-
Notifications
You must be signed in to change notification settings - Fork 5k
Expand file tree
/
Copy pathrepository_path.go
More file actions
86 lines (78 loc) · 2.05 KB
/
Copy pathrepository_path.go
File metadata and controls
86 lines (78 loc) · 2.05 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
package github
import (
"fmt"
"path"
"slices"
"strings"
"github.com/github/github-mcp-server/pkg/scopes"
)
const workflowPathPrefix = ".github/workflows/"
func validateRelativePath(value string) (string, error) {
value = strings.TrimPrefix(value, "/")
if value == "" {
return "", fmt.Errorf("path must not be empty")
}
if path.IsAbs(value) {
return "", fmt.Errorf("path must be relative")
}
if strings.Contains(value, `\`) {
return "", fmt.Errorf("path must use forward slashes")
}
if slices.Contains(strings.Split(value, "/"), "..") {
return "", fmt.Errorf("path must not contain parent directory traversal")
}
cleaned := path.Clean(value)
if cleaned == "." {
return "", fmt.Errorf("path must identify a file")
}
return cleaned, nil
}
func isWorkflowPath(value string) bool {
return strings.HasPrefix(value, workflowPathPrefix) && len(value) > len(workflowPathPrefix)
}
func workflowScopeChallengeForPath(arguments map[string]any, activeScopes []string) []string {
value, ok := arguments["path"].(string)
if !ok {
return nil
}
cleaned, err := validateRelativePath(value)
if err != nil {
return nil
}
if !isWorkflowPath(cleaned) {
return scopes.ChallengeAll(activeScopes, scopes.Repo)
}
return scopes.ChallengeAll(activeScopes, scopes.Repo, scopes.Workflow)
}
func workflowScopeChallengeForFiles(arguments map[string]any, activeScopes []string) []string {
files, ok := arguments["files"].([]any)
if !ok {
return nil
}
containsWorkflow := false
for _, file := range files {
fileMap, ok := file.(map[string]any)
if !ok {
return nil
}
value, ok := fileMap["path"].(string)
if !ok {
return nil
}
cleaned, err := validateRelativePath(value)
if err != nil {
return nil
}
if isWorkflowPath(cleaned) {
containsWorkflow = true
}
}
var challenge []string
if !scopes.HasAll(activeScopes, scopes.Repo) {
challenge = append(challenge, string(scopes.Repo))
}
if containsWorkflow && !scopes.HasAll(activeScopes, scopes.Workflow) {
challenge = append(challenge, string(scopes.Workflow))
}
return challenge
}