Skip to content

v1.0.4 - Security Hardening

Choose a tag to compare

View all tags
@TharanaBope TharanaBope released this 23 Apr 08:13
v1.0.4
9d80105
This commit was signed with the committer’s verified signature.
TharanaBope Tharana Navithaka Bopearachchi
GPG key ID: 0EE039297C891041
Verified
Learn about vigilant mode.

Security fixes

  • SQL injection: Replaced string-interpolated query parameters with parameterized queries across all schema,
    search, and relationship tools
  • Read-only bypass: Expanded blocklist to include SP_EXECUTESQL, OPENROWSET, OPENQUERY, WAITFOR, BULK,
    OPENDATASOURCE; added multi-statement semicolon check
  • Database allowlist: Now default-deny when SQL_ALLOWED_DATABASES is not configured
  • Input validation: Zod schema enforcement on all 12 tool inputs
  • Dependency: Upgraded @modelcontextprotocol/sdk to patch CVEs GHSA-8r9q-7v3j-jr4g, GHSA-345p-7cg4-v4c7,
    GHSA-w48q-cv73-mx4w
  • Bug fix: Fixed LIST_TABLES SQL syntax error (reserved word conflict with rowCount)

NPM Packages

Assets 2
Loading