stacklok / toolhive / 34208266711

71%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

The authorization middleware and the MCP parser both skipped any request
whose path ended in "/sse". The skip existed for SSE stream establishment,
which is a GET, but it was written as a suffix test and reached on POST --
the method that carries MCP messages. On the transparent proxy, which
mounts "/" as a catch-all, a JSON POST to /sse or any */sse path therefore
reached the backend with no policy check, returned unfiltered tools/list
results, and was recorded in the audit log as a generic http_request with
no method or tool name.

No path test belongs in either predicate. There is no fixed MCP endpoint
path: the streamable transport's path is server-chosen, and in 2024-11-05
HTTP+SSE the server names its own message endpoint in the endpoint event,
which ToolHive's proxies forward as given. Tightening the suffix to an
exact match would have closed the reported paths while keeping the shape
of the bug, so both branches are deleted instead. Every JSON POST is now
parsed and authorized regardless of path.

vMCP mounts its MCP handler as a catch-all too, so the parser change makes
requests on arbitrary paths newly visible to the revision-classifying
handler. Scope classification to the configured endpoint path so a
Modern-_meta POST to an unrelated path does not reach dispatchModern. That
gate is routing only -- authorization is enforced independently on both
sides of it.

Fixes GHSA-h4mf-84xq-q2fc

Coverage Stats

8 of 8 new or added lines in 3 files covered. (100.0%)

12 existing lines in 4 files now uncovered.

79005 of 112662 relevant lines covered (70.13%)

93.42 hits per line