From 445ea42adcfa708fc97fa7681c5be9bebbb86816 Mon Sep 17 00:00:00 2001
From: Den Delimarsky <53200638+localden@users.noreply.github.com>
Date: Fri, 3 Oct 2025 10:00:51 -0700
Subject: [PATCH] Update sample with URI validation (#824)

---
 samples/ProtectedMcpClient/Program.cs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/samples/ProtectedMcpClient/Program.cs b/samples/ProtectedMcpClient/Program.cs
index 9dc2410..042d477 100644
--- a/samples/ProtectedMcpClient/Program.cs
+++ b/samples/ProtectedMcpClient/Program.cs
@@ -134,6 +134,13 @@ static async Task<string?> HandleAuthorizationUrlAsync(Uri authorizationUrl, Uri
 /// <param name="url">The URL to open.</param>
 static void OpenBrowser(Uri url)
 {
+    // Validate the URI scheme - only allow safe protocols
+    if (url.Scheme != Uri.UriSchemeHttp && url.Scheme != Uri.UriSchemeHttps)
+    {
+        Console.WriteLine($"Error: Only HTTP and HTTPS URLs are allowed.");
+        return;
+    }
+
     try
     {
         var psi = new ProcessStartInfo
@@ -145,7 +152,7 @@ static void OpenBrowser(Uri url)
     }
     catch (Exception ex)
     {
-        Console.WriteLine($"Error opening browser. {ex.Message}");
+        Console.WriteLine($"Error opening browser: {ex.Message}");
         Console.WriteLine($"Please manually open this URL: {url}");
     }
 }
\ No newline at end of file