Harden Power Pages Playwright MCP root resolution (#382)

* Harden Playwright MCP root resolution

- require an absolute host-provided plugin root\n- canonicalize and contain the launcher path\n- cover invalid roots, malicious cwd, and supported hosts\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* address PR review feedback

- Guard EACCES/EPERM errors while statting the declared plugin root.
- Guard EACCES/EPERM errors while statting the resolved launcher.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e799af6-1da3-4859-931b-4f199e3e1146

* address PR review feedback

- Classify an exact-parent launcher resolution as escaping the declared plugin root.
- Add deterministic coverage for the exact-parent containment boundary.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e799af6-1da3-4859-931b-4f199e3e1146

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7e799af6-1da3-4859-931b-4f199e3e1146

Author: priyanshu92

plugins/power-pages/.mcp.json

@@ -4,7 +4,7 @@
             "command": "node",
             "args": [
                 "-e",
-                "const fs=require('node:fs'); const path=require('node:path'); const root=process.env.PLUGIN_ROOT||process.env.CLAUDE_PLUGIN_ROOT||process.cwd(); const entry=path.resolve(root,'scripts','launch-playwright-mcp.js'); if(!fs.existsSync(entry)) throw new Error('Could not resolve Power Pages plugin root; set PLUGIN_ROOT or launch from the plugin root'); const mod=require(entry); if(!mod||typeof mod.launch!=='function') throw new Error('Power Pages Playwright MCP launcher did not export launch()'); mod.launch();"
+                "const fs=require('node:fs'); const path=require('node:path'); const fail=(message)=>{throw new Error('[Power Pages Playwright MCP] '+message);}; const declaredRoot=process.env.PLUGIN_ROOT||process.env.CLAUDE_PLUGIN_ROOT; if(!declaredRoot) fail('PLUGIN_ROOT or CLAUDE_PLUGIN_ROOT must be set; refusing to resolve the launcher from the current working directory.'); if(!path.isAbsolute(declaredRoot)) fail('Declared plugin root must be an absolute path: '+declaredRoot+'.'); let root; try{root=fs.realpathSync(declaredRoot);}catch(error){fail('Declared plugin root is invalid: '+declaredRoot+' ('+(error.code||error.message)+').');} let rootStat; try{rootStat=fs.statSync(root);}catch(error){fail('Could not inspect declared plugin root: '+root+' ('+(error.code||error.message)+').');} if(!rootStat.isDirectory()) fail('Declared plugin root is not a directory: '+declaredRoot+'.'); const candidate=path.resolve(root,'scripts','launch-playwright-mcp.js'); let entry; try{entry=fs.realpathSync(candidate);}catch(error){fail('Launcher was not found under the declared plugin root: '+candidate+'.');} const relative=path.relative(root,entry); if(relative==='..'||relative.startsWith('..'+path.sep)||path.isAbsolute(relative)) fail('Resolved launcher escapes the declared plugin root: '+entry+'.'); let entryStat; try{entryStat=fs.statSync(entry);}catch(error){fail('Could not inspect resolved launcher: '+entry+' ('+(error.code||error.message)+').');} if(!entryStat.isFile()) fail('Resolved launcher is not a file: '+entry+'.'); const mod=require(entry); if(!mod||typeof mod.launch!=='function') fail('Launcher did not export launch(): '+entry+'.'); mod.launch();"
             ]
         },
         "microsoft-learn": {

plugins/power-pages/README.md

@@ -436,6 +436,8 @@ The plugin ships with two MCP servers configured in `.mcp.json` — they start a
 | **playwright** | Headless browser automation for live previews and runtime tests |
 | **microsoft-learn** | Grounded search/fetch over official Microsoft Learn docs |
 
+The plugin host must provide an absolute `PLUGIN_ROOT` (GitHub Copilot) or `CLAUDE_PLUGIN_ROOT` (Claude Code). The Playwright bootstrap resolves its launcher only from that declared plugin root and never from the workspace working directory.
+
 ## Typical Workflow
 
 A common end-to-end workflow looks like this:

plugins/power-pages/scripts/tests/mcp-config.test.js

@@ -6,6 +6,8 @@ const { spawnSync } = require('node:child_process');
 const test = require('node:test');
 
 const pluginRoot = path.resolve(__dirname, '..', '..');
+const config = JSON.parse(fs.readFileSync(path.join(pluginRoot, '.mcp.json'), 'utf8'));
+const server = config.mcpServers.playwright;
 
 function createFakeNpx(dir) {
   const commandPath = path.join(dir, process.platform === 'win32' ? 'npx.cmd' : 'npx');
@@ -17,27 +19,236 @@ function createFakeNpx(dir) {
   return commandPath;
 }
 
-test('playwright MCP bootstrap resolves the plugin root without host-provided env vars', (t) => {
+function runBootstrap({
+  cwd,
+  pluginRoot: pluginRootValue,
+  claudePluginRoot,
+  pathPrefix,
+  realpathOverride,
+  statFailure,
+} = {}) {
+  const env = { ...process.env };
+  const args = [...server.args];
+  delete env.PLUGIN_ROOT;
+  delete env.CLAUDE_PLUGIN_ROOT;
+
+  if (pluginRootValue !== undefined) {
+    env.PLUGIN_ROOT = pluginRootValue;
+  }
+  if (claudePluginRoot !== undefined) {
+    env.CLAUDE_PLUGIN_ROOT = claudePluginRoot;
+  }
+  if (pathPrefix) {
+    const pathSeparator = process.platform === 'win32' ? ';' : ':';
+    env.PATH = `${pathPrefix}${pathSeparator}${env.PATH || ''}`;
+  }
+  if (realpathOverride) {
+    // Patch only the launcher lookup so the canonical root still follows the real filesystem.
+    const bootstrapIndex = args.indexOf('-e') + 1;
+    const prelude = [
+      "const injectedFs=require('node:fs');",
+      'const originalRealpathSync=injectedFs.realpathSync;',
+      `const injectedRealpathTarget=${JSON.stringify(path.resolve(realpathOverride.target))};`,
+      `const injectedRealpathResult=${JSON.stringify(path.resolve(realpathOverride.result))};`,
+      "injectedFs.realpathSync=function(target,...options){if(require('node:path').resolve(String(target))===injectedRealpathTarget)return injectedRealpathResult;return originalRealpathSync.call(this,target,...options);};",
+    ].join(' ');
+    args[bootstrapIndex] = `${prelude} ${args[bootstrapIndex]}`;
+  }
+  if (statFailure) {
+    // Patch the child process's fs module so access errors are deterministic across platforms.
+    const bootstrapIndex = args.indexOf('-e') + 1;
+    const prelude = [
+      "const injectedFs=require('node:fs');",
+      'const originalStatSync=injectedFs.statSync;',
+      `const injectedStatTarget=${JSON.stringify(path.resolve(statFailure.target))};`,
+      `const injectedStatCode=${JSON.stringify(statFailure.code)};`,
+      "injectedFs.statSync=function(target,...options){if(require('node:path').resolve(String(target))===injectedStatTarget){const error=new Error('injected statSync failure');error.code=injectedStatCode;throw error;}return originalStatSync.call(this,target,...options);};",
+    ].join(' ');
+    args[bootstrapIndex] = `${prelude} ${args[bootstrapIndex]}`;
+  }
+
+  return spawnSync(server.command, args, {
+    cwd,
+    encoding: 'utf8',
+    env,
+    timeout: 5_000,
+  });
+}
+
+test('playwright MCP bootstrap wraps root stat errors with a clear diagnostic', () => {
+  const root = fs.realpathSync(pluginRoot);
+  const result = runBootstrap({
+    cwd: pluginRoot,
+    pluginRoot,
+    statFailure: { target: root, code: 'EACCES' },
+  });
+
+  assert.notEqual(result.status, 0);
+  assert.match(
+    result.stderr,
+    /\[Power Pages Playwright MCP\] Could not inspect declared plugin root: .+ \(EACCES\)\./,
+  );
+});
+
+test('playwright MCP bootstrap wraps launcher stat errors with a clear diagnostic', () => {
+  const launcher = fs.realpathSync(path.join(pluginRoot, 'scripts', 'launch-playwright-mcp.js'));
+  const result = runBootstrap({
+    cwd: pluginRoot,
+    pluginRoot,
+    statFailure: { target: launcher, code: 'EPERM' },
+  });
+
+  assert.notEqual(result.status, 0);
+  assert.match(
+    result.stderr,
+    /\[Power Pages Playwright MCP\] Could not inspect resolved launcher: .+ \(EPERM\)\./,
+  );
+});
+
+test('playwright MCP bootstrap requires a host-provided plugin root', () => {
+  const result = runBootstrap({ cwd: pluginRoot });
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /PLUGIN_ROOT or CLAUDE_PLUGIN_ROOT must be set/);
+  assert.match(result.stderr, /refusing to resolve the launcher from the current working directory/);
+});
+
+test('playwright MCP bootstrap does not execute a launcher from a malicious cwd', (t) => {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'power-pages-mcp-malicious-cwd-'));
+  const scriptsDir = path.join(tempDir, 'scripts');
+  const markerPath = path.join(tempDir, 'cwd-launcher-executed');
+  t.after(() => fs.rmSync(tempDir, { recursive: true, force: true }));
+
+  fs.mkdirSync(scriptsDir);
+  fs.writeFileSync(
+    path.join(scriptsDir, 'launch-playwright-mcp.js'),
+    `require('node:fs').writeFileSync(${JSON.stringify(markerPath)}, 'executed'); module.exports = { launch() {} };\n`,
+  );
+
+  const result = runBootstrap({ cwd: tempDir });
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /PLUGIN_ROOT or CLAUDE_PLUGIN_ROOT must be set/);
+  assert.equal(fs.existsSync(markerPath), false);
+});
+
+test('playwright MCP bootstrap rejects malformed plugin roots', async (t) => {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'power-pages-mcp-invalid-root-'));
+  const fileRoot = path.join(tempDir, 'not-a-directory');
+  t.after(() => fs.rmSync(tempDir, { recursive: true, force: true }));
+  fs.writeFileSync(fileRoot, 'not a plugin root');
+
+  await t.test('nonexistent root', () => {
+    const result = runBootstrap({
+      cwd: tempDir,
+      pluginRoot: path.join(tempDir, 'missing'),
+    });
+
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /Declared plugin root is invalid/);
+  });
+
+  await t.test('file root', () => {
+    const result = runBootstrap({ cwd: tempDir, pluginRoot: fileRoot });
+
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /Declared plugin root is not a directory/);
+  });
+
+  await t.test('relative root', () => {
+    const result = runBootstrap({ cwd: tempDir, pluginRoot: '.' });
+
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /Declared plugin root must be an absolute path/);
+  });
+});
+
+test('playwright MCP bootstrap rejects a launcher that resolves outside the plugin root', (t) => {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'power-pages-mcp-escape-'));
+  const declaredRoot = path.join(tempDir, 'plugin');
+  const outsideScripts = path.join(tempDir, 'outside-scripts');
+  const markerPath = path.join(tempDir, 'escaped-launcher-executed');
+  t.after(() => fs.rmSync(tempDir, { recursive: true, force: true }));
+
+  fs.mkdirSync(declaredRoot);
+  fs.mkdirSync(outsideScripts);
+  fs.writeFileSync(
+    path.join(outsideScripts, 'launch-playwright-mcp.js'),
+    `require('node:fs').writeFileSync(${JSON.stringify(markerPath)}, 'executed'); module.exports = { launch() {} };\n`,
+  );
+
+  try {
+    fs.symlinkSync(
+      outsideScripts,
+      path.join(declaredRoot, 'scripts'),
+      process.platform === 'win32' ? 'junction' : 'dir',
+    );
+  } catch (error) {
+    if (error.code === 'EPERM' || error.code === 'EACCES') {
+      t.skip(`symlinks are unavailable: ${error.code}`);
+      return;
+    }
+    throw error;
+  }
+
+  const result = runBootstrap({ cwd: tempDir, pluginRoot: declaredRoot });
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Resolved launcher escapes the declared plugin root/);
+  assert.equal(fs.existsSync(markerPath), false);
+});
+
+test('playwright MCP bootstrap rejects a launcher resolving to the exact parent directory', (t) => {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'power-pages-mcp-parent-escape-'));
+  const declaredRoot = path.join(tempDir, 'plugin');
+  t.after(() => fs.rmSync(tempDir, { recursive: true, force: true }));
+  fs.mkdirSync(declaredRoot);
+  const canonicalRoot = fs.realpathSync(declaredRoot);
+  const candidate = path.join(canonicalRoot, 'scripts', 'launch-playwright-mcp.js');
+  const exactParent = path.dirname(canonicalRoot);
+
+  const result = runBootstrap({
+    cwd: tempDir,
+    pluginRoot: declaredRoot,
+    realpathOverride: { target: candidate, result: exactParent },
+  });
+
+  assert.notEqual(result.status, 0);
+  assert.match(
+    result.stderr,
+    /Error: \[Power Pages Playwright MCP\] Resolved launcher escapes the declared plugin root:/,
+  );
+  assert.doesNotMatch(
+    result.stderr,
+    /Error: \[Power Pages Playwright MCP\] Resolved launcher is not a file:/,
+  );
+});
+
+test('playwright MCP bootstrap supports installed-plugin root environment conventions', async (t) => {
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'power-pages-mcp-'));
   t.after(() => fs.rmSync(tempDir, { recursive: true, force: true }));
 
   createFakeNpx(tempDir);
 
-  const config = JSON.parse(fs.readFileSync(path.join(pluginRoot, '.mcp.json'), 'utf8'));
-  const server = config.mcpServers.playwright;
-  const pathSeparator = process.platform === 'win32' ? ';' : ':';
-  const result = spawnSync(server.command, server.args, {
-    cwd: pluginRoot,
-    encoding: 'utf8',
-    env: {
-      HOME: process.env.HOME,
-      PATH: `${tempDir}${pathSeparator}${process.env.PATH || ''}`,
-      USERPROFILE: process.env.USERPROFILE,
-    },
-    timeout: 5_000,
+  await t.test('PLUGIN_ROOT', () => {
+    const result = runBootstrap({
+      cwd: tempDir,
+      pluginRoot,
+      pathPrefix: tempDir,
+    });
+
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /fake-npx/);
   });
 
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /fake-npx/);
-  assert.doesNotMatch(result.stderr, /PLUGIN_ROOT is not set/);
+  await t.test('CLAUDE_PLUGIN_ROOT', () => {
+    const result = runBootstrap({
+      cwd: tempDir,
+      claudePluginRoot: pluginRoot,
+      pathPrefix: tempDir,
+    });
+
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /fake-npx/);
+  });
 });