modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

all: use case-sensitive JSON unmarshaling (#807)

Browse source 
As reported in
https://github.com/modelcontextprotocol/go-sdk/issues/805, case
insensitive unmarshaling can pose security issues. This change adjusts
all non-test and non-example unmarshaling to use a case sensitive mode.

This introduces a new external dependency
`github.com/segmentio/encoding`.
This commit is contained in:
Maciej Kisiel 2026-02-18 16:38:36 +01:00 • committed by GitHub
commit 7b8d81c264
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 134 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

8
mcp/content.go
View file

@ -10,6 +10,8 @@ package mcp
import (
"encoding/json"
"fmt"
internaljson "github.com/modelcontextprotocol/go-sdk/internal/json"
)
// A Content is a [TextContent], [ImageContent], [AudioContent],
@ -248,7 +250,7 @@ func (c *ToolResultContent) MarshalJSON() ([]byte, error) {
return nil, err
}
var w wireContent
if err := json.Unmarshal(data, &w); err != nil {
if err := internaljson.Unmarshal(data, &w); err != nil {
return nil, err
}
contentWire = append(contentWire, &w)
@ -328,11 +330,11 @@ func unmarshalContent(raw json.RawMessage, allow map[string]bool) ([]Content, er
}
// Try array first, then fall back to single object.
var wires []*wireContent
if err := json.Unmarshal(raw, &wires); err == nil {
if err := internaljson.Unmarshal(raw, &wires); err == nil {
return contentsFromWire(wires, allow)
}
var wire wireContent
if err := json.Unmarshal(raw, &wire); err != nil {
if err := internaljson.Unmarshal(raw, &wire); err != nil {
return nil, err
}
c, err := contentFromWire(&wire, allow)