fix(security): remove process-global image cache and MCP resource interface (GHSA-25fp-988j-w29f) (#163)

utils.ad_creative_images was a module-level dict keyed by image hash alone, read by two registered MCP resources (meta-ads://resources enumerated every entry, meta-ads://images/{id} returned any entry's bytes) that never touched the request credential.

Nothing had written to it since 0.4.0 — create_resource_from_image() held the only write and had no call sites — so the interface served an always-empty cache and no creative image was ever exposed through it. Removed rather than scoped, along with the dead writer and imports; regression tests assert none of it returns.

Bumps to 1.0.123 and documents the advisory, including its reachability, in SECURITY.md.

Author: nictuku

SECURITY.md

@@ -221,3 +221,40 @@ cache per caller would have kept the machinery without the benefit.
   typed tools instead: `get_ad_accounts`, `get_campaigns`,
   `get_campaign_details`, `get_adsets`, `get_ads`, `get_ad_details`.
 - Credited to [@BarakSrour](https://github.com/BarakSrour).
+
+### GHSA-25fp-988j-w29f — MCP resource interface over a process-global, unscoped image cache
+
+- **Severity:** Low (reported as Medium; see *Reachability* below)
+- **Affected versions:** `<= 1.0.122`
+- **Fixed in:** `1.0.123`
+- **Affected configurations:** Would have applied to multi-caller
+  `--transport streamable-http` deployments. The hosted MCP at
+  `*.mcp.pipeboard.co` does not expose the MCP resources interface to clients.
+
+**What was wrong.** `utils.ad_creative_images` was a module-level dict of ad
+creative images keyed by image hash alone, with no caller, session or tenant
+component and no eviction. Two MCP resources registered on the server read it
+directly: `meta-ads://resources` (`list_resources`) enumerated every entry, and
+`meta-ads://images/{resource_id}` (`get_resource`) returned any entry's raw
+bytes. Neither handler resolved or used the request credential, so the shape of
+the code was a cross-caller read with an enumeration primitive attached.
+
+**Reachability.** No shipped version could populate that cache. The only write
+was `create_resource_from_image()`, which has had no call sites since `0.4.0`
+(July 2025) — `get_ad_image` returns the image directly and never cached it.
+Verified against the running server: `meta-ads://resources` returns
+`{"resources": []}` and every `meta-ads://images/...` read returns
+"Resource not found". No creative image of any caller was ever exposed through
+this interface. The finding is accurate about the code and does not describe a
+disclosure that could occur in practice.
+
+**Fix.** The cache, its writer, the `resources` module and both resource
+registrations were removed. An unscoped global with live readers is one commit
+away from being exploitable the moment a write path returns.
+
+**Action for operators.** None required. Upgrade to `1.0.123` to drop the dead
+interface. Clients that enumerated `meta-ads://resources` (it only ever returned
+an empty list) should use `get_ad_image` / `get_ad_creatives` instead.
+
+- Credited to [@Gal3m](https://github.com/Gal3m) and
+  [@mohammad228](https://github.com/mohammad228).

meta_ads_mcp/__init__.py

@@ -6,7 +6,7 @@
 
 from meta_ads_mcp.core.server import main
 
-__version__ = "1.0.122"
+__version__ = "1.0.123"
 
 __all__ = [
     'get_ad_accounts',

meta_ads_mcp/core/ads.py

@@ -433,7 +433,7 @@ def _translate_video_customization_rules_for_existing_post(
     return translated_rules, videos_array
 
 
-from .utils import download_image, try_multiple_download_methods, ad_creative_images, extract_creative_image_urls
+from .utils import download_image, try_multiple_download_methods, extract_creative_image_urls
 from .server import mcp_server
 
 

meta_ads_mcp/core/insights.py

@@ -3,7 +3,7 @@
 import json
 from typing import Optional, Union, Dict, List
 from .api import meta_api_tool, make_api_request
-from .utils import download_image, try_multiple_download_methods, ad_creative_images, create_resource_from_image
+from .utils import download_image, try_multiple_download_methods
 from .server import mcp_server
 import base64
 import datetime

meta_ads_mcp/core/resources.py

@@ -7,16 +7,11 @@
 import json
 from typing import Dict, Any, Optional
 from .auth import login as login_auth
-from .resources import list_resources, get_resource
 from .utils import logger
 
 # Initialize FastMCP server
 mcp_server = FastMCP("meta-ads")
 
-# Register resource URIs
-mcp_server.resource(uri="meta-ads://resources")(list_resources)
-mcp_server.resource(uri="meta-ads://images/{resource_id}")(get_resource)
-
 
 class StreamableHTTPHandler:
     """Handles stateless Streamable HTTP requests for Meta Ads MCP"""

meta_ads_mcp/core/server.py

@@ -75,9 +75,6 @@ def setup_logging():
 # Create the logger instance to be imported by other modules
 logger = setup_logging()
 
-# Global store for ad creative images
-ad_creative_images = {}
-
 
 def extract_creative_image_urls(creative: Dict[str, Any]) -> List[str]:
     """
@@ -369,28 +366,3 @@ async def try_multiple_download_methods(url: str) -> Optional[bytes]:
 
     return None
 
-
-def create_resource_from_image(image_bytes: bytes, resource_id: str, name: str) -> Dict[str, Any]:
-    """
-    Create a resource entry from image bytes.
-    
-    Args:
-        image_bytes: Raw image data
-        resource_id: Unique identifier for the resource
-        name: Human-readable name for the resource
-        
-    Returns:
-        Dictionary with resource information
-    """
-    ad_creative_images[resource_id] = {
-        "data": image_bytes,
-        "mime_type": "image/jpeg",
-        "name": name
-    }
-    
-    return {
-        "resource_id": resource_id,
-        "resource_uri": f"meta-ads://images/{resource_id}",
-        "name": name,
-        "size": len(image_bytes)
-    } 

meta_ads_mcp/core/utils.py

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "meta-ads-mcp"
-version = "1.0.122"
+version = "1.0.123"
 description = "Model Context Protocol (MCP) server for Meta Ads - Use Remote MCP at pipeboard.co for easiest setup"
 readme = "README.md"
 requires-python = ">=3.10"

pyproject.toml

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "co.pipeboard/meta-ads-mcp",
   "description": "Facebook / Meta Ads automation with AI: analyze performance, test creatives, optimize spend.",
-  "version": "1.0.122",
+  "version": "1.0.123",
   "remotes": [
     {
       "type": "streamable-http",

server.json

@@ -3,8 +3,8 @@
 Tests for issue where get_ad_creatives would throw:
 'TypeError: 'dict' object is not callable'
 
-This was caused by trying to call ad_creative_images(creative) where 
-ad_creative_images is a dictionary, not a function.
+This was caused by trying to call ad_creative_images(creative), which was a
+dictionary, not a function. That dictionary is gone (GHSA-25fp-988j-w29f).
 
 The fix was to create extract_creative_image_urls() function and use that instead.
 """
@@ -13,7 +13,6 @@
 import json
 from unittest.mock import AsyncMock, patch
 from meta_ads_mcp.core.ads import get_ad_creatives
-from meta_ads_mcp.core.utils import ad_creative_images
 
 
 @pytest.mark.asyncio
@@ -172,19 +171,3 @@ async def test_get_ad_creatives_strips_standard_enhancements(self):
             assert creative["creative_features_spec"]["image_touchups"]["enroll_status"] == "OPT_IN"
             assert "standard_enhancements" not in creative["degrees_of_freedom_spec"]["creative_features_spec"]
             assert creative["degrees_of_freedom_spec"]["creative_features_spec"]["profile_card"]["enroll_status"] == "OPT_IN"
-
-
-def test_ad_creative_images_is_dict():
-    """Test that ad_creative_images is a dictionary, not a function.
-    
-    This confirms the original issue: ad_creative_images is a dict for storing image data,
-    but was being called as a function ad_creative_images(creative), which would fail.
-    This test ensures we don't accidentally change ad_creative_images to a function
-    and break its intended purpose as a storage dictionary.
-    """
-    assert isinstance(ad_creative_images, dict)
-    
-    # This would raise TypeError: 'dict' object is not callable
-    # This is the original bug - trying to call a dict as a function
-    with pytest.raises(TypeError, match="'dict' object is not callable"):
-        ad_creative_images({"test": "data"})