dayuan.jiang a46787c1b8 fix(mcp-server): fix XSS and crashes, make XML validation strict ...

- Validate and escape the mcp session id; only serve localhost Host/Origin
- Malformed URLs and session ids return errors instead of crashing the process
- Strict XML syntax check with saxes (linkedom never reports parse errors)
- autoFixXml no longer corrupts valid XML; attribute newlines serialized as entities
- Sessions stay alive while polled; browser pushes carry a base version (409 on conflict)
- Page tools respect the edit gate; UTF-8 bodies decoded correctly
- Export replies matched to requests and serialized; xml sync export handled
- UserObject/object cells addressable by id; history restored by stable id; logs off stdout

2026-10-03 17:45:41 +09:00

..

diagram-operations.test.ts

fix(mcp-server): fix XSS and crashes, make XML validation strict

2026-10-03 17:45:41 +09:00

edit-gate.test.ts

fix(mcp-server): fix XSS and crashes, make XML validation strict

2026-10-03 17:45:41 +09:00

http-server.test.ts

fix(mcp-server): fix XSS and crashes, make XML validation strict

2026-10-03 17:45:41 +09:00

load-diagram.test.ts

fix(mcp-server): fix XSS and crashes, make XML validation strict

2026-10-03 17:45:41 +09:00

multi-page.test.ts

fix(mcp-server): fix XSS and crashes, make XML validation strict

2026-10-03 17:45:41 +09:00

server-wiring.test.ts

feat(mcp): add load_diagram tool to load .drawio files into the session (#893)

2026-07-12 19:54:42 +09:00

xml-validation.test.ts

fix(mcp-server): fix XSS and crashes, make XML validation strict

2026-10-03 17:45:41 +09:00