mcpb/examples/chrome-applescript/server
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Bryan Thompson dace08d31f
fix(examples/chrome-applescript): sanitize tab_id to prevent AppleScript injection
The inputSchema `type: "number"` is advisory only — runtime may receive a
string payload that gets interpolated into the osascript template. Coerce
tab_id via Number.parseInt before interpolating at all four sites.

Affected sites:
- findTabById(tabId)
- executeTabOperation(tabId, ...) (close_tab, switch_to_tab, reload_tab,
  go_back, go_forward)
- execute_javascript handler
- get_page_content handler

The shared toSafeTabId() helper returns null for missing values (preserving
the active-tab fallthrough) and throws on non-numeric input (surfacing misuse
via the existing request-level try/catch, consistent with the missing-code
path in execute_javascript).
2026-04-17 13:49:30 -05:00
..
index.js fix(examples/chrome-applescript): sanitize tab_id to prevent AppleScript injection 2026-04-17 13:49:30 -05:00