anthropics / anthropics/claude-code

PII filter incorrectly sanitizes Figma node IDs in MCP tool responses

未关闭
#91,537 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
area:mcp area:security bug
主要语言
Python
星标
145k
派生
23.1k
PR 合并指标
PR 指标待抓取

描述

## Bug Description

The system-level PII (phone number) filter is incorrectly sanitizing Figma node IDs returned from Atlassian/Jira MCP tool responses. Figma node IDs use a `XXXX-XXXXX` numeric format (e.g., `2006-14129`) which matches phone number patterns, causing them to be replaced with `PHONE_X` placeholders.

## Impact

This completely blocks design-to-code workflows where Jira tickets contain Figma URLs with node IDs. The node IDs are essential for navigating to specific design frames (e.g., VQA documentation, component specs).

## Reproduction

1. Have a Jira ticket with a Figma URL containing a node-id parameter (e.g., `?node-id=2006-14129`)
2. Use any Atlassian MCP tool to read the ticket (`getJiraIssue`, `fetch`, `searchJiraIssuesUsingJql`, `search`, etc.)
3. The node-id value is replaced with `PHONE_X` in the response

## Workarounds Attempted (All Failed)

- `getJiraIssue` with markdown format
- `getJiraIssue` with ADF format
- `getTeamworkGraphContext` (ExternalDesign filter + unfiltered)
- `getJiraIssueRemoteIssueLinks`
- `fetch` with ARI
- `searchJiraIssuesUsingJql`
- Rovo `search`

All return sanitized `PHONE_X` values because the filter operates on all tool output text regardless of the tool or format.

## Workaround That Works

Reading the same URLs from source code files (e.g., Figma Code Connect `.figma.tsx` files) is NOT affected, since the PII filter apparently does not apply to file reads. Short node IDs like `2-62` also survive the filter — only longer numeric patterns trigger it.

## Expected Behavior

Figma node IDs in URLs should not be treated as phone numbers. The filter should be context-aware enough to recognize URL query parameters (especially `node-id=`) as non-PII data.

## Environment

- Claude Code CLI
- Atlassian MCP plugin
- Figma MCP plugin

贡献指南

这个仓库没有索引到贡献指南

调研方向

Reproduce the issue with getJiraIssue or fetch using a Jira ticket containing ?node-id=2006-14129, and compare the response with a source-code read of a .figma.tsx file. Trace the system-level PII filter and verify that Figma node IDs remain unchanged while phone-number sanitization still works across Atlassian MCP tool responses.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
cli, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
活跃
描述清晰度
基本清楚
新手友好度
55/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。