mcpb/examples/chrome-applescript
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Bryan Thompson dace08d31f
fix(examples/chrome-applescript): sanitize tab_id to prevent AppleScript injection
The inputSchema `type: "number"` is advisory only — runtime may receive a
string payload that gets interpolated into the osascript template. Coerce
tab_id via Number.parseInt before interpolating at all four sites.

Affected sites:
- findTabById(tabId)
- executeTabOperation(tabId, ...) (close_tab, switch_to_tab, reload_tab,
  go_back, go_forward)
- execute_javascript handler
- get_page_content handler

The shared toSafeTabId() helper returns null for missing values (preserving
the active-tab fallthrough) and throws on non-numeric input (surfacing misuse
via the existing request-level try/catch, consistent with the missing-code
path in execute_javascript).
2026-04-17 13:49:30 -05:00
..
server fix(examples/chrome-applescript): sanitize tab_id to prevent AppleScript injection 2026-04-17 13:49:30 -05:00
manifest.json feat: add privacy_policies field to manifest schema 2025-09-12 11:53:11 -07:00
yarn.lock build: ensure examples use public npm registry (#48) 2025-07-04 10:20:32 -07:00