Repository navigation
Fix audited dependencies, keep cookie requests on the Overleaf origin, safer live tests - #11
Merged
Merged
Conversation
…and never run live tests on an arbitrary project - Bump @modelcontextprotocol/sdk to ^1.32.2 (the floor matters for npx users, who do not get the lockfile), zod to ^4 (the SDK accepts ^3.25 || ^4), vitest to ^5; npm audit reports 0 vulnerabilities (was 9 in production deps, 7 more in dev deps). - REST requests and fetchText resolve paths with sameOriginUrl and refuse anything off the configured origin. They carry the session cookie, and fetchText takes a path from a server response, where plain concatenation would turn '@evil.example/x' into a request to evil.example. - The live suites only run against OVERLEAF_TEST_PROJECT (id or name) or the dev project. They used to fall back to the first writable project of whoever is signed in and would then overwrite its main.tex for a moment.
lonetis
pushed a commit
that referenced
this pull request
Nov 9, 2026
Releases what landed since 0.3.0: - tracked changes: list a document's pending suggestions (SDK listTrackedChanges, CLI `changes`, MCP overleaf_list_tracked_changes), and refuse by default any edit that would touch one (TrackedChangeConflictError; override with overwriteTrackedChanges / --overwrite-tracked-changes) (#10) - security: cookie-carrying REST requests stay on the Overleaf origin; @modelcontextprotocol/sdk ^1.32.2 and zod ^4, npm audit clean (#11) A minor bump rather than 0.3.1: the default edit behaviour changes, and 0.3.1 was published and then unpublished on npm, so that number can never be reused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016k8nQbcXiTztFcEngHqwxs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
1. Vulnerable dependencies.
npm auditreported 9 vulnerabilities in production dependencies (1 critical, 5 high), all through@modelcontextprotocol/sdk1.29 (its HTTP/OAuth parts and their express/hono stack) pluszod, and 7 more in the dev toolchain (vitest 2 / vite / esbuild). Claudeleaf only uses the stdio transport, so the exposure is small, but anyone installing it gets the alerts.@modelcontextprotocol/sdk^1.12.0 → ^1.32.2. The floor matters:npx claudeleafinstalls frompackage.json, not from the lockfile.zod^3.23 → ^4 (the SDK accepts^3.25 || ^4.0; no code changes needed).vitest^2.1 → ^5.1 (dev only).npm auditnow reports 0.2. Cookie-carrying requests stay on the Overleaf origin.
RestClient.requestandfetchTextbuilt URLs asbaseUrl + path.fetchTexttakes its path from a server response (the compile output URL), and plain concatenation turns a path like@evil.example/xintohttps://www.overleaf.com@evil.example/x, whose host isevil.example– with the session cookie attached. Only a misbehaving server could trigger it, but the fix is cheap:sameOriginUrlresolves the path against the base (self-hosted base paths kept) and refuses anything off its origin. Unit tests intest/rest.test.ts.3. Live tests never pick an arbitrary project. When
OVERLEAF_TEST_PROJECTwas unset (and the dev project not accessible), the integration and MCP e2e suites fell back to the first writable project of whoever was signed in, then created and deleted documents there and briefly overwrote itsmain.texfor the compile test. That can hit someone's real paper. They now run only againstOVERLEAF_TEST_PROJECT(id or exact name) or the dev project, and otherwise skip with a warning (test/liveProject.ts).Tested
npm run typecheck,npm run build,npm testwith a live session against a throwaway project: everything passes except the compile-error test when it runs right after the compile test – Overleaf answers the second compile withtoo-recently-compiledand no output. That happens onmaintoo; run alone it passes. WithoutOVERLEAF_TEST_PROJECTthe live suites skip.Note: this and the tracked-changes PR both touch
test/integration.test.ts; whichever lands second needs a small rebase, which I'm happy to do.