mirror of
https://github.com/NickoScope/nickol-knx-mcp.git
synced 2026-09-29 19:31:12 +02:00
Nikolay1andClaude Opus 4.8
f68c85bb48
A .knxproj is a user-supplied ZIP-of-XML — untrusted input. New safexml.py
centralises hardened parsing for every place we open an archive or parse XML
ourselves (load_project, check_device_parameters, app-program parser):
XML - dependency-free reject of DOCTYPE/ENTITY (billion-laughs / XXE;
legitimate ETS XML never carries one) + defusedxml parser-level
blocking when installed (added as a dependency).
ZIP - pre-flight against absolute caps (archive size, entry count, per-member
and total decompressed size, compression ratio) rejects zip-bombs;
member names checked for path-traversal / absolute paths; each member
read through a streaming cap so a lying header can't exhaust memory.
Violations return a normal error dict, not a traceback. Still read-only.
Raised by external security review. tests/test_safexml.py (11/11 suite green).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.5 KiB
TOML
43 lines
1.5 KiB
TOML
[project]
|
|
name = "nickol-knx-mcp"
|
|
version = "0.8.0"
|
|
description = "Design-time KNX/ETS6 project assistant as an MCP server (parse .knxproj, validate, generate HA YAML + ETS CSV/XML). No live bus access."
|
|
readme = "README.md"
|
|
requires-python = ">=3.10"
|
|
license = { text = "MIT" }
|
|
authors = [{ name = "Nikolay Miroshnichenko" }]
|
|
keywords = ["knx", "ets", "ets6", "home-assistant", "mcp", "model-context-protocol", "smart-home", "home-automation"]
|
|
classifiers = [
|
|
"Development Status :: 4 - Beta",
|
|
"Intended Audience :: Developers",
|
|
"License :: OSI Approved :: MIT License",
|
|
"Programming Language :: Python :: 3",
|
|
"Programming Language :: Python :: 3.10",
|
|
"Programming Language :: Python :: 3.11",
|
|
"Programming Language :: Python :: 3.12",
|
|
"Topic :: Home Automation",
|
|
"Topic :: Software Development :: Libraries",
|
|
]
|
|
dependencies = [
|
|
"mcp>=1.10,<2", # v2 renames mcp.server.fastmcp.FastMCP -> mcp.server.MCPServer (breaking)
|
|
"xknxproject>=3.8",
|
|
"PyYAML>=6.0",
|
|
"defusedxml>=0.7", # hardened XML parsing of untrusted .knxproj (XXE/billion-laughs)
|
|
]
|
|
|
|
[project.urls]
|
|
Homepage = "https://github.com/NickoScope/nickol-knx-mcp"
|
|
Repository = "https://github.com/NickoScope/nickol-knx-mcp"
|
|
Issues = "https://github.com/NickoScope/nickol-knx-mcp/issues"
|
|
Changelog = "https://github.com/NickoScope/nickol-knx-mcp/blob/main/CHANGELOG.md"
|
|
|
|
[project.scripts]
|
|
nickol-knx-mcp = "nickol_knx_mcp.server:main"
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=68"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[tool.setuptools]
|
|
packages = ["nickol_knx_mcp"]
|