Repository navigation
Conversation
The wildcard-port patterns (e.g. "localhost:*") used a bare prefix match, so values like "localhost:evil.com" or "http://localhost:3000.evil.com" were accepted. Require a non-empty ASCII-digits-only port after the prefix.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1192
Motivation and Context
Wildcard-port patterns (
localhost:*,http://localhost:*) matched with a barestartsWith(base + ":"), so values like127.0.0.1:evil.com,localhost:@evil.comandhttp://localhost:3000.evil.comwere accepted. Browsers can't send these headers, so this is hardening and correctness rather than a standalone bypass. Related: modelcontextprotocol/python-sdk#3364. The Swift SDK already requires a digits-only port.What changed
After the prefix, the remainder must be a non-empty string of ASCII digits. The no-port form (
localhost) and exact matches are unchanged. No 1-65535 range check, matching Swift. One side effect: an Origin likehttp://localhost:8080/pathis now rejected; real Origin headers never include a path.How Has This Been Tested?
New parameterized tests for the Origin and Host wildcard cases (bad suffixes rejected,
127.0.0.1:8080andhttp://localhost:3000still accepted). Reverting the fix makes 16 of them fail. The whole mcp-core module passes (585 tests) with spring-javaformat validation. The Docker-based mcp-test integration tests weren't run locally.Types of changes
Checklist