modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

fix: count a pct-triplet as one character when truncating a prefix

Browse source 
Addresses Copilot's round-9 review on #2035.

RFC 6570 2.4.1 counts the prefix in *characters* and is explicit that a
pct-encoded triplet counts as a single one. Truncation went by code point,
so it cut a triplet in half -- measured on 6acaff70:

  x{+v:5}  v = "%61%62%63%64%65%66"  =>  "x%61%256"

The orphaned "%6" is not a triplet, so encodeAllowReserved then (correctly)
escaped its `%`, and the value went out carrying a byte the caller never
asked for. Now "x%61%62%63%64%65".

Triplets are units only under `+` and `#`. Under every other operator the
encoder escapes a `%` anyway (`%61` -> `%2561`), so the three characters
really are three and grouping them would mis-count the prefix -- asserted
both ways. Astral code points remain single units under both, which is what
`Array.from` was there for.

Also corrects the comment on `readResourceFromTemplate`, which still said
the shared helper drops blank values. It has not since 6acaff70: `params`
passes through as given, so only an absent key omits its expression and a
direct API caller can request `?q=` deliberately. A caller whose values come
from a form drops its own blanks first.

Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-16 23:18:20 -04:00
commit 52abe8a165
1 changed files with 85 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

16
core/mcp/inspectorClient.ts
View file

@ -4972,11 +4972,17 @@ export class InspectorClient extends InspectorClientEventTarget {
const uriTemplateString = uriTemplate;
// Expand through the shared helper in ./uriTemplate.js so this and the web
// Resources form cannot disagree. It drops blank values so an unfilled
// optional field reads as *undefined* (the expression disappears) rather
// than as the empty string (a valueless `?topic=`), and it covers the
// expression shapes the SDK's own expander gets wrong -- `{a,b}`, `{;id}`,
// and the `{id:3}` prefix modifier (#1919).
// Resources form cannot disagree. It covers the expression shapes the SDK's
// own expander gets wrong -- `{a,b}`, `{;id}`, and the `{id:3}` prefix
// modifier (#1919).
//
// `params` is passed through AS GIVEN. Only an *absent* key omits its
// expression; a key present with `""` is a defined RFC 6570 value and
// expands (`{?q}` -> `?q=`, `{;q}` -> `;q`), which is what lets a caller
// request those URIs deliberately. A caller whose values come from a form
// -- where an untouched field is indistinguishable from a deliberately
// empty one -- drops its blanks with `definedValues` first, as the TUI's
// ResourceTestModal does.
let expandedUri: string;
try {
expandedUri = expandUriTemplateStrict(uriTemplateString, params);