feat: add security hardening for ReDoS, path traversal, and SSRF
- Add input-validation.ts with regex, path, and URL validation utilities - Validate regex patterns before RegExp creation to prevent ReDoS - Block dangerous nested quantifiers (a+)+, (a*)+, etc. - Prevent path traversal with directory escape detection - Block localhost, private IPs, and non-http/https protocols for SSRF - Add SecurityOptions for configurable validation (allowPrivateIPs, etc.) - Include 33 security tests (unit + integration) Fixes #362 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
rimskij
parent
df0143ddcc
commit
d7f354b37d
7 changed files with 1031 additions and 7 deletions
185
docs/implementations/security-hardening-implementation.md
Normal file
185
docs/implementations/security-hardening-implementation.md
Normal file
|
|
@ -0,0 +1,185 @@
|
|||
# Security Hardening Implementation
|
||||
|
||||
**Date**: 2026-01-12
|
||||
**OpenProject**: [#362](https://pm.hyperlocalplatform.com/work_packages/362)
|
||||
**Branch**: `feature/362-security-hardening`
|
||||
**Status**: Complete
|
||||
|
||||
## Related Documents
|
||||
- Task: `docs/tasks/security-hardening-task.md`
|
||||
|
||||
## Summary
|
||||
|
||||
Implemented security hardening to address three pre-existing vulnerabilities identified in the security audit:
|
||||
|
||||
1. **ReDoS (Regular Expression Denial of Service)** - Malicious regex patterns could cause exponential backtracking
|
||||
2. **Path Traversal** - Malicious file paths could escape intended directories
|
||||
3. **SSRF (Server-Side Request Forgery)** - Malicious URLs could access internal resources
|
||||
|
||||
## Files Modified
|
||||
|
||||
### New Files
|
||||
| File | Purpose |
|
||||
|------|---------|
|
||||
| `src/lib/input-validation.ts` | Centralized input validation utilities |
|
||||
| `scripts/self-testing/security-test.ts` | 25 security unit tests |
|
||||
| `scripts/self-testing/mcp-integration-test.ts` | 8 MCP integration tests |
|
||||
|
||||
### Modified Files
|
||||
| File | Changes |
|
||||
|------|---------|
|
||||
| `src/tools/query.ts` | Added regex validation before `new RegExp()`, import `createSafeRegex` |
|
||||
| `src/lib/parser.ts` | Added `validateSpecPath()` call, security options in `ParseOptions` |
|
||||
|
||||
## Implementation Details
|
||||
|
||||
### ReDoS Protection
|
||||
- Validates regex patterns before creating `RegExp` objects
|
||||
- Blocks patterns with:
|
||||
- Nested quantifiers: `(a+)+`, `(a*)+`, etc.
|
||||
- Excessive length (>500 chars)
|
||||
- Deep nesting (>10 levels)
|
||||
- Lookahead/lookbehind patterns
|
||||
|
||||
```typescript
|
||||
// In query.ts - validation before use
|
||||
if (args.pathPattern) {
|
||||
const regexValidation = validateRegexPattern(args.pathPattern);
|
||||
if (!regexValidation.valid) {
|
||||
return errorResponse(regexValidation.error, 'validating path pattern');
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Path Traversal Prevention
|
||||
- Validates file paths stay within allowed base directories
|
||||
- Detects traversal patterns: `../`, URL-encoded (`%2e%2e`), double-encoded
|
||||
- Uses cross-platform path separator (`path.sep`)
|
||||
|
||||
```typescript
|
||||
// Uses resolve() and startsWith() check
|
||||
const resolvedPath = resolve(normalize(filePath));
|
||||
const isWithinAllowed = allowedBaseDirs.some(baseDir => {
|
||||
const resolvedBase = resolve(baseDir);
|
||||
return resolvedPath.startsWith(resolvedBase + sep) || resolvedPath === resolvedBase;
|
||||
});
|
||||
```
|
||||
|
||||
### SSRF Protection
|
||||
- Validates URL protocol (http/https only)
|
||||
- Blocks localhost and loopback IPs
|
||||
- Blocks private IP ranges (10.x, 172.16-31.x, 192.168.x)
|
||||
- Blocks link-local addresses (169.254.x)
|
||||
- Configurable via `allowPrivateIPs` option
|
||||
|
||||
```typescript
|
||||
// Blocked hostnames and IP patterns
|
||||
const BLOCKED_HOSTNAMES = ['localhost', '127.0.0.1', '::1', '0.0.0.0'];
|
||||
const PRIVATE_IP_PATTERNS = [
|
||||
/^127\./, /^10\./, /^172\.(1[6-9]|2[0-9]|3[0-1])\./, /^192\.168\./
|
||||
];
|
||||
```
|
||||
|
||||
## Security Options
|
||||
|
||||
New `SecurityOptions` interface for configurable security:
|
||||
|
||||
```typescript
|
||||
interface SecurityOptions {
|
||||
allowPrivateIPs?: boolean; // Allow internal IPs (default: false)
|
||||
allowedBaseDirs?: string[]; // Allowed file directories
|
||||
skipUrlValidation?: boolean; // Skip URL validation for trusted sources
|
||||
}
|
||||
|
||||
// Usage
|
||||
await parseSpec('spec.yaml', {
|
||||
security: { allowPrivateIPs: true }
|
||||
});
|
||||
```
|
||||
|
||||
## Test Results
|
||||
|
||||
### Security Unit Tests (25 tests)
|
||||
```
|
||||
✅ Rejects nested quantifier pattern (a+)+
|
||||
✅ Rejects nested quantifier pattern (a*)+
|
||||
✅ Rejects nested quantifier pattern ([a-zA-Z]+)*
|
||||
✅ Rejects overly long regex patterns
|
||||
✅ Allows safe regex patterns
|
||||
✅ createSafeRegex returns null for dangerous patterns
|
||||
✅ createSafeRegex returns RegExp for safe patterns
|
||||
✅ Rejects path with ../
|
||||
✅ Rejects path with encoded traversal %2e%2e
|
||||
✅ Rejects path with double encoded traversal
|
||||
✅ Allows paths within current directory
|
||||
✅ Allows absolute paths within cwd
|
||||
✅ Rejects localhost URLs
|
||||
✅ Rejects 127.0.0.1 URLs
|
||||
✅ Rejects private IP 10.x.x.x
|
||||
✅ Rejects private IP 172.16.x.x
|
||||
✅ Rejects private IP 192.168.x.x
|
||||
✅ Rejects file:// protocol
|
||||
✅ Rejects ftp:// protocol
|
||||
✅ Allows public HTTPS URLs
|
||||
✅ Allows public HTTP URLs
|
||||
✅ Allows private IPs when allowPrivateIPs is true
|
||||
✅ validateSpecPath correctly identifies URLs
|
||||
✅ validateSpecPath rejects dangerous URLs
|
||||
✅ validateSpecPath rejects path traversal
|
||||
```
|
||||
|
||||
### MCP Integration Tests (8 tests)
|
||||
```
|
||||
✅ query-endpoints rejects ReDoS pattern
|
||||
✅ query-endpoints accepts safe regex
|
||||
✅ parseSpec rejects path traversal
|
||||
✅ parseSpec rejects localhost URL
|
||||
✅ parseSpec rejects private IP
|
||||
✅ parseSpec rejects file:// protocol
|
||||
✅ parseSpec accepts valid local file
|
||||
✅ parseSpec allows private IP with allowPrivateIPs option
|
||||
```
|
||||
|
||||
## Known Limitations
|
||||
|
||||
Documented in code comments:
|
||||
|
||||
1. **DNS Rebinding**: Hostname validation checks the hostname string, not resolved IP. For full SSRF protection against DNS rebinding, additional measures would be needed.
|
||||
|
||||
2. **HTTP Redirects**: The swagger-parser library follows HTTP redirects. A malicious redirect could bypass URL validation.
|
||||
|
||||
For MCP server use cases (local CLI tool), these are acceptable limitations with reduced attack surface.
|
||||
|
||||
## Security Audit Summary
|
||||
|
||||
| Severity | Count | Status |
|
||||
|----------|-------|--------|
|
||||
| Critical | 0 | - |
|
||||
| High | 2 | Documented limitations (DNS rebinding, redirects) |
|
||||
| Medium | 3 | Low priority for CLI tool context |
|
||||
| Low | 4 | Backlog items |
|
||||
|
||||
## Rollback Instructions
|
||||
|
||||
To rollback these changes:
|
||||
|
||||
1. Revert the input-validation.ts file:
|
||||
```bash
|
||||
git checkout HEAD~1 -- src/lib/input-validation.ts
|
||||
```
|
||||
|
||||
2. Remove validation imports and calls from parser.ts and query.ts:
|
||||
```bash
|
||||
git checkout HEAD~1 -- src/lib/parser.ts src/tools/query.ts
|
||||
```
|
||||
|
||||
3. Rebuild:
|
||||
```bash
|
||||
npm run build
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
- OWASP ReDoS: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
|
||||
- OWASP Path Traversal: https://owasp.org/www-community/attacks/Path_Traversal
|
||||
- OWASP SSRF: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
|
||||
130
docs/tasks/archive/security-hardening-task.md
Normal file
130
docs/tasks/archive/security-hardening-task.md
Normal file
|
|
@ -0,0 +1,130 @@
|
|||
---
|
||||
openproject: 362
|
||||
base-branch: dev
|
||||
---
|
||||
# Task: Security Hardening - Address ReDoS, Path Traversal, and SSRF Vulnerabilities
|
||||
|
||||
## Related Documents
|
||||
- OpenProject: [#362](https://pm.hyperlocalplatform.com/work_packages/362)
|
||||
- Branch: `feature/362-security-hardening` (from `dev`)
|
||||
|
||||
## Priority
|
||||
HIGH
|
||||
|
||||
## Objective
|
||||
Address pre-existing security vulnerabilities identified in the security audit: ReDoS in pathPattern regex, path traversal in file system access, and SSRF in unrestricted URL fetching. These issues pose risks to users of the MCP server.
|
||||
|
||||
## Definition of Done
|
||||
- [x] ReDoS vulnerability mitigated with regex timeout/complexity limits
|
||||
- [x] Path traversal prevented with path validation
|
||||
- [x] SSRF mitigated with URL allowlist/blocklist support
|
||||
- [x] TypeScript compilation CLEAN
|
||||
- [x] Lint checks PASSED (no lint script configured)
|
||||
- [x] ALL tests passing (33 security tests)
|
||||
- [x] Manual verification completed
|
||||
- [x] PROOF PROVIDED (security test cases)
|
||||
|
||||
## Scope
|
||||
### IN SCOPE
|
||||
- ReDoS mitigation in `src/tools/query.ts` pathPattern handling
|
||||
- Path traversal prevention in `src/lib/parser.ts` file access
|
||||
- SSRF mitigation in URL fetching (remote spec loading)
|
||||
- Input validation utilities
|
||||
- Security-focused test cases
|
||||
|
||||
### OUT OF SCOPE
|
||||
- Authentication/authorization (MCP server runs locally)
|
||||
- Encryption at rest
|
||||
- Rate limiting (single-user CLI tool)
|
||||
- Audit logging
|
||||
|
||||
## Sub-Tasks
|
||||
|
||||
### Phase 1: ReDoS Mitigation
|
||||
#### 1.1 Add Regex Complexity Limits
|
||||
- **Details**: Implement regex validation before creating RegExp from user input. Either use a safe-regex library or implement timeout-based execution.
|
||||
- **Files**: `src/tools/query.ts`
|
||||
- **Testing**: Test with known ReDoS patterns (e.g., `(a+)+$` against `aaaaaaaaaaaaaaaaaaaaaaaaaaaa!`)
|
||||
|
||||
#### 1.2 Create Input Validation Utilities
|
||||
- **Details**: Create `src/lib/input-validation.ts` with reusable validation functions for regex patterns, file paths, and URLs.
|
||||
- **Files**: `src/lib/input-validation.ts` (new)
|
||||
- **Testing**: Unit tests for validation functions
|
||||
|
||||
### Phase 2: Path Traversal Prevention
|
||||
#### 2.1 Implement Path Validation
|
||||
- **Details**: Validate file paths to prevent directory traversal attacks (e.g., `../../../etc/passwd`). Resolve paths and ensure they don't escape intended directories.
|
||||
- **Files**: `src/lib/parser.ts`, `src/lib/input-validation.ts`
|
||||
- **Testing**: Test with path traversal payloads
|
||||
|
||||
#### 2.2 Add Configurable Base Directory (Optional)
|
||||
- **Details**: Allow configuration of allowed directories for spec file access. Default to current working directory.
|
||||
- **Files**: `src/lib/parser.ts`, `src/lib/input-validation.ts`
|
||||
- **Testing**: Test directory restrictions
|
||||
|
||||
### Phase 3: SSRF Mitigation
|
||||
#### 3.1 Implement URL Validation
|
||||
- **Details**: Validate URLs before fetching. Block internal/private IP ranges (10.x, 172.16-31.x, 192.168.x, localhost, 127.x). Consider allowlist for known spec hosts.
|
||||
- **Files**: `src/lib/parser.ts`, `src/lib/input-validation.ts`
|
||||
- **Testing**: Test with internal IP addresses and localhost URLs
|
||||
|
||||
#### 3.2 Add URL Protocol Restrictions
|
||||
- **Details**: Only allow `http://` and `https://` protocols. Block `file://`, `ftp://`, `data:`, etc.
|
||||
- **Files**: `src/lib/input-validation.ts`
|
||||
- **Testing**: Test with various URL protocols
|
||||
|
||||
## Files to Modify
|
||||
- `src/tools/query.ts`: Add regex validation before `new RegExp()`
|
||||
- `src/lib/parser.ts`: Add path and URL validation before spec loading
|
||||
- `src/lib/input-validation.ts` (new): Centralized input validation utilities
|
||||
- `src/lib/types.ts`: Add configuration types if needed
|
||||
|
||||
## Risks & Mitigations
|
||||
| Risk | Impact | Mitigation |
|
||||
|------|--------|------------|
|
||||
| Breaking legitimate regex patterns | MEDIUM | Test common valid patterns, provide clear error messages |
|
||||
| Blocking valid internal specs | MEDIUM | Make SSRF protection configurable, document bypass options |
|
||||
| Performance impact from validation | LOW | Keep validation lightweight, cache validation results |
|
||||
| Incomplete protection | HIGH | Follow OWASP guidelines, test with known attack payloads |
|
||||
|
||||
## Testing Strategy
|
||||
- Build: `npm run build` - must pass
|
||||
- Lint: `npm run lint` - must pass
|
||||
- Manual testing with attack payloads:
|
||||
- ReDoS: `(a+)+$`, `([a-zA-Z]+)*$` against long strings
|
||||
- Path traversal: `../../../etc/passwd`, `....//....//etc/passwd`
|
||||
- SSRF: `http://127.0.0.1/`, `http://localhost/`, `http://10.0.0.1/`
|
||||
- Verify legitimate use cases still work:
|
||||
- Local spec files (relative and absolute paths)
|
||||
- Remote HTTPS specs (public APIs)
|
||||
- Common regex patterns for path filtering
|
||||
|
||||
## Implementation Notes
|
||||
|
||||
### ReDoS Approach Options
|
||||
1. **safe-regex library**: Detect dangerous patterns before execution
|
||||
2. **Regex timeout**: Use `vm.runInNewContext` with timeout (complex)
|
||||
3. **Pattern restrictions**: Limit regex features (simpler but restrictive)
|
||||
|
||||
Recommended: Start with pattern validation + timeout fallback.
|
||||
|
||||
### Path Traversal Approach
|
||||
Use `path.resolve()` and verify the resolved path starts with the allowed base directory:
|
||||
```typescript
|
||||
const resolved = path.resolve(basePath, userPath);
|
||||
if (!resolved.startsWith(basePath)) {
|
||||
throw new Error('Path traversal detected');
|
||||
}
|
||||
```
|
||||
|
||||
### SSRF Approach
|
||||
1. Parse URL with `new URL()`
|
||||
2. Check protocol (allow only http/https)
|
||||
3. Resolve hostname to IP
|
||||
4. Check IP against private ranges blocklist
|
||||
5. Consider DNS rebinding protection (optional, advanced)
|
||||
|
||||
## References
|
||||
- OWASP ReDoS: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
|
||||
- OWASP Path Traversal: https://owasp.org/www-community/attacks/Path_Traversal
|
||||
- OWASP SSRF: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
|
||||
169
scripts/self-testing/mcp-integration-test.ts
Normal file
169
scripts/self-testing/mcp-integration-test.ts
Normal file
|
|
@ -0,0 +1,169 @@
|
|||
/**
|
||||
* MCP integration test for security features.
|
||||
* Tests that the actual tools properly reject dangerous inputs.
|
||||
*/
|
||||
|
||||
import { queryToolHandler } from '../../src/tools/query.js';
|
||||
import { parseSpec } from '../../src/lib/parser.js';
|
||||
|
||||
async function runTests() {
|
||||
console.log('\n=== MCP Integration Security Tests ===\n');
|
||||
let passed = 0;
|
||||
let failed = 0;
|
||||
|
||||
// Test 1: ReDoS protection in query-endpoints
|
||||
console.log('Test 1: query-endpoints rejects ReDoS pattern...');
|
||||
try {
|
||||
const result = await queryToolHandler({
|
||||
path: 'test/fixtures/petstore.yaml',
|
||||
pathPattern: '(a+)+$',
|
||||
});
|
||||
|
||||
const content = result.content[0];
|
||||
if (content.type === 'text' && content.text.includes('nested quantifiers')) {
|
||||
console.log(' ✅ ReDoS pattern rejected');
|
||||
passed++;
|
||||
} else {
|
||||
console.log(' ❌ ReDoS pattern NOT rejected');
|
||||
console.log(' Response:', JSON.stringify(result).substring(0, 200));
|
||||
failed++;
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(' ❌ Unexpected error:', (err as Error).message);
|
||||
failed++;
|
||||
}
|
||||
|
||||
// Test 2: Safe regex works
|
||||
console.log('Test 2: query-endpoints accepts safe regex...');
|
||||
try {
|
||||
const result = await queryToolHandler({
|
||||
path: 'test/fixtures/petstore.yaml',
|
||||
pathPattern: '/pets.*',
|
||||
});
|
||||
|
||||
const structured = result.structuredContent as { success: boolean };
|
||||
if (structured.success) {
|
||||
console.log(' ✅ Safe regex accepted');
|
||||
passed++;
|
||||
} else {
|
||||
console.log(' ❌ Safe regex rejected unexpectedly');
|
||||
failed++;
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(' ❌ Unexpected error:', (err as Error).message);
|
||||
failed++;
|
||||
}
|
||||
|
||||
// Test 3: Path traversal protection
|
||||
console.log('Test 3: parseSpec rejects path traversal...');
|
||||
try {
|
||||
await parseSpec('../../../etc/passwd');
|
||||
console.log(' ❌ Path traversal NOT blocked');
|
||||
failed++;
|
||||
} catch (err) {
|
||||
if ((err as Error).message.includes('traversal')) {
|
||||
console.log(' ✅ Path traversal blocked');
|
||||
passed++;
|
||||
} else {
|
||||
console.log(' ❌ Wrong error:', (err as Error).message);
|
||||
failed++;
|
||||
}
|
||||
}
|
||||
|
||||
// Test 4: SSRF protection - localhost
|
||||
console.log('Test 4: parseSpec rejects localhost URL...');
|
||||
try {
|
||||
await parseSpec('http://localhost/spec.json');
|
||||
console.log(' ❌ Localhost URL NOT blocked');
|
||||
failed++;
|
||||
} catch (err) {
|
||||
if ((err as Error).message.includes('blocked')) {
|
||||
console.log(' ✅ Localhost URL blocked');
|
||||
passed++;
|
||||
} else {
|
||||
console.log(' ❌ Wrong error:', (err as Error).message);
|
||||
failed++;
|
||||
}
|
||||
}
|
||||
|
||||
// Test 5: SSRF protection - private IP
|
||||
console.log('Test 5: parseSpec rejects private IP...');
|
||||
try {
|
||||
await parseSpec('http://192.168.1.1/spec.json');
|
||||
console.log(' ❌ Private IP NOT blocked');
|
||||
failed++;
|
||||
} catch (err) {
|
||||
if ((err as Error).message.includes('Private')) {
|
||||
console.log(' ✅ Private IP blocked');
|
||||
passed++;
|
||||
} else {
|
||||
console.log(' ❌ Wrong error:', (err as Error).message);
|
||||
failed++;
|
||||
}
|
||||
}
|
||||
|
||||
// Test 6: SSRF protection - file protocol
|
||||
console.log('Test 6: parseSpec rejects file:// protocol...');
|
||||
try {
|
||||
await parseSpec('file:///etc/passwd');
|
||||
console.log(' ❌ File protocol NOT blocked');
|
||||
failed++;
|
||||
} catch (err) {
|
||||
if ((err as Error).message.includes('Protocol')) {
|
||||
console.log(' ✅ File protocol blocked');
|
||||
passed++;
|
||||
} else {
|
||||
console.log(' ❌ Wrong error:', (err as Error).message);
|
||||
failed++;
|
||||
}
|
||||
}
|
||||
|
||||
// Test 7: Valid local file works
|
||||
console.log('Test 7: parseSpec accepts valid local file...');
|
||||
try {
|
||||
const result = await parseSpec('test/fixtures/petstore.yaml');
|
||||
if (result.metadata.title) {
|
||||
console.log(' ✅ Valid local file parsed');
|
||||
passed++;
|
||||
} else {
|
||||
console.log(' ❌ Parse succeeded but no title');
|
||||
failed++;
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(' ❌ Unexpected error:', (err as Error).message);
|
||||
failed++;
|
||||
}
|
||||
|
||||
// Test 8: Private IPs allowed with option
|
||||
console.log('Test 8: parseSpec allows private IP with allowPrivateIPs option...');
|
||||
try {
|
||||
await parseSpec('http://192.168.1.1/spec.json', {
|
||||
security: { allowPrivateIPs: true }
|
||||
});
|
||||
// This will fail to connect, but that's expected - the security check should pass
|
||||
console.log(' ❌ Should have thrown network error');
|
||||
failed++;
|
||||
} catch (err) {
|
||||
const msg = (err as Error).message;
|
||||
if (msg.includes('Private') || msg.includes('blocked')) {
|
||||
console.log(' ❌ Private IP still blocked despite option');
|
||||
failed++;
|
||||
} else {
|
||||
// Network error is expected (no server there)
|
||||
console.log(' ✅ Security check passed (network error expected)');
|
||||
passed++;
|
||||
}
|
||||
}
|
||||
|
||||
// Summary
|
||||
console.log('\n=== Summary ===');
|
||||
console.log(`Passed: ${passed}/${passed + failed}`);
|
||||
console.log(`Failed: ${failed}/${passed + failed}`);
|
||||
|
||||
if (failed > 0) {
|
||||
process.exit(1);
|
||||
}
|
||||
console.log('\n✅ All MCP integration security tests passed!\n');
|
||||
}
|
||||
|
||||
runTests().catch(console.error);
|
||||
206
scripts/self-testing/security-test.ts
Normal file
206
scripts/self-testing/security-test.ts
Normal file
|
|
@ -0,0 +1,206 @@
|
|||
/**
|
||||
* Security validation tests for swagger-tools.
|
||||
* Tests ReDoS, path traversal, and SSRF protection.
|
||||
*/
|
||||
|
||||
import {
|
||||
validateRegexPattern,
|
||||
createSafeRegex,
|
||||
validateFilePath,
|
||||
validateUrl,
|
||||
validateSpecPath,
|
||||
} from '../../src/lib/input-validation.js';
|
||||
|
||||
interface TestResult {
|
||||
name: string;
|
||||
passed: boolean;
|
||||
error?: string;
|
||||
}
|
||||
|
||||
const results: TestResult[] = [];
|
||||
|
||||
function test(name: string, fn: () => void): void {
|
||||
try {
|
||||
fn();
|
||||
results.push({ name, passed: true });
|
||||
console.log(`✅ ${name}`);
|
||||
} catch (err) {
|
||||
results.push({ name, passed: false, error: (err as Error).message });
|
||||
console.log(`❌ ${name}: ${(err as Error).message}`);
|
||||
}
|
||||
}
|
||||
|
||||
function assert(condition: boolean, message: string): void {
|
||||
if (!condition) {
|
||||
throw new Error(message);
|
||||
}
|
||||
}
|
||||
|
||||
console.log('\n=== ReDoS Protection Tests ===\n');
|
||||
|
||||
test('Rejects nested quantifier pattern (a+)+', () => {
|
||||
const result = validateRegexPattern('(a+)+$');
|
||||
assert(!result.valid, 'Should reject dangerous pattern');
|
||||
assert(result.error?.includes('nested quantifiers'), 'Should mention nested quantifiers');
|
||||
});
|
||||
|
||||
test('Rejects nested quantifier pattern (a*)+', () => {
|
||||
const result = validateRegexPattern('(a*)+');
|
||||
assert(!result.valid, 'Should reject dangerous pattern');
|
||||
});
|
||||
|
||||
test('Rejects nested quantifier pattern ([a-zA-Z]+)*', () => {
|
||||
const result = validateRegexPattern('([a-zA-Z]+)*$');
|
||||
assert(!result.valid, 'Should reject dangerous pattern');
|
||||
});
|
||||
|
||||
test('Rejects overly long regex patterns', () => {
|
||||
const longPattern = 'a'.repeat(501);
|
||||
const result = validateRegexPattern(longPattern);
|
||||
assert(!result.valid, 'Should reject long pattern');
|
||||
assert(result.error?.includes('maximum length'), 'Should mention length limit');
|
||||
});
|
||||
|
||||
test('Allows safe regex patterns', () => {
|
||||
const safePatterns = [
|
||||
'/users/.*',
|
||||
'/api/v[0-9]+/.*',
|
||||
'^/pets$',
|
||||
'/orders/[0-9]+$',
|
||||
];
|
||||
for (const pattern of safePatterns) {
|
||||
const result = validateRegexPattern(pattern);
|
||||
assert(result.valid, `Should allow safe pattern: ${pattern}`);
|
||||
}
|
||||
});
|
||||
|
||||
test('createSafeRegex returns null for dangerous patterns', () => {
|
||||
const regex = createSafeRegex('(a+)+$');
|
||||
assert(regex === null, 'Should return null for dangerous pattern');
|
||||
});
|
||||
|
||||
test('createSafeRegex returns RegExp for safe patterns', () => {
|
||||
const regex = createSafeRegex('/users/.*');
|
||||
assert(regex instanceof RegExp, 'Should return RegExp for safe pattern');
|
||||
assert(regex.test('/users/123'), 'Regex should work correctly');
|
||||
});
|
||||
|
||||
console.log('\n=== Path Traversal Protection Tests ===\n');
|
||||
|
||||
test('Rejects path with ../', () => {
|
||||
const result = validateFilePath('../../../etc/passwd');
|
||||
assert(!result.valid, 'Should reject traversal pattern');
|
||||
assert(result.error?.includes('traversal'), 'Should mention traversal');
|
||||
});
|
||||
|
||||
test('Rejects path with encoded traversal %2e%2e', () => {
|
||||
const result = validateFilePath('%2e%2e%2fetc/passwd');
|
||||
assert(!result.valid, 'Should reject encoded traversal');
|
||||
});
|
||||
|
||||
test('Rejects path with double encoded traversal', () => {
|
||||
const result = validateFilePath('%252e%252e%252fetc/passwd');
|
||||
assert(!result.valid, 'Should reject double encoded traversal');
|
||||
});
|
||||
|
||||
test('Allows paths within current directory', () => {
|
||||
const result = validateFilePath('./test/fixtures/petstore.yaml');
|
||||
assert(result.valid, 'Should allow relative path within cwd');
|
||||
});
|
||||
|
||||
test('Allows absolute paths within cwd', () => {
|
||||
const cwd = process.cwd();
|
||||
const result = validateFilePath(`${cwd}/test/fixtures/petstore.yaml`);
|
||||
assert(result.valid, 'Should allow absolute path within cwd');
|
||||
});
|
||||
|
||||
console.log('\n=== SSRF Protection Tests ===\n');
|
||||
|
||||
test('Rejects localhost URLs', () => {
|
||||
const result = validateUrl('http://localhost/api/spec.json');
|
||||
assert(!result.valid, 'Should reject localhost');
|
||||
assert(result.error?.includes('blocked'), 'Should indicate blocked');
|
||||
});
|
||||
|
||||
test('Rejects 127.0.0.1 URLs', () => {
|
||||
const result = validateUrl('http://127.0.0.1/api/spec.json');
|
||||
assert(!result.valid, 'Should reject loopback IP');
|
||||
});
|
||||
|
||||
test('Rejects private IP 10.x.x.x', () => {
|
||||
const result = validateUrl('http://10.0.0.1/api/spec.json');
|
||||
assert(!result.valid, 'Should reject private IP');
|
||||
assert(result.error?.includes('Private'), 'Should mention private IP');
|
||||
});
|
||||
|
||||
test('Rejects private IP 172.16.x.x', () => {
|
||||
const result = validateUrl('http://172.16.0.1/api/spec.json');
|
||||
assert(!result.valid, 'Should reject private IP');
|
||||
});
|
||||
|
||||
test('Rejects private IP 192.168.x.x', () => {
|
||||
const result = validateUrl('http://192.168.1.1/api/spec.json');
|
||||
assert(!result.valid, 'Should reject private IP');
|
||||
});
|
||||
|
||||
test('Rejects file:// protocol', () => {
|
||||
const result = validateUrl('file:///etc/passwd');
|
||||
assert(!result.valid, 'Should reject file protocol');
|
||||
assert(result.error?.includes('Protocol'), 'Should mention protocol');
|
||||
});
|
||||
|
||||
test('Rejects ftp:// protocol', () => {
|
||||
const result = validateUrl('ftp://example.com/spec.json');
|
||||
assert(!result.valid, 'Should reject ftp protocol');
|
||||
});
|
||||
|
||||
test('Allows public HTTPS URLs', () => {
|
||||
const result = validateUrl('https://petstore.swagger.io/v2/swagger.json');
|
||||
assert(result.valid, 'Should allow public HTTPS URL');
|
||||
});
|
||||
|
||||
test('Allows public HTTP URLs', () => {
|
||||
const result = validateUrl('http://api.example.com/spec.json');
|
||||
assert(result.valid, 'Should allow public HTTP URL');
|
||||
});
|
||||
|
||||
test('Allows private IPs when allowPrivateIPs is true', () => {
|
||||
const result = validateUrl('http://192.168.1.1/spec.json', { allowPrivateIPs: true });
|
||||
assert(result.valid, 'Should allow private IP with option');
|
||||
});
|
||||
|
||||
console.log('\n=== Spec Path Validation Tests ===\n');
|
||||
|
||||
test('validateSpecPath correctly identifies URLs', () => {
|
||||
const urlResult = validateSpecPath('https://example.com/spec.json');
|
||||
assert(urlResult.valid, 'Should validate URL correctly');
|
||||
|
||||
const localResult = validateSpecPath('./spec.yaml');
|
||||
assert(localResult.valid, 'Should validate local path correctly');
|
||||
});
|
||||
|
||||
test('validateSpecPath rejects dangerous URLs', () => {
|
||||
const result = validateSpecPath('http://localhost/internal/spec.json');
|
||||
assert(!result.valid, 'Should reject localhost URL');
|
||||
});
|
||||
|
||||
test('validateSpecPath rejects path traversal', () => {
|
||||
const result = validateSpecPath('../../../etc/passwd');
|
||||
assert(!result.valid, 'Should reject path traversal');
|
||||
});
|
||||
|
||||
// Summary
|
||||
console.log('\n=== Test Summary ===\n');
|
||||
const passed = results.filter(r => r.passed).length;
|
||||
const failed = results.filter(r => !r.passed).length;
|
||||
console.log(`Total: ${results.length}, Passed: ${passed}, Failed: ${failed}`);
|
||||
|
||||
if (failed > 0) {
|
||||
console.log('\nFailed tests:');
|
||||
results.filter(r => !r.passed).forEach(r => {
|
||||
console.log(` - ${r.name}: ${r.error}`);
|
||||
});
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
console.log('\n✅ All security tests passed!\n');
|
||||
310
src/lib/input-validation.ts
Normal file
310
src/lib/input-validation.ts
Normal file
|
|
@ -0,0 +1,310 @@
|
|||
/**
|
||||
* Input validation utilities for security hardening.
|
||||
* Provides protection against ReDoS, path traversal, and SSRF attacks.
|
||||
*/
|
||||
|
||||
import { resolve, normalize, sep } from 'path';
|
||||
|
||||
/** Maximum regex pattern length to prevent overly complex patterns */
|
||||
const MAX_REGEX_LENGTH = 500;
|
||||
|
||||
/** Maximum nesting depth for regex groups */
|
||||
const MAX_REGEX_NESTING = 10;
|
||||
|
||||
/** Characters that indicate potentially dangerous regex patterns */
|
||||
const DANGEROUS_REGEX_PATTERNS = [
|
||||
/\(\?[^:]/, // Lookahead/lookbehind (can be slow)
|
||||
/\([^)]*\+[^)]*\)\+/, // Nested quantifiers: (a+)+
|
||||
/\([^)]*\*[^)]*\)\+/, // Nested quantifiers: (a*)+
|
||||
/\([^)]*\+[^)]*\)\*/, // Nested quantifiers: (a+)*
|
||||
/\([^)]*\*[^)]*\)\*/, // Nested quantifiers: (a*)*
|
||||
/\([^)]*\{[^}]+\}[^)]*\)\+/, // Nested quantifiers with {n,m}
|
||||
/\([^)]*\{[^}]+\}[^)]*\)\*/, // Nested quantifiers with {n,m}
|
||||
];
|
||||
|
||||
/** Private IP ranges and localhost patterns for SSRF protection */
|
||||
const PRIVATE_IP_PATTERNS = [
|
||||
/^127\./, // Loopback
|
||||
/^10\./, // Class A private
|
||||
/^172\.(1[6-9]|2[0-9]|3[0-1])\./, // Class B private
|
||||
/^192\.168\./, // Class C private
|
||||
/^0\./, // Current network
|
||||
/^169\.254\./, // Link-local
|
||||
/^::1$/, // IPv6 loopback
|
||||
/^fc00:/i, // IPv6 unique local
|
||||
/^fe80:/i, // IPv6 link-local
|
||||
];
|
||||
|
||||
/** Allowed URL protocols for spec fetching */
|
||||
const ALLOWED_PROTOCOLS = ['http:', 'https:'];
|
||||
|
||||
/** Blocked hostnames for SSRF protection */
|
||||
const BLOCKED_HOSTNAMES = [
|
||||
'localhost',
|
||||
'localhost.localdomain',
|
||||
'127.0.0.1',
|
||||
'::1',
|
||||
'0.0.0.0',
|
||||
];
|
||||
|
||||
export interface ValidationResult {
|
||||
valid: boolean;
|
||||
error?: string;
|
||||
}
|
||||
|
||||
export interface SecurityOptions {
|
||||
/** Allow internal/private IP addresses (default: false) */
|
||||
allowPrivateIPs?: boolean;
|
||||
/** Custom allowed base directories for file access */
|
||||
allowedBaseDirs?: string[];
|
||||
/** Skip URL validation (for trusted sources) */
|
||||
skipUrlValidation?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates a regex pattern for ReDoS vulnerabilities.
|
||||
* Checks for excessive length, nesting depth, and known dangerous patterns.
|
||||
*/
|
||||
export function validateRegexPattern(pattern: string): ValidationResult {
|
||||
// Check length
|
||||
if (pattern.length > MAX_REGEX_LENGTH) {
|
||||
return {
|
||||
valid: false,
|
||||
error: `Regex pattern exceeds maximum length of ${MAX_REGEX_LENGTH} characters`,
|
||||
};
|
||||
}
|
||||
|
||||
// Check for dangerous patterns
|
||||
for (const dangerous of DANGEROUS_REGEX_PATTERNS) {
|
||||
if (dangerous.test(pattern)) {
|
||||
return {
|
||||
valid: false,
|
||||
error: 'Regex pattern contains potentially dangerous nested quantifiers',
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Check nesting depth
|
||||
const nestingDepth = countMaxNesting(pattern);
|
||||
if (nestingDepth > MAX_REGEX_NESTING) {
|
||||
return {
|
||||
valid: false,
|
||||
error: `Regex pattern exceeds maximum nesting depth of ${MAX_REGEX_NESTING}`,
|
||||
};
|
||||
}
|
||||
|
||||
// Try to compile the regex to catch syntax errors
|
||||
try {
|
||||
new RegExp(pattern);
|
||||
} catch {
|
||||
return {
|
||||
valid: false,
|
||||
error: 'Invalid regex pattern syntax',
|
||||
};
|
||||
}
|
||||
|
||||
return { valid: true };
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a safe RegExp from a pattern after validation.
|
||||
* Returns null if the pattern is unsafe or invalid.
|
||||
*/
|
||||
export function createSafeRegex(pattern: string): RegExp | null {
|
||||
const validation = validateRegexPattern(pattern);
|
||||
if (!validation.valid) {
|
||||
return null;
|
||||
}
|
||||
return new RegExp(pattern);
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates a file path to prevent directory traversal attacks.
|
||||
* Ensures the resolved path stays within allowed base directories.
|
||||
*/
|
||||
export function validateFilePath(
|
||||
filePath: string,
|
||||
options?: SecurityOptions
|
||||
): ValidationResult {
|
||||
// Default to current working directory if no base dirs specified
|
||||
const allowedBaseDirs = options?.allowedBaseDirs ?? [process.cwd()];
|
||||
|
||||
// Normalize and resolve the path
|
||||
const normalizedPath = normalize(filePath);
|
||||
const resolvedPath = resolve(normalizedPath);
|
||||
|
||||
// Check for common traversal patterns in the original path
|
||||
if (containsTraversalPatterns(filePath)) {
|
||||
return {
|
||||
valid: false,
|
||||
error: 'Path contains directory traversal patterns',
|
||||
};
|
||||
}
|
||||
|
||||
// Verify the resolved path is within an allowed base directory
|
||||
// Use path.sep for cross-platform compatibility (Windows uses \, Unix uses /)
|
||||
const isWithinAllowed = allowedBaseDirs.some(baseDir => {
|
||||
const resolvedBase = resolve(baseDir);
|
||||
return resolvedPath.startsWith(resolvedBase + sep) || resolvedPath === resolvedBase;
|
||||
});
|
||||
|
||||
if (!isWithinAllowed) {
|
||||
return {
|
||||
valid: false,
|
||||
error: 'Path is outside allowed directories',
|
||||
};
|
||||
}
|
||||
|
||||
return { valid: true };
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates a URL for SSRF vulnerabilities.
|
||||
* Checks protocol, hostname, and IP address ranges.
|
||||
*
|
||||
* Note: This validation checks the hostname string, not the resolved IP.
|
||||
* For full SSRF protection against DNS rebinding attacks, additional
|
||||
* measures like DNS pinning or resolved IP checking would be needed.
|
||||
* For MCP server use cases (local CLI tool), hostname-based blocking
|
||||
* provides reasonable protection against common SSRF vectors.
|
||||
*/
|
||||
export function validateUrl(
|
||||
urlString: string,
|
||||
options?: SecurityOptions
|
||||
): ValidationResult {
|
||||
if (options?.skipUrlValidation) {
|
||||
return { valid: true };
|
||||
}
|
||||
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(urlString);
|
||||
} catch {
|
||||
return {
|
||||
valid: false,
|
||||
error: 'Invalid URL format',
|
||||
};
|
||||
}
|
||||
|
||||
// Check protocol
|
||||
if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
|
||||
return {
|
||||
valid: false,
|
||||
error: `Protocol '${url.protocol}' is not allowed. Use http: or https:`,
|
||||
};
|
||||
}
|
||||
|
||||
// Check for blocked hostnames
|
||||
const hostname = url.hostname.toLowerCase();
|
||||
if (BLOCKED_HOSTNAMES.includes(hostname)) {
|
||||
if (!options?.allowPrivateIPs) {
|
||||
return {
|
||||
valid: false,
|
||||
error: `Hostname '${hostname}' is blocked for security reasons`,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Check for private IP addresses
|
||||
if (!options?.allowPrivateIPs && isPrivateIP(hostname)) {
|
||||
return {
|
||||
valid: false,
|
||||
error: 'Private and internal IP addresses are not allowed',
|
||||
};
|
||||
}
|
||||
|
||||
return { valid: true };
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines if a spec path is a URL or a local file path.
|
||||
* Checks for common URL schemes to ensure proper routing to URL validation.
|
||||
*/
|
||||
export function isUrl(specPath: string): boolean {
|
||||
// Check for common URL protocols (validated schemes handled separately)
|
||||
const urlSchemePattern = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
|
||||
return urlSchemePattern.test(specPath);
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates a spec path (either URL or file path).
|
||||
* Returns validation result with appropriate checks based on path type.
|
||||
*/
|
||||
export function validateSpecPath(
|
||||
specPath: string,
|
||||
options?: SecurityOptions
|
||||
): ValidationResult {
|
||||
if (isUrl(specPath)) {
|
||||
return validateUrl(specPath, options);
|
||||
}
|
||||
return validateFilePath(specPath, options);
|
||||
}
|
||||
|
||||
// ============ Helper Functions ============
|
||||
|
||||
/**
|
||||
* Counts maximum nesting depth of parentheses in a pattern.
|
||||
*/
|
||||
function countMaxNesting(pattern: string): number {
|
||||
let maxDepth = 0;
|
||||
let currentDepth = 0;
|
||||
let inCharClass = false;
|
||||
let escaped = false;
|
||||
|
||||
for (const char of pattern) {
|
||||
if (escaped) {
|
||||
escaped = false;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (char === '\\') {
|
||||
escaped = true;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (char === '[' && !inCharClass) {
|
||||
inCharClass = true;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (char === ']' && inCharClass) {
|
||||
inCharClass = false;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (inCharClass) continue;
|
||||
|
||||
if (char === '(') {
|
||||
currentDepth++;
|
||||
maxDepth = Math.max(maxDepth, currentDepth);
|
||||
} else if (char === ')') {
|
||||
currentDepth = Math.max(0, currentDepth - 1);
|
||||
}
|
||||
}
|
||||
|
||||
return maxDepth;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if a path contains common directory traversal patterns.
|
||||
*/
|
||||
function containsTraversalPatterns(path: string): boolean {
|
||||
const traversalPatterns = [
|
||||
/\.\.\//, // ../
|
||||
/\.\.\\/, // ..\
|
||||
/%2e%2e[\/\\]/i, // URL-encoded ../
|
||||
/%2e%2e%2f/i, // URL-encoded ../
|
||||
/%252e%252e/i, // Double URL-encoded
|
||||
/\.\.%2f/i, // Mixed encoding
|
||||
/\.\.%5c/i, // Mixed encoding with backslash
|
||||
];
|
||||
|
||||
return traversalPatterns.some(pattern => pattern.test(path));
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if a hostname or IP is in a private range.
|
||||
*/
|
||||
function isPrivateIP(hostnameOrIP: string): boolean {
|
||||
return PRIVATE_IP_PATTERNS.some(pattern => pattern.test(hostnameOrIP));
|
||||
}
|
||||
|
|
@ -5,10 +5,14 @@ import type { ParsedSpec, OpenAPISpec } from './types.js';
|
|||
import { specCache, getCacheKey } from './cache.js';
|
||||
import { getSchemaCount } from './schema-utils.js';
|
||||
import { isOpenAPIV3, isSwaggerV2, getSpecVersion as getVersion } from './spec-guards.js';
|
||||
import { validateSpecPath, isUrl } from './input-validation.js';
|
||||
import type { SecurityOptions } from './input-validation.js';
|
||||
|
||||
export interface ParseOptions {
|
||||
dereference?: boolean;
|
||||
noCache?: boolean;
|
||||
/** Security options for path/URL validation */
|
||||
security?: SecurityOptions;
|
||||
}
|
||||
|
||||
export interface ParseResult {
|
||||
|
|
@ -22,6 +26,12 @@ export async function parseSpec(specPath: string, options?: ParseOptions): Promi
|
|||
const shouldDereference = options?.dereference !== false;
|
||||
const useCache = options?.noCache !== true;
|
||||
|
||||
// Validate spec path for security (path traversal / SSRF protection)
|
||||
const validation = validateSpecPath(specPath, options?.security);
|
||||
if (!validation.valid) {
|
||||
throw new Error(`Security validation failed: ${validation.error}`);
|
||||
}
|
||||
|
||||
// Check cache first (unless noCache is set)
|
||||
if (useCache) {
|
||||
const cacheKey = getCacheKey(specPath);
|
||||
|
|
@ -62,7 +72,12 @@ export async function parseSpec(specPath: string, options?: ParseOptions): Promi
|
|||
return { spec, metadata, dereferenced, cached: false };
|
||||
}
|
||||
|
||||
export async function bundleSpec(specPath: string): Promise<OpenAPISpec> {
|
||||
export async function bundleSpec(specPath: string, options?: ParseOptions): Promise<OpenAPISpec> {
|
||||
// Validate spec path for security (path traversal / SSRF protection)
|
||||
const validation = validateSpecPath(specPath, options?.security);
|
||||
if (!validation.valid) {
|
||||
throw new Error(`Security validation failed: ${validation.error}`);
|
||||
}
|
||||
return SwaggerParser.bundle(specPath);
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@ import { parseSpec } from '../lib/parser.js';
|
|||
import { formatEndpoints } from '../utils/format.js';
|
||||
import { HTTP_METHODS } from '../lib/types.js';
|
||||
import { successResponse, errorResponse } from '../lib/tool-response.js';
|
||||
import { createSafeRegex, validateRegexPattern } from '../lib/input-validation.js';
|
||||
import type { ToolResponse } from '../lib/tool-response.js';
|
||||
import type { EndpointInfo, EndpointFilter, ParameterInfo, ResponseInfo } from '../lib/types.js';
|
||||
import type { OpenAPIV3 } from 'openapi-types';
|
||||
|
|
@ -29,6 +30,17 @@ export async function queryToolHandler(args: {
|
|||
noCache?: boolean;
|
||||
}): Promise<ToolResponse> {
|
||||
try {
|
||||
// Validate regex pattern before use (ReDoS protection)
|
||||
if (args.pathPattern) {
|
||||
const regexValidation = validateRegexPattern(args.pathPattern);
|
||||
if (!regexValidation.valid) {
|
||||
return errorResponse(
|
||||
regexValidation.error ?? 'Invalid path pattern',
|
||||
'validating path pattern'
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
const { spec } = await parseSpec(args.path, { noCache: args.noCache });
|
||||
|
||||
const filter: EndpointFilter = {
|
||||
|
|
@ -62,12 +74,9 @@ function extractEndpoints(spec: object, filter: EndpointFilter): EndpointInfo[]
|
|||
if (filter.method && method !== filter.method) continue;
|
||||
|
||||
if (filter.pathPattern) {
|
||||
try {
|
||||
const regex = new RegExp(filter.pathPattern);
|
||||
if (!regex.test(pathName)) continue;
|
||||
} catch {
|
||||
// Invalid regex, skip filter
|
||||
}
|
||||
// Use safe regex creation (already validated in handler)
|
||||
const regex = createSafeRegex(filter.pathPattern);
|
||||
if (regex && !regex.test(pathName)) continue;
|
||||
}
|
||||
|
||||
if (filter.tag && (!operation.tags || !operation.tags.includes(filter.tag))) continue;
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue