security

Security Rules for Code-Index-MCP

Overview

This file defines security policies, best practices, and implementation guidelines for the Code-Index-MCP project to ensure safe code indexing and analysis.

Input Validation

File Path Validation

import os
from pathlib import Path

def validate_file_path(file_path: str, base_dir: str) -> bool:
    """Ensure file paths are within allowed directories."""
    try:
        # Resolve to absolute path
        abs_path = Path(file_path).resolve()
        base_path = Path(base_dir).resolve()
        
        # Check if path is within base directory
        return abs_path.is_relative_to(base_path)
    except Exception:
        return False

# Usage in API endpoints
@app.post("/index")
async def index_file(file_path: str):
    if not validate_file_path(file_path, os.getcwd()):
        raise HTTPException(403, "Access denied: Invalid file path")

Query Sanitization

def sanitize_search_query(query: str) -> str:
    """Remove potentially dangerous characters from search queries."""
    # Remove SQL injection attempts
    dangerous_patterns = [';', '--', '/*', '*/', 'xp_', 'sp_']
    for pattern in dangerous_patterns:
        query = query.replace(pattern, '')
    
    # Limit query length
    return query[:1000]

Authentication & Authorization

API Key Management

import secrets
import hashlib

class APIKeyManager:
    def generate_api_key(self) -> str:
        """Generate secure API key."""
        return secrets.token_urlsafe(32)
    
    def hash_api_key(self, api_key: str) -> str:
        """Hash API key for storage."""
        return hashlib.sha256(api_key.encode()).hexdigest()
    
    def verify_api_key(self, provided_key: str, stored_hash: str) -> bool:
        """Verify API key against stored hash."""
        return self.hash_api_key(provided_key) == stored_hash

Request Authentication

from fastapi import Security, HTTPException
from fastapi.security import APIKeyHeader

api_key_header = APIKeyHeader(name="X-API-Key")

async def verify_api_key(api_key: str = Security(api_key_header)):
    """Verify API key middleware."""
    if not api_key_manager.verify_api_key(api_key):
        raise HTTPException(401, "Invalid API key")
    return api_key