modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

all: use case-sensitive JSON unmarshaling (#807)

Browse source 
As reported in
https://github.com/modelcontextprotocol/go-sdk/issues/805, case
insensitive unmarshaling can pose security issues. This change adjusts
all non-test and non-example unmarshaling to use a case sensitive mode.

This introduces a new external dependency
`github.com/segmentio/encoding`.
This commit is contained in:
Maciej Kisiel 2026-02-18 16:38:36 +01:00 • committed by GitHub
commit 7b8d81c264
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 134 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

8
oauthex/dcr.go
View file

@ -17,6 +17,8 @@ import (
"io"
"net/http"
"time"
internaljson "github.com/modelcontextprotocol/go-sdk/internal/json"
)
// ClientRegistrationMetadata represents the client metadata fields for the DCR POST request (RFC 7591).
@ -144,7 +146,7 @@ func (r *ClientRegistrationResponse) UnmarshalJSON(data []byte) error {
}{
alias: (*alias)(r),
}
if err := json.Unmarshal(data, &aux); err != nil {
if err := internaljson.Unmarshal(data, &aux); err != nil {
return err
}
if aux.ClientIDIssuedAt != 0 {
@ -206,7 +208,7 @@ func RegisterClient(ctx context.Context, registrationEndpoint string, clientMeta
if resp.StatusCode == http.StatusCreated {
var regResponse ClientRegistrationResponse
if err := json.Unmarshal(body, &regResponse); err != nil {
if err := internaljson.Unmarshal(body, &regResponse); err != nil {
return nil, fmt.Errorf("failed to decode successful registration response: %w (%s)", err, string(body))
}
if regResponse.ClientID == "" {
@ -221,7 +223,7 @@ func RegisterClient(ctx context.Context, registrationEndpoint string, clientMeta
if resp.StatusCode == http.StatusBadRequest {
var regError ClientRegistrationError
if err := json.Unmarshal(body, &regError); err != nil {
if err := internaljson.Unmarshal(body, &regError); err != nil {
return nil, fmt.Errorf("failed to decode registration error response: %w (%s)", err, string(body))
}
return nil, &regError