github · mcp-serverHEAD

// Parse YAML

    let parsed: any;

    try {

        schema: yamlSchema,

        json: false,

        onWarning: (warning: any) => {

// Read file content

      const content = await this.fileOperations.readFile(filePath, { source: 'PortfolioIndexManager.createMemoryIndexEntry' });

      // Memory files are pure YAML without frontmatter markers, so we can't use SecureYamlParser

      // (which is designed for Markdown files with YAML frontmatter between --- markers)

      // Using FAILSAFE_SCHEMA for security (same as MemoryManager uses)

// Use preserved metadata for perfect roundtrip

            const preservedYAML = skillData.metadata.get('dollhouse.yaml')!;

            // FIX (DMCP-SEC-005): Use CORE_SCHEMA to prevent YAML deserialization attacks

            // Apply any custom metadata overrides

            if (options?.customMetadata) {

                Object.assign(enrichedMetadata, options.customMetadata);

} else if (exportPackage.format === 'yaml') {

        // SECURITY: Use JSON_SCHEMA for pure YAML parsing (prevents code execution)

        // JSON_SCHEMA = FAILSAFE + bool/int/float/null (safer than DEFAULT which adds timestamps)

        if (typeof parsed !== 'object' || parsed === null) {

          throw new Error('Invalid YAML data: expected object');

        }

}

        // FIX (DMCP-SEC-005): Use CORE_SCHEMA to prevent YAML deserialization attacks

        const bodyContent = yamlMatch[2];

        return { metadata, bodyContent };

findings.push(...this.evaluateConfigObject(parsed, filePath));

      } else if (extension === '.yml' || extension === '.yaml') {

        // Use FAILSAFE_SCHEMA for safe YAML parsing (no arbitrary object instantiation)

        if (parsed && typeof parsed === 'object') {

          findings.push(...this.evaluateConfigObject(parsed, filePath));

        }

*/

  static readPortFromYaml(yamlContent: string): number | undefined {

    try {

      const raw = parsed?.console?.port;

      if (raw === undefined || raw === null) return undefined;

      const port = Number(raw);

const content = await this.fileOperations.readFile(filePath, { source: 'SubmitToPortfolioTool.extractElementMetadata' });

      // SECURITY FIX: Use SecureYamlParser to prevent YAML deserialization attacks

      // Now: Uses SecureYamlParser.parse() which validates and sanitizes

      try {

        const parsed = SecureYamlParser.parse(content, {

return null;

      }

        schema: yaml.FAILSAFE_SCHEMA

      });

}

        // FIX (DMCP-SEC-005): Use CORE_SCHEMA to prevent YAML deserialization attacks

        const content = yamlMatch[2].trim();

        return { metadata, content };

// 5. Parse with safe schema

    let data: any;

    try {

        schema: this.SAFE_SCHEMA,

        json: false,  // Don't allow JSON-specific types

        onWarning: (warning) => {

let loadedData: any;

      try {

        // Using yaml with FAILSAFE_SCHEMA is secure - prevents code execution

          schema: yaml.FAILSAFE_SCHEMA // Safe schema prevents code execution

        });

      } catch (yamlError) {

try {

      // Use safe load with restricted schema

      const rawData = yaml.load(yamlContent, {

        onWarning: (warning) => {

          logger.warn('YAML parsing warning:', warning);

}

    ): DollhouseMCPSkillMetadata {

        // FIX (DMCP-SEC-005): Use CORE_SCHEMA to prevent YAML deserialization attacks

        // Apply any custom metadata overrides

        if (options?.customMetadata) {

const content = await this.fileOperations.readFile(this.capabilityIndexPath, {

        source: 'CapabilityIndexResource.loadCapabilityIndex'

      });

      // Cache the result

      this.cachedIndex = parsed;

// Try parsing as YAML

    try {

      const parsed = yaml.load(trimmed, {

        json: false

      });

### YAML Parsing

**Always use `SecureYamlParser`** - never use `yaml.load()` directly.

```typescript

// For markdown with frontmatter (personas, skills, templates)

}

    // Parse with safe schema

      schema: this.SAFE_SCHEMA,  // CORE_SCHEMA - safe basic types only

      json: false

    });

yaml: {

          parse: (str: string) => {

            // Use our secure YAML parsing

              schema: this.SAFE_SCHEMA,

              json: false

            });

});

  }

    .update(normalized.normalizedContent)

    .digest();

  const hashInt = hash.readUInt32BE(0);

# Minimal test Dockerfile - just echo hello and exit

# Using busybox instead of alpine to avoid rate limit issues

CMD ["echo", "Hello from minimal Docker test!"]

# Purpose: Create constrained container environments matching GitHub Actions runner specs

# for local performance calibration and CI prediction

# Base image matching GitHub Actions ubuntu-latest Node 20 environment

FROM node:20-slim AS ci-base

# Install minimal dependencies matching GitHub Actions environment

RUN apt-get update && apt-get install -y --no-install-recommends \

    python3 \

    make \

    g++ \

    ca-certificates \

    && rm -rf /var/lib/apt/lists/*

# Using busybox instead of alpine to avoid rate limit issues

FROM busybox:latest

CMD ["echo", "Hello from minimal Docker test!"]

// ---------- Step 1: initial status ----------

    section('Step 1: initial status (should be not-enrolled)');

    const initialStatus = await apiCall('GET', '/api/console/totp/status', token);

    checkOk('GET /status returned 200', () => assert.strictEqual(initialStatus.status, 200));

    checkOk('status reports enrolled=false before enrollment', () =>

      assert.strictEqual((initialStatus.body as { enrolled: boolean }).enrolled,

*   const result = queryService.query(items, userOptions);

   * } catch (error) {

   *   // Options are invalid, show error to user

   * }

   * ```

   */

const match = response.match(/SELECTED: ([\\w-]+)/);

        const selected = match ? match[1] : null;

          variation: '${variationId}',

          query: '${query.query}',

          selected: selected,

          expected: '${query.expected}',

          correct: selected === '${query.expected}'

        }));

        `

      ]);

// ---------- Step 5: status reflects enrollment ----------

    section('Step 5: status reflects enrollment');

    const enrolledStatus = await apiCall('GET', '/api/console/totp/status', token);

    checkOk('GET /status returned 200', () => assert.strictEqual(enrolledStatus.status, 200));

    checkOk('status reports enrolled=true after enrollment', () =>

      assert.strictEqual((enrolledStatus.body as { enrolled: boolean }).enrolled

// Length check to prevent DOS

    if (input.length > maxLength) {

      console.warn(`[SafeRegex] Input too long (${input.length} > ${maxLength}) in ${context}`);

    }

// ---------- Step 7: final status ----------

    section('Step 7: status reflects disable');

    const finalStatus = await apiCall('GET', '/api/console/totp/status', token);

    checkOk('GET /status returned 200', () => assert.strictEqual(finalStatus.status, 200));

    checkOk('status reports enrolled=false after disable', () =>

      assert.strictEqual((finalStatus.body as { enrolled: boolean }).enrolled, false),

if (currentPhase < phases.length) {

    const phase = phases[currentPhase];

    console.error(`📤 Phase ${phase.id}: ${phase.name}`);

    currentPhase++;

  } else {

    // All done

);

    console.log(initialCheck);

    // Create an MCP request to list_elements (simple tool that should trigger index)

    const mcpRequest = JSON.stringify({

* });

   *

   * if (result.isValid) {

   * } else {

   *   console.error('Validation failed:', result.errors);

   * }

// Handle directories

    if (!fs.statSync(input).isDirectory()) {

        console.error(chalk.red(`Input must be a directory or ZIP file: ${input}`));

    }

* ```typescript

   * const result = normalizer.normalize({ query: 'test' }, context);

   * if (result.success) {

   * } else {

   *   console.error(result.error); // Validation error message

   * }

btn.classList.toggle('active', on);

        btn.setAttribute('aria-pressed', on);

      });

    }

    applyView(activeView);

const hljsDark  = document.getElementById('hljs-theme-dark');

      if (hljsLight) hljsLight.disabled = isDark;

      if (hljsDark)  hljsDark.disabled  = !isDark;

    }

    // Restore saved preference; fall back to OS preference

}

    // Restore saved preference; fall back to OS preference

    const preferred = saved || (globalThis.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');

    applyTheme(preferred);