7a6d1bc30aFollow-up to #1207, addressing items from the cargo validator review. **Scoped to cargo + shared helpers — no behavior change for existing npm/pypi/nuget/oci/mcpb publishers.** Safe to merge and promote. ### Changes **SSRF hardening of the two-call README retrieval** - Pin the step-2 README URL to an allowed host (`static.crates.io` in prod; the base host under test) *before* fetching, so a metadata response can't steer the validator at an internal/attacker host. - `CheckRedirect` policy pins every redirect hop to the same allowlist (the initial URL being pinned isn't enough if an upstream 3xx is followed). - Cap the README body with `io.LimitReader` (5 MiB). > Not publisher-exploitable today (the URL comes from crates.io), so this is defense-in-depth — but it makes the "host is pinned" guarantee hold in code rather than rely on crates.io's behavior. **Clearer status handling** (previously any non-5xx/non-200 collapsed to "not found") - **429** → reported as transient/retryable, at both the metadata and README steps. - **403** → disambiguated via the crate-version endpoint: genuinely-missing stays "not found"; *exists-but-no-README* gets an actionable "add a README with `mcp-name` and republish" message (mirrors the NuGet validator). This continues the 5xx-vs-403 diagnostic split @P4ST4S started in the #1207 review — thanks! **Shared `containsMCPNameToken` helper** Boundary-anchored ownership-token match (prevents prefix confusion, e.g. a README declaring `io.github.acme/widget-pro` satisfying a claim for `io.github.acme/widget`), used here **by the cargo validator only**. Adopting it in PyPI/NuGet is a separate follow-up because it's a behavior change for those already-live registries. **Tests & docs** Hermetic positive `ServerNameFormats`; combined fixture gains a version-existence endpoint + cases for 403-missing vs 403-no-README, 429, and prefix-confusion rejection; new foreign-README-host (SSRF) test; internal test for the helper. Docs: list `crates.io` in the registry-requirements list + the `Package` model doc. ### Testing `go build`, `go vet`, full `./internal/validators/...` suite (incl. live cargo positive), `make check-schema`, `validate-examples` all pass. No new `golangci-lint` findings. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
2.1 KiB
Go
53 lines
2.1 KiB
Go
package registries
|
|
|
|
import "strings"
|
|
|
|
// isServerNameChar reports whether c can appear in an MCP server name.
|
|
//
|
|
// Server names follow the schema pattern ^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$
|
|
// (reverse-DNS namespace + "/" + name), so the full set of characters that may
|
|
// continue a server name is [A-Za-z0-9._/-].
|
|
func isServerNameChar(c byte) bool {
|
|
switch {
|
|
case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9':
|
|
return true
|
|
case c == '.', c == '-', c == '_', c == '/':
|
|
return true
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
|
|
// containsMCPNameToken reports whether the package README/description contains
|
|
// the ownership token "mcp-name: <serverName>" as a complete token — i.e. the
|
|
// matched server name is not merely a prefix of a longer declared name.
|
|
//
|
|
// A bare strings.Contains check is vulnerable to prefix confusion: a README that
|
|
// legitimately declares `mcp-name: io.github.acme/widget-pro` would otherwise
|
|
// satisfy an ownership claim for the shorter `io.github.acme/widget`, because the
|
|
// shorter string is a substring of the longer one. This is contained by namespace
|
|
// authorization (a publisher can only claim names within a namespace they own),
|
|
// but it still weakens the crate↔server-name binding the token is meant to prove,
|
|
// so we require a trailing boundary: the character following the server name must
|
|
// be the end of the content or any non-server-name character (whitespace, a
|
|
// newline, or an HTML tag delimiter from a rendered README such as `<`).
|
|
//
|
|
// Shared by the README-token validators (PyPI, NuGet, Cargo). NPM is unaffected
|
|
// because it compares an exact metadata field rather than scanning README text.
|
|
func containsMCPNameToken(content, serverName string) bool {
|
|
token := "mcp-name: " + serverName
|
|
searchFrom := 0
|
|
for {
|
|
idx := strings.Index(content[searchFrom:], token)
|
|
if idx < 0 {
|
|
return false
|
|
}
|
|
tokenEnd := searchFrom + idx + len(token)
|
|
if tokenEnd >= len(content) || !isServerNameChar(content[tokenEnd]) {
|
|
return true
|
|
}
|
|
// This occurrence is a prefix of a longer name; keep scanning in case a
|
|
// properly-terminated occurrence appears later in the content.
|
|
searchFrom = searchFrom + idx + 1
|
|
}
|
|
}
|