mirror of
https://github.com/haris-musa/excel-mcp-server.git
synced 2026-07-23 11:28:51 +08:00
Harden get_excel_path() for SSE and streamable-http transports: - Reject absolute paths supplied by remote clients - Resolve and validate relative paths stay within EXCEL_FILES_PATH - Reject filenames containing NUL bytes Add tests/test_sandbox_paths.py covering bypass vectors. Bump version to 0.1.8. Made-with: Cursor