fix: v0.1.3 — server startup crash + security hardening

Dev Agent Amelia · Dev Agent Amelia · commit 8c880ec5cf88 · 2026-02-21T23:39:28.000+01:00
- Fix server startup crash when installed via npx (package.json path)
- [HIGH] Validate entitySetName with safe identifier regex across all tools (F-01)
- [MEDIUM] Validate relationshipName/relatedEntitySetName in relation tools (F-10)
- [LOW] Consolidate inline OData escaping to centralized esc() utility (F-06)
- Add validation.utils.ts with shared Zod schemas for input sanitization
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -17,6 +17,18 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) — [Semantic V
 
 ---
 
+## [0.1.3] — 2025-06-22
+
+### Fixed
+- Server startup crash when installed via `npx` — incorrect `package.json` path resolution from `dist/` (was `../../package.json`, now `../package.json`)
+
+### Security
+- **[HIGH]** `entitySetName` now validated against a safe identifier regex (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`) across all tools — prevents path traversal within same origin (F-01)
+- **[MEDIUM]** `relationshipName` and `relatedEntitySetName` now validated with the same safe identifier regex in relation tools (F-10)
+- Consolidated all inline OData single-quote escaping calls to use the centralized `esc()` utility for consistency (F-06)
+
+---
+
 ## [0.1.0] — 2025-04-01
 
 ### Added
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mcp-dataverse",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "MCP Server for Microsoft Dataverse Web API",
   "type": "module",
   "main": "dist/server.js",
diff --git a/server.json b/server.json
@@ -7,12 +7,12 @@
     "url": "https://github.com/codeurali/mcp-dataverse",
     "source": "github"
   },
-  "version": "0.1.0",
+  "version": "0.1.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "mcp-dataverse",
-      "version": "0.1.0",
+      "version": "0.1.3",
       "transport": {
         "type": "stdio"
       },
diff --git a/src/server.ts b/src/server.ts
@@ -87,7 +87,7 @@ const TEAM_TOOL_NAMES = new Set(teamTools.map(t => t.name));
 
 // Read version from package.json so server.ts never drifts out of sync
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const SERVER_VERSION = (JSON.parse(readFileSync(join(__dirname, '../../package.json'), 'utf-8')) as { version: string }).version;
+const SERVER_VERSION = (JSON.parse(readFileSync(join(__dirname, '../package.json'), 'utf-8')) as { version: string }).version;
 
 /**
  * Routes a tool call to its handler. Used directly by the request handler
diff --git a/src/tools/actions.tools.ts b/src/tools/actions.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { safeEntitySetName } from './validation.utils.js';
 
 export const actionTools = [
   {
@@ -120,7 +121,7 @@ const ExecuteFunctionInput = z.object({
 });
 
 const ExecuteBoundActionInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
   actionName: z
     .string()
@@ -142,7 +143,7 @@ const ListTableDependenciesInput = z.object({
 });
 
 const ExecuteBoundFunctionInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
   functionName: z
     .string()
diff --git a/src/tools/annotations.tools.ts b/src/tools/annotations.tools.ts
@@ -1,5 +1,7 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { esc } from '../dataverse/dataverse-client.utils.js';
+import { safeEntitySetName } from './validation.utils.js';
 
 const GetAnnotationsInput = z.object({
     recordId: z.string().uuid(),
@@ -10,7 +12,7 @@ const GetAnnotationsInput = z.object({
 
 const CreateAnnotationInput = z.object({
     recordId: z.string().uuid(),
-    entitySetName: z.string().min(1),
+    entitySetName: safeEntitySetName,
     notetext: z.string().optional(),
     subject: z.string().optional(),
     filename: z.string().optional(),
@@ -121,7 +123,7 @@ export async function handleAnnotationTool(
             const filterParts = [`_objectid_value eq ${params.recordId}`];
             if (params.mimeTypeFilter) {
                 filterParts.push(
-                    `mimetype eq '${params.mimeTypeFilter.replace(/'/g, "''")}'`,
+                    `mimetype eq '${esc(params.mimeTypeFilter)}'`,
                 );
             }
 
diff --git a/src/tools/audit.tools.ts b/src/tools/audit.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { esc } from '../dataverse/dataverse-client.utils.js';
 
 const AUDIT_ACTION_NAMES: Record<number, string> = {
   1: 'Create',
@@ -135,7 +136,7 @@ export async function handleAuditTool(
         filters.push(`_objectid_value eq ${params.recordId}`);
       }
       if (params.entityLogicalName) {
-        const escaped = params.entityLogicalName.replace(/'/g, "''");
+        const escaped = esc(params.entityLogicalName);
         filters.push(`objecttypecode eq '${escaped}'`);
       }
       if (params.userId) {
diff --git a/src/tools/crud.tools.ts b/src/tools/crud.tools.ts
@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import type { DataverseClient } from '../dataverse/dataverse-client.js';
 import { esc } from '../dataverse/dataverse-client.utils.js';
+import { safeEntitySetName } from './validation.utils.js';
 
 export const crudTools = [
   {
@@ -109,31 +110,31 @@ export const crudTools = [
 ];
 
 const GetInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
   select: z.array(z.string()).optional(),
 });
 
 const CreateInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   data: z.record(z.unknown()),
 });
 
 const UpdateInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
   data: z.record(z.unknown()),
   etag: z.string().optional(),
 });
 
 const DeleteInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
   confirm: z.boolean(),
 });
 
 const UpsertInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   alternateKey: z.string().min(1).optional(),
   alternateKeyValue: z.string().min(1).optional(),
   alternateKeys: z.record(z.string()).optional(),
@@ -146,7 +147,7 @@ const UpsertInput = z.object({
 );
 
 const AssignInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
   ownerType: z.enum(['systemuser', 'team']),
   ownerId: z.string().uuid(),
diff --git a/src/tools/customization.tools.ts b/src/tools/customization.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { esc } from '../dataverse/dataverse-client.utils.js';
 
 const STAGE_NAMES: Record<number, string> = {
   10: 'Pre-validation',
@@ -118,7 +119,7 @@ export async function handleCustomizationTool(
 
       const filters: string[] = ['isprivate eq false'];
       if (nameFilter) {
-        filters.push(`contains(name,'${nameFilter.replace(/'/g, "''")}')`);
+        filters.push(`contains(name,'${esc(nameFilter)}')`);
       }
 
       const result = await client.query<SdkMessage>('sdkmessages', {
diff --git a/src/tools/query.tools.ts b/src/tools/query.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { safeEntitySetName } from './validation.utils.js';
 
 /**
  * Dataverse entities whose EntitySetName does not follow the simple <logicalName>+s pattern.
@@ -105,7 +106,7 @@ export const queryTools = [
 ];
 
 const QueryInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   select: z.array(z.string()).optional(),
   filter: z.string().optional(),
   orderby: z.string().optional(),
@@ -121,7 +122,7 @@ const FetchXmlInput = z.object({
 });
 
 const RetrieveWithPagingInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   select: z.array(z.string()).optional(),
   filter: z.string().optional(),
   orderby: z.string().optional(),
diff --git a/src/tools/relations.tools.ts b/src/tools/relations.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseClient } from '../dataverse/dataverse-client.js';
+import { safeEntitySetName, safeRelationshipName } from './validation.utils.js';
 
 export const relationTools = [
   {
@@ -35,19 +36,19 @@ export const relationTools = [
 ];
 
 const AssociateInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
-  relationshipName: z.string().min(1),
-  relatedEntitySetName: z.string().min(1),
+  relationshipName: safeRelationshipName,
+  relatedEntitySetName: safeEntitySetName,
   relatedId: z.string().uuid(),
 });
 
 const DisassociateInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   id: z.string().uuid(),
-  relationshipName: z.string().min(1),
+  relationshipName: safeRelationshipName,
   relatedId: z.string().uuid().optional(),
-  relatedEntitySetName: z.string().min(1).optional(),
+  relatedEntitySetName: safeEntitySetName.optional(),
 });
 
 export async function handleRelationTool(
diff --git a/src/tools/solution.tools.ts b/src/tools/solution.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { esc } from '../dataverse/dataverse-client.utils.js';
 
 const ListSolutionsInput = z.object({
   includeManaged: z.boolean().optional().default(false),
@@ -107,7 +108,7 @@ export async function handleSolutionTool(
       }
       if (params.nameFilter) {
         filterParts.push(
-          `contains(uniquename,'${params.nameFilter.replace(/'/g, "''")}')`,
+          `contains(uniquename,'${esc(params.nameFilter)}')`,
         );
       }
 
diff --git a/src/tools/trace.tools.ts b/src/tools/trace.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { esc } from '../dataverse/dataverse-client.utils.js';
 
 const OPERATION_TYPE_NAMES: Record<number, string> = {
   0: 'Execute',
@@ -148,13 +149,13 @@ export async function handleTraceTool(
 
       const filterParts: string[] = [];
       if (params.pluginTypeFilter) {
-        filterParts.push(`contains(typename,'${params.pluginTypeFilter.replace(/'/g, "''")}')`);
+        filterParts.push(`contains(typename,'${esc(params.pluginTypeFilter)}')`);
       }
       if (params.messageFilter) {
-        filterParts.push(`messagename eq '${params.messageFilter.replace(/'/g, "''")}'`);
+        filterParts.push(`messagename eq '${esc(params.messageFilter)}'`);
       }
       if (params.entityFilter) {
-        filterParts.push(`primaryentity eq '${params.entityFilter.replace(/'/g, "''")}'`);
+        filterParts.push(`primaryentity eq '${esc(params.entityFilter)}'`);
       }
       if (params.exceptionsOnly) {
         filterParts.push('exceptiondetails ne null');
@@ -206,7 +207,7 @@ export async function handleTraceTool(
       }
       if (params.entityFilter) {
         filterParts.push(
-          `regardingobjecttypecode eq '${params.entityFilter.replace(/'/g, "''")}'`,
+          `regardingobjecttypecode eq '${esc(params.entityFilter)}'`,
         );
       }
 
diff --git a/src/tools/tracking.tools.ts b/src/tools/tracking.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { safeEntitySetName } from './validation.utils.js';
 
 export const trackingTools = [
   {
@@ -29,7 +30,7 @@ export const trackingTools = [
 ];
 
 const ChangeDetectionInput = z.object({
-  entitySetName: z.string().min(1),
+  entitySetName: safeEntitySetName,
   deltaToken: z.string().nullable(),
   select: z.array(z.string()).optional(),
 });
diff --git a/src/tools/users.tools.ts b/src/tools/users.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { esc } from '../dataverse/dataverse-client.utils.js';
 
 const GetUserRolesInput = z.object({
     userId: z.string().uuid(),
@@ -123,7 +124,7 @@ export async function handleUserTool(
             }
 
             if (params.search) {
-                const escaped = params.search.replace(/'/g, "''");
+                const escaped = esc(params.search);
                 filterParts.push(
                     `(contains(fullname,'${escaped}') or contains(internalemailaddress,'${escaped}'))`
                 );
diff --git a/src/tools/validation.utils.ts b/src/tools/validation.utils.ts
@@ -0,0 +1,16 @@
+import { z } from 'zod';
+
+/** Matches valid OData entity set names and Dataverse schema identifiers. */
+const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+
+/** Zod string schema for entity set names — blocks path traversal and injection. */
+export const safeEntitySetName = z.string().min(1).regex(
+  SAFE_IDENTIFIER,
+  'entitySetName must contain only letters, digits, or underscores',
+);
+
+/** Zod string schema for relationship names — blocks path traversal and injection. */
+export const safeRelationshipName = z.string().min(1).regex(
+  SAFE_IDENTIFIER,
+  'relationshipName must contain only letters, digits, or underscores',
+);
diff --git a/src/tools/views.tools.ts b/src/tools/views.tools.ts
@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';
+import { esc } from '../dataverse/dataverse-client.utils.js';
 
 const ListViewsInput = z.object({
   entityLogicalName: z.string().min(1),
@@ -55,7 +56,7 @@ export async function handleViewTool(
   switch (name) {
     case 'dataverse_list_views': {
       const { entityLogicalName, includePersonal, top } = ListViewsInput.parse(args);
-      const escaped = entityLogicalName.replace(/'/g, "''");
+      const escaped = esc(entityLogicalName);
 
       const systemResult = await client.query<SystemView>('savedqueries', {
         filter: `returnedtypecode eq '${escaped}' and statecode eq 0`,

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "mcp-dataverse",`
`3`		`- "version": "0.1.0",`
	`3`	`+ "version": "0.1.3",`
`4`	`4`	`"description": "MCP Server for Microsoft Dataverse Web API",`
`5`	`5`	`"type": "module",`
`6`	`6`	`"main": "dist/server.js",`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`import { z } from 'zod';`
`2`	`2`	`import type { DataverseAdvancedClient } from '../dataverse/dataverse-client-advanced.js';`
	`3`	`+import { esc } from '../dataverse/dataverse-client.utils.js';`
`3`	`4`
`4`	`5`	`const AUDIT_ACTION_NAMES: Record<number, string> = {`
`5`	`6`	`1: 'Create',`
`@@ -135,7 +136,7 @@ export async function handleAuditTool(`
`135`	`136`	filters.push(`_objectid_value eq ${params.recordId}`);
`136`	`137`	`}`
`137`	`138`	`if (params.entityLogicalName) {`
`138`		`- const escaped = params.entityLogicalName.replace(/'/g, "''");`
	`139`	`+ const escaped = esc(params.entityLogicalName);`
`139`	`140`	filters.push(`objecttypecode eq '${escaped}'`);
`140`	`141`	`}`
`141`	`142`	`if (params.userId) {`