Ghost-MCP-Server: Instructions file for Claude Code

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Security Requirements (OWASP Guidelines)

All code written for this project MUST follow OWASP security best practices to prevent common vulnerabilities:

Required Security Measures:

1. Input Validation & Sanitization

   • Validate ALL user inputs using Zod schemas from src/schemas/
   • HTML sanitization is integrated into the schema layer (src/schemas/common.js)
   • Reject inputs that don't match expected patterns
   • Use allowlists for acceptable values, not denylists

2. Path Traversal Prevention

   • Always resolve and validate file paths against expected directories
   • Use path.resolve() and verify paths start with allowed base directories
   • Never use user input directly in file system operations
   • Generate cryptographically secure filenames for uploads

3. XSS (Cross-Site Scripting) Prevention

   • Sanitize all HTML content before storage or display
   • Escape special characters in user-generated content
   • Use Content Security Policy headers
   • Never use eval() or new Function() with user input

4. SQL Injection Prevention

   • Use parameterized queries (though this project uses Ghost API, not direct SQL)
   • Escape special characters in filter strings
   • Validate query parameters against expected formats

5. Authentication & Authorization

   • Use constant-time comparison for secrets (crypto.timingSafeEqual)
   • Implement rate limiting on sensitive endpoints
   • Validate API keys and tokens securely
   • Never log sensitive information

6. Additional Security Controls

   • Set appropriate HTTP security headers
   • Implement request size limits
   • Use HTTPS for external requests
   • Validate URLs to prevent SSRF attacks
   • Clean up temporary files securely
   • Log security events appropriately

Security Libraries in Use:

• zod - Runtime type validation and schema definition (primary validation)
• sanitize-html - HTML sanitization (integrated into Zod schemas)
• express-rate-limit - Rate limiting
• crypto - Secure random generation and comparisons
• helmet - HTTP security headers
• joi - Legacy validation, allowlisted in 4 specific files only. New joi imports are blocked by ESLint no-restricted-imports — see eslint.config.js. Use Zod schemas under src/schemas/.