janniclas.loosenandClaude Opus 5.5
e420145cbe
Without /D, "$" also matches before a trailing "\n", so "custom_meta_telefon\n", a color setting "5\n" (stored as sent) or a whole reference followed by "\n" passed VariableRef. Added /D to every ^...$ pattern that validates client or admin input: - VariableRef META_KEY, NUMBER, WHOLE (canonical/typeOf; Placeholders::field shares META_KEY) - Cursor::decode, GuideRepository topic names (MCP input and filter keys) - ExposurePolicy::sanitize ability keys and group ids, LogTab list filters Not changed: Placeholders::PATTERN (runs on trim()), Warnings hex checks (hints only), NodeSummary/AttrPathIndex/LogListTable (stored or Divi data, no client input). Each fixed pattern has a test with a trailing "\n" that is rejected. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
97 lines
2.7 KiB
PHP
97 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace LIT\MCP\Guides;
|
|
|
|
/**
|
|
* Guide topics: markdown files from one directory (the default), extended or overridden
|
|
* by the site via the filter `lit_mcp_guides` (spec §9.2), which returns
|
|
* array<string topic, string markdown>. Topic names are restricted to lowercase slugs,
|
|
* so no path outside the directory can ever be read; filter entries with another name or
|
|
* a non-string content are ignored. Filtered content is site-owned and returned as-is.
|
|
*/
|
|
final class GuideRepository
|
|
{
|
|
private const TOPIC_PATTERN = '/^[a-z0-9]+(?:-[a-z0-9]+)*$/D';
|
|
|
|
/** @var array<string, string>|null Filtered topics, read once per instance (= request). */
|
|
private ?array $filtered = null;
|
|
|
|
public function __construct(private string $directory)
|
|
{
|
|
}
|
|
|
|
/** @return list<string> */
|
|
public function topics(): array
|
|
{
|
|
$topics = array_unique(array_merge($this->fileTopics(), array_keys($this->filtered())));
|
|
sort($topics);
|
|
|
|
return array_values($topics);
|
|
}
|
|
|
|
public function get(string $topic): ?string
|
|
{
|
|
if (! self::isTopic($topic)) {
|
|
return null;
|
|
}
|
|
|
|
$filtered = $this->filtered();
|
|
if (array_key_exists($topic, $filtered)) {
|
|
return $filtered[$topic];
|
|
}
|
|
|
|
if (! in_array($topic, $this->fileTopics(), true)) {
|
|
return null;
|
|
}
|
|
|
|
// phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
|
|
$content = file_get_contents($this->directory . '/' . $topic . '.md');
|
|
|
|
return $content === false ? null : $content;
|
|
}
|
|
|
|
/** @return list<string> */
|
|
private function fileTopics(): array
|
|
{
|
|
$files = glob($this->directory . '/*.md');
|
|
if ($files === false) {
|
|
return [];
|
|
}
|
|
|
|
$topics = [];
|
|
foreach ($files as $file) {
|
|
$topic = basename($file, '.md');
|
|
if (self::isTopic($topic)) {
|
|
$topics[] = $topic;
|
|
}
|
|
}
|
|
|
|
return $topics;
|
|
}
|
|
|
|
/** @return array<string, string> */
|
|
private function filtered(): array
|
|
{
|
|
if ($this->filtered !== null) {
|
|
return $this->filtered;
|
|
}
|
|
|
|
$guides = apply_filters('lit_mcp_guides', []);
|
|
$this->filtered = [];
|
|
foreach (is_array($guides) ? $guides : [] as $topic => $markdown) {
|
|
if (is_string($topic) && self::isTopic($topic) && is_string($markdown)) {
|
|
$this->filtered[$topic] = $markdown;
|
|
}
|
|
}
|
|
|
|
return $this->filtered;
|
|
}
|
|
|
|
private static function isTopic(string $topic): bool
|
|
{
|
|
return preg_match(self::TOPIC_PATTERN, $topic) === 1;
|
|
}
|
|
}
|