modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

internal/oauthex: address URL attacks in PRM (#539)

Browse source 
Fix Protected Resource Metadata to prevent URL attacks, as described in
the issue.

For #526
This commit is contained in:
Jonathan Amsterdam 2025-09-30 07:33:59 -04:00 • committed by GitHub
commit fd0dc9d741
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 31 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
internal/oauthex/resource_meta.go
View file

@ -159,11 +159,11 @@ func GetProtectedResourceMetadataFromHeader(ctx context.Context, header http.Hea
// getPRM makes a GET request to the given URL, and validates the response.
// As part of the validation, it compares the returned resource field to wantResource.
func getPRM(ctx context.Context, url string, c *http.Client, wantResource string) (*ProtectedResourceMetadata, error) {
if !strings.HasPrefix(strings.ToUpper(url), "HTTPS://") {
return nil, fmt.Errorf("resource URL %q does not use HTTPS", url)
func getPRM(ctx context.Context, purl string, c *http.Client, wantResource string) (*ProtectedResourceMetadata, error) {
if !strings.HasPrefix(strings.ToUpper(purl), "HTTPS://") {
return nil, fmt.Errorf("resource URL %q does not use HTTPS", purl)
}
prm, err := getJSON[ProtectedResourceMetadata](ctx, c, url, 1<<20)
prm, err := getJSON[ProtectedResourceMetadata](ctx, c, purl, 1<<20)
if err != nil {
return nil, err
}
@ -171,6 +171,12 @@ func getPRM(ctx context.Context, url string, c *http.Client, wantResource string
if prm.Resource != wantResource {
return nil, fmt.Errorf("got metadata resource %q, want %q", prm.Resource, wantResource)
}
// Validate the authorization server URLs to prevent XSS attacks (see #526).
for _, u := range prm.AuthorizationServers {
if err := checkURLScheme(u); err != nil {
return nil, err
}
}
return prm, nil
}