Skip to content

v0.4.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Sep 13:06
v0.4.2
This tag was signed with the committer’s verified signature.
sknr Stephan Knauer
SSH Key Fingerprint: dG8YAu7mgXjucmJVpCx3dsUmCkCHbrHvaCQwgAkb+Ps
Verified
Learn about vigilant mode.
9413d77
This commit was signed with the committer’s verified signature.
sknr Stephan Knauer
SSH Key Fingerprint: dG8YAu7mgXjucmJVpCx3dsUmCkCHbrHvaCQwgAkb+Ps
Verified
Learn about vigilant mode.

Release v0.4.2 – MCP Security Hardening, Boundary Integrity & ReDoS/OOM Protection

Release v0.4.2 delivers comprehensive security and robustness hardening across the Model Context Protocol (MCP) server, input validation layers, path resolution boundaries, and concept mutation storage. It prevents in-memory cache corruption, protects against stream-based OOM denial-of-service, neutralizes Unicode homoglyph/BiDi spoofing, eliminates Markdown frontmatter smuggling, and enforces directory nesting bounds.

1. MCP Input Bounds & DoS Hardening (#32, #33)

  • Argument Length Constraints (getStringArg): Enforced byte length caps across all MCP tool calls:
    • 1,000 bytes for concept_id, type, title, description, source_id, target_id, and bundle paths.
    • 10,000 bytes for okf_search query strings.
    • 1,048,576 bytes (1 MB) for Markdown body payloads.
  • Search Limit Capping: Bounded the limit parameter in okf_search to a maximum of 100 results (limit <= 100).
  • Stdin Stream OOM Defense (readBoundedLine): Implemented a bounded line reader (maxMCPLineLength = 4MB) in RunMCPServerIO. Unbounded streams without newline characters are safely truncated and rejected with JSON-RPC error -32700, preserving connection synchronization without out-of-memory crashes.

2. Cache Integrity & Non-Empty Title Enforcement

  • Copy-on-Write Mutation: okf_update now operates on a copy of the concept (updated := *c), only committing updates to the in-memory cache upon successful disk persistence. Failed validations or disk writes can no longer leave the in-memory cache desynchronized or corrupted.
  • Empty Title Prevention: Upfront validation rejects empty or whitespace-only titles in both okf_create and okf_update (strings.TrimSpace(title) == "").
  • Tool Schema Alignment: Added "minLength": 1 to title properties in embedded cmd/okf/schemas/tools.json.

3. Unicode Homoglyph, BiDi & Dotfile Protection

  • Format & Invisible Character Blocking: ValidateConceptID strictly rejects zero-width spaces (\u200B), zero-width joiners (\u200C, \u200D), zero-width non-breaking spaces / BOM (\uFEFF), and general Unicode format control characters (unicode.Cf).
  • BiDi Override Prevention (Trojan Source): Rejected bidirectional override and embedding characters (\u202A–\u202E, \u2066–\u2069) preventing visual spoofing of file paths in terminals and UIs.
  • International Character Support: Preserved 100% compatibility for legitimate international alphabets (Cyrillic, Chinese, Kanji, German Umlauts, etc.) via unicode.IsPrint.
  • Hidden Dotfile Rejection: Concept IDs cannot target hidden directories or dotfiles (.git, .env, .secret).
  • Directory Depth Limit: Enforced MaxConceptDirectoryDepth = 8 to prevent deep filesystem nesting and inode exhaustion attacks.

4. Frontmatter Smuggling Defense

  • Nested Frontmatter Detection: sanitizeConceptMetadata scans Markdown body content to detect and reject embedded --- blocks containing reserved frontmatter keys (verified:, governance:, generated:, type:, status:), eliminating privilege escalation and forged human verification tags. Standard Markdown horizontal rules (<hr>) remain fully supported.

5. Cross-Platform Path Traversal Hardening

  • POSIX Backslash Sanitization: Replaced filepath.ToSlash with universal strings.ReplaceAll(path, "\\", "/") across validator, search, bundle resolution, and mutation to prevent Windows-style backslash traversal vectors on POSIX operating systems.

Full Changelog

See commits between v0.4.1...v0.4.2 on GitHub.

Assets 12
Loading