RDFPortal-MCP

CRITICAL: The `save_MIE_file` function in `src/server.py` is vulnerable to path traversal. The `dbname` parameter is directly used in `os.path.join(MIE_DIR, f'{dbname}.yaml')`. If a malicious `dbname` (e.g., `../../../malicious.yaml`) is provided, an attacker can write arbitrary content to files outside the intended 'mie' directory. This constitutes a severe remote arbitrary file write vulnerability, which can lead to Remote Code Execution (RCE) if an attacker can write to sensitive locations on the server's file system. Additionally, the server allows execution of arbitrary SPARQL queries on configured endpoints. While endpoints are whitelisted, the queries themselves are not sanitized, posing a potential risk of denial of service or data exfiltration on the target SPARQL endpoints.