rimskij/swagger-tools
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions
14 commits 5 branches 4 tags 172 KiB
Commit graph

4 commits

Author SHA1 Message Date
rimskij
d7f354b37d feat: add security hardening for ReDoS, path traversal, and SSRF 
- Add input-validation.ts with regex, path, and URL validation utilities
- Validate regex patterns before RegExp creation to prevent ReDoS
- Block dangerous nested quantifiers (a+)+, (a*)+, etc.
- Prevent path traversal with directory escape detection
- Block localhost, private IPs, and non-http/https protocols for SSRF
- Add SecurityOptions for configurable validation (allowPrivateIPs, etc.)
- Include 33 security tests (unit + integration)

Fixes #362

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-12 18:20:26 +01:00
rimskij
70fada22d6 refactor: consolidate shared utilities and reduce code duplication 
- Extract HTTP_METHODS constant to types.ts (eliminates duplication in 3 files)
- Add DEFAULT_CACHE_MAX_SIZE and DEFAULT_CACHE_TTL_MINUTES constants to cache.ts
- Create schema-utils.ts with getSchemas, findSchema, getSchemaNames, getSchemaCount
- Create spec-guards.ts with isOpenAPIV3, isSwaggerV2, getSpecVersion type guards
- Create tool-response.ts with successResponse, errorResponse helpers
- Update all tool handlers to use response helpers (~50 lines reduced)
- Update parser.ts to use type guards for version detection

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-12 17:45:18 +01:00
rimskij
cae5f7fce1 feat: add in-memory LRU cache for parsed specs 
Add caching layer to improve performance when repeatedly accessing
the same OpenAPI specs:

- LRU cache with max 10 entries and 15-minute TTL
- Cache key includes mtime for local files (change detection)
- URL normalization for consistent remote spec caching
- noCache parameter on all tools to bypass cache
- Response includes cached:true/false indicator

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-12 17:09:21 +01:00
rimskij
cc789d3b32 feat: initial MCP server for OpenAPI/Swagger parsing 
- Parse and validate OpenAPI 3.x / Swagger 2.0 specs
- Query endpoints by method, path pattern, tag, operationId
- Get component schema details
- Generate TypeScript interfaces from schemas
- Support local files and remote URLs

Tools: parse-spec, validate-spec, query-endpoints, get-schema, generate-types

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-01-12 14:33:10 +01:00