stacklok / toolhive / 30352921632

70%

Build Type

push

github

Committed by web-flow

Commit Message

Close authz response filter bypasses via media type and status (#6092)

Close authz filter bypasses via media type and status

The authz response filter only filtered list results labeled exactly
"application/json" or "text/event-stream" on HTTP 200/202. RFC 9110
makes media types case-insensitive and allows whitespace before
parameters, and fetch-based MCP clients accept any 2xx status, so a
backend could return "Application/JSON", "application/json ;
charset=utf-8", or HTTP 201 and deliver the complete unfiltered
inventory to the caller, silently. Both bypasses were confirmed by an
executed test harness.

Normalize the media type before matching, filter the whole 2xx range,
and sniff unrecognized media types on filtered methods for JSON-RPC
results so a mislabeled list fails closed, mirroring the hardened
sibling filter in pkg/mcp/tool_filter.go.


Claude-Session: https://claude.ai/code/session_01Y5WXPQr5Da9Cox2nZWhg6n

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Coverage Stats

41 of 41 new or added lines in 1 file covered. (100.0%)

15 existing lines in 3 files now uncovered.

81403 of 116669 relevant lines covered (69.77%)

98.53 hits per line