inspector/clients/web/src/test/core
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall 7bcf155e06 fix: scope the value ceiling to the names a template references
Addresses Copilot's round-19 review on #2035 -- a divergence introduced by
my own round-14 guard rather than by the original code.

The SDK validated a value inside `encodeValue`, i.e. only after looking one
up by a DECLARED name. The restored guard checked the caller's whole map, so
an unrelated entry failed a template that never mentions it. Measured on
9caac43d:

  tryExpandUriTemplate("x://{id}", { id: "7", stale: "a".repeat(1_000_001) })
    =>  error: The value for "stale" exceeds the 1000000-character limit

RFC 6570 ignores an extra variable, so this refused a perfectly valid read.
`valueLengthError` now takes the names to consider and both callers pass the
template's declared set.

Copilot's second half is worth taking on its own: strict expansion parsed
the template THREE times -- inside `templateError`, again for the name list,
again to expand -- and the template is server-controlled and may be 1 MB.
It is now parsed once and reused, with validation split into
`sdkTemplateError` (the constructor's unclosed-brace and length/count
limits) and `partsError` (this module's own grammar), so `templateError` and
strict expansion share both halves rather than duplicating either.

npm run ci passes.

Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-17 01:54:37 -04:00
..
auth Merge pull request #2037 from modelcontextprotocol/v2/feat/1906-auth-token-url-overrides 2026-08-16 22:49:19 -04:00
client feat(auth): per-server authorization and token URL overrides 2026-08-16 20:36:24 -04:00
logging feat: port CLI, TUI, and launcher from v1.5 into v2 (#1452) 2026-06-14 20:27:49 -04:00
mcp fix: scope the value ceiling to the names a template references 2026-08-17 01:54:37 -04:00
node feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796) 2026-07-26 22:15:10 -04:00
react test(web): drop the double cast from the CRLF SSE stream mocks 2026-08-16 20:47:01 -04:00
storage feat(servers): persist server list to ~/.mcp-inspector/mcp.json (#1343) (#1349) 2026-05-23 14:26:23 -04:00
apps.test.ts SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') (#1624) 2026-07-15 10:44:24 -04:00
jsonUtils.test.ts chore: close quality-gate coverage gaps (#1689) (#1766) 2026-07-24 17:20:12 -04:00
nullableUnion.test.ts fix: decline empty enums, drop mislabelling enumNames, treat $ref as opaque 2026-08-15 20:27:19 -04:00
remote-tokenAuthProvider.test.ts All of the mid-session and step-up auth work 2026-07-02 16:35:31 -07:00
taskNotificationSchemas.test.ts test(coverage): bootstrap vitest unit infra and add tests at 90%+ per file (#1245) (#1269) 2026-05-01 15:15:32 -04:00
xMcpHeader.test.ts fix(core): mirror SEP-2243 x-mcp-header args to Mcp-Param-* on tools/call (#1847) 2026-07-28 19:19:48 -04:00