modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Server] Handle malformed JSON-RPC input graceful (#412)

Browse source 
* Never let a throwable escape Protocol::processInput()

* Validate payload types in the schema hydration methods

* Stop leaking handler exception messages to the client
This commit is contained in:
Christopher Hertel 2026-08-14 22:34:01 +02:00 • committed by GitHub
commit c8ed07bba2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 858 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

36
tests/Unit/JsonRpc/MessageFactoryTest.php
View file

@ -21,6 +21,7 @@ use Mcp\Schema\Notification\InitializedNotification;
use Mcp\Schema\Request\ElicitRequest;
use Mcp\Schema\Request\GetPromptRequest;
use Mcp\Schema\Request\PingRequest;
use PHPUnit\Framework\Attributes\DataProvider;
use PHPUnit\Framework\TestCase;
final class MessageFactoryTest extends TestCase
@ -452,6 +453,41 @@ final class MessageFactoryTest extends TestCase
$this->assertInstanceOf(InvalidInputMessageException::class, $results[1]);
}
/**
* @return iterable<string, array{string}>
*/
public static function provideNonStringMethods(): iterable
{
yield 'object' => ['{"evil": true}'];
yield 'array' => ['[1, 2, 3]'];
yield 'int' => ['5'];
yield 'bool' => ['true'];
}
#[DataProvider('provideNonStringMethods')]
public function testNonStringMethodIsRejected(string $method): void
{
$results = $this->factory->create(\sprintf('{"jsonrpc": "2.0", "id": 1, "method": %s}', $method));
$this->assertCount(1, $results);
$this->assertInstanceOf(InvalidInputMessageException::class, $results[0]);
$this->assertStringContainsString('"method" must be a string', $results[0]->getMessage());
}
public function testBatchWithNonStringMethodStillYieldsTheValidMessages(): void
{
$json = '[
{"jsonrpc": "2.0", "method": "ping", "id": 1},
{"jsonrpc": "2.0", "method": {}, "id": 2}
]';
$results = $this->factory->create($json);
$this->assertCount(2, $results);
$this->assertInstanceOf(PingRequest::class, $results[0]);
$this->assertInstanceOf(InvalidInputMessageException::class, $results[1]);
}
public function testLeadingWhitespaceObjectIsParsedAsSingleMessage(): void
{
$json = " \n {\"jsonrpc\": \"2.0\", \"method\": \"ping\", \"id\": 1}";