fix: address security issues and improve Docker implementation

Security Fixes:
- Add command injection prevention in n8n-mcp wrapper with whitelist validation
- Fix race condition in database initialization with proper lock directory creation
- Add flock availability check with fallback behavior
- Implement comprehensive input sanitization in parse-config.js

Improvements:
- Add debug logging support to parse-config.js (DEBUG_CONFIG=true)
- Improve test cleanup error handling with proper error tracking
- Increase integration test timeouts for CI compatibility
- Update test assertions to check environment variables instead of processes

All critical security vulnerabilities identified by code review have been addressed.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
czlonkowski
2025-07-31 13:04:25 +02:00
parent 903a49d3b0
commit 71cd20bf95
6 changed files with 127 additions and 39 deletions

View File

@@ -45,10 +45,11 @@ COPY data/nodes.db ./data/
COPY src/database/schema-optimized.sql ./src/database/
COPY .env.example ./
# Copy entrypoint script and config parser
# Copy entrypoint script, config parser, and n8n-mcp command
COPY docker/docker-entrypoint.sh /usr/local/bin/
COPY docker/parse-config.js /app/docker/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
COPY docker/n8n-mcp /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh /usr/local/bin/n8n-mcp
# Add container labels
LABEL org.opencontainers.image.source="https://github.com/czlonkowski/n8n-mcp"