- Create shared validateRedirectUrl utility to centralize URL validation
- Only allow HTTP and HTTPS protocols in OAuth authorization URLs
- Fix three vulnerable redirect paths that bypassed validation:
- AuthDebugger.tsx: Direct window.location.href redirect
- OAuthFlowProgress.tsx: window.open() without validation
- OAuthFlowProgress.tsx: Direct anchor href attribute
- Add comprehensive test coverage for URL validation
- Update existing auth.ts to use shared validation utility
This prevents malicious MCP servers from injecting javascript: or data:
protocol URLs that would execute XSS attacks when users are redirected
to the authorization endpoint.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* wip auth debugger
* cleanup types and validation
* more cleanup
* draft test
* wip clean up some
* rm toasts
* consolidate state management
* prettier
* hoist state up to App
* working with quick and guided
* sort out displaying debugger
* prettier
* cleanup types
* fix tests
* cleanup comment
* prettier
* fixup types in tests
* prettier
* refactor debug to avoid toasting
* callback shuffling
* linting
* types
* rm toast in test
* bump typescript sdk version to 0.11.2 for scope parameter passing
* use proper scope handling
* test scope parameter passing
* move functions and s/sseUrl/serverUrl/
* extract status message into component
* refactor progress and steps into components
* fix test
* rename quick handler
* one less click
* last step complete
* add state machine
* test and types
