modelcontextprotocol/java-sdk
Watch
1
0
Fork
You've already forked java-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DefaultSseMessageEndpointValidator allows same-origin message endpoints

Browse source 
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
This commit is contained in:
Daniel Garnier-Moiroux 2026-05-04 10:16:45 +02:00 • committed by Daniel Garnier-Moiroux
commit bf30e21f0d
1 changed files with 25 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

25
mcp-core/src/main/java/io/modelcontextprotocol/client/transport/DefaultSseMessageEndpointValidator.java
View file

@ -10,8 +10,8 @@ import io.modelcontextprotocol.util.Assert;
/**
* Default {@link SseMessageEndpointValidator} that validates the {@code message} endpoint
* advertised by an SSE server. Message endpoints must be a relative URI, without path
* traversal or authority.
* advertised by an SSE server. Message endpoints must either have the same origin as the
* SSE uri, or be a relative uri.
*
* @author Daniel Garnier-Moiroux
*/
@ -30,16 +30,19 @@ public final class DefaultSseMessageEndpointValidator implements SseMessageEndpo
messageEndpoint);
}
if (endpointUri.isAbsolute()) {
// Exclude absolute URIs e.g. https://example.com/mcp
throw new InvalidSseMessageEndpointException("messageEndpoint must be a relative path, not an absolute URI",
messageEndpoint);
}
if (endpointUri.isAbsolute() || endpointUri.getRawAuthority() != null) {
String scheme = endpointUri.getScheme();
String host = endpointUri.getHost();
int port = endpointUri.getPort();
if (endpointUri.getRawAuthority() != null) {
// Exclude network paths e.g. //example.com/mcp
throw new InvalidSseMessageEndpointException(
"messageEndpoint must be a relative path and must not contain an authority", messageEndpoint);
boolean sameScheme = scheme != null && scheme.equalsIgnoreCase(sseUri.getScheme());
boolean sameHost = host != null && host.equalsIgnoreCase(sseUri.getHost());
boolean samePort = port == sseUri.getPort();
if (!sameScheme || !sameHost || !samePort) {
throw new InvalidSseMessageEndpointException(
"messageEndpoint must be a relative path or a same-origin URI", messageEndpoint);
}
}
// Exclude path-traversal