modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

all: use case-sensitive JSON unmarshaling (#807)

Browse source 
As reported in
https://github.com/modelcontextprotocol/go-sdk/issues/805, case
insensitive unmarshaling can pose security issues. This change adjusts
all non-test and non-example unmarshaling to use a case sensitive mode.

This introduces a new external dependency
`github.com/segmentio/encoding`.
This commit is contained in:
Maciej Kisiel 2026-02-18 16:38:36 +01:00 • committed by GitHub
commit 7b8d81c264
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 134 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

5
mcp/server.go
View file

@ -25,6 +25,7 @@ import (
"time"
"github.com/google/jsonschema-go/jsonschema"
internaljson "github.com/modelcontextprotocol/go-sdk/internal/json"
"github.com/modelcontextprotocol/go-sdk/internal/jsonrpc2"
"github.com/modelcontextprotocol/go-sdk/internal/util"
"github.com/modelcontextprotocol/go-sdk/jsonrpc"
@ -327,7 +328,7 @@ func toolForErr[In, Out any](t *Tool, h ToolHandlerFor[In, Out], cache *SchemaCa
// Unmarshal and validate args.
var in In
if input != nil {
if err := json.Unmarshal(input, &in); err != nil {
if err := internaljson.Unmarshal(input, &in); err != nil {
return nil, fmt.Errorf("%w: %v", jsonrpc2.ErrInvalidParams, err)
}
}
@ -1371,7 +1372,7 @@ func initializeMethodInfo() methodInfo {
info.unmarshalParams = func(m json.RawMessage) (Params, error) {
var params *initializeParamsV2
if m != nil {
if err := json.Unmarshal(m, &params); err != nil {
if err := internaljson.Unmarshal(m, &params); err != nil {
return nil, fmt.Errorf("unmarshaling %q into a %T: %w", m, params, err)
}
}