mirror of
https://github.com/langgenius/dify-official-plugins.git
synced 2026-07-22 01:55:27 -04:00
Xiyuan Chen
a74ee6819e
* feat(linear): align tool coverage with MCP list/get endpoints * chore(linear): bump plugin version to 0.0.2 * chore(linear): bump dify plugin sdk range * fix(linear): remove sensitive data from log messages * fix(linear): prevent GraphQL injection by using query variables Replace f-string interpolation of user input in GraphQL queries with proper query variables to prevent injection attacks. This affects 9 tool files that were building filter strings via string interpolation. Changes: - Replace f-string filter building with GraphQL variable objects - Pass variables dict to query_graphql() method - Maintain same functionality while preventing injection Fixes security vulnerability in: - linear_list_projects.py - linear_list_cycles.py - linear_get_teams.py - linear_list_issue_statuses.py - linear_list_documents.py - linear_get_users.py (complex nested OR/AND filters) - linear_list_project_labels.py - linear_list_issue_labels.py - linear_get_user_issues.py * fix(linear): add comprehensive security hardening - Add resource whitelist validation to prevent GraphQL injection attacks - Sanitize error messages to prevent information disclosure - Add input length validation (title: 255 chars, description/body: 50,000 chars) - Fix exception handling to prevent unbound variable errors Security improvements address: - HIGH: GraphQL injection via string interpolation in query_basic_resource - MEDIUM: Information disclosure through raw API responses in errors - LOW: DoS potential through unlimited input lengths * fix(linear): use typed filter variables for optional GraphQL filters Convert 7 tools from inline filter variables to typed $filter parameter. Fixes bug where null filter values caused incorrect query results when optional filters were omitted. - Pattern: $filter: XxxFilter (optional), conditionally include in variables - Affected: teams, cycles, documents, issueLabels, workflowStates, projectLabels, projects * chore(linear): remove unused legacy LinearClient Delete tools/linear/tools/linear_client.py (163 lines). Zero imports or references found in codebase - all tools use client/Linear.py instead. * refactor(linear): simplify duplicated fallback logic in get_user_issues Consolidate two identical fallback message branches into single path. Behavior unchanged: summary attempted first, fallback on error or missing session model.