK_LIBRARY_PATH (macOS) These variables can inject malicious libraries into spawned processes and should never be user-configurable for MCP servers. Add comprehensive tests: - test_rejects_relative_path: Verify existing path validation - test_rejects_dangerous_env_vars: Test all blocked variables - test_rejects_dangerous_env_vars_case_insensitive: Verify lowercase variants blocked - test_allows_safe_env_vars: Verify legitimate vars (DEBUG, PATH, API_KEY) allowed All tests passing. |
||
|---|---|---|
| .. | ||
| .cargo | ||
| capabilities | ||
| gen/schemas | ||
| icons | ||
| resources/ollama | ||
| src | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| tauri.conf.json | ||