mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-11 09:25:35 +08:00
Code Analyzer
21c73b57f1
- str_util: add cbm_validate_project_name() — strict allowlist ([A-Za-z0-9._-], no leading dot, no '..', no path separators) so a project name can never escape the cache directory. - store/mcp/http_server: validate project names (fail-closed) before interpolating them into .db file paths (path-traversal hardening; defense-in-depth for the wrong-path class in #331). - store: fix use-after-free in the LIKE pool — like_pool_add() frees its argument when the pool is full, so capture pool_was_full before the add and skip the subsequent bind that would touch the freed pointer (two call sites). Also fix the find_edges_by_url_path LIKE pattern (stray double-percent) and add NULL guards to cbm_store_checkpoint / cbm_store_node_degree / cbm_store_restore_from. - mcp: emit "result": null when a JSON-RPC response would otherwise carry neither result nor error (2.0 compliance); bounds-check the project-name accumulator against truncation. - http_server: JSON-escape directory and parent names in the browse endpoint to prevent stored-XSS/JSON injection via crafted names. - cypher: expr_free now recurses on EXPR_FREE_STACK overflow instead of silently dropping subtrees (memory leak). Distilled from #352 onto current main (store.c like-pool hunk re-resolved against the v0.7.0 search refactor; restored cypher.c EOF newline).