stacklok / toolhive / 41832476071

73%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Accept only canonical resource URIs

Authorization compares a resource URI as an exact string, but MCP
servers built on the TypeScript and Python SDKs look a resource up by a
normalized form of the requested URI: both lower-case the scheme,
remove dot segments including %2e%2e, strip surrounding whitespace and
rewrite file://localhost/x to file:///x. A policy that forbids one URI
therefore did not cover its other spellings.

The proxy now accepts a resource URI only when it is already in
canonical form, meaning WHATWG URL serialization leaves it unchanged
and it passes a few RFC 3986 normalization rules, and denies any other
URI with a 403 before a policy is evaluated. This applies to
resources/read, resources/subscribe, resources/unsubscribe and each URI
in subscriptions/listen, for every authorizer. The warning log names
the rule that refused the URI, never the URI itself. Resource template
refs in completion/complete are only refused when empty or containing a
space or control character, because a template is not a URI and SDKs
match template refs exactly. List filtering is unchanged.

With authorization configured, a backend that lists a URI not in
canonical form can no longer have that resource read. Deployments
without authorization are unaffected.

C# SDK servers are only partly covered: the case of a non-special host
and user information are accepted as sent, so the docs recommend an
allow-list for C# backends.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Apply canonical resource URI checks in vMCP

Virtual MCP authorizes resource reads in its admission layer rather
than the authorization middleware, so it did not get the proxy's
canonical-form check.

The Cedar admission now refuses a resource read, and the pre-dispatch
read check, when the URI is not in canonical form, before any policy is
evaluated, and logs the rule that refused it. Admission gains
AllowResourceTemplateRead for completion/complete with a ref/re... (continued)

Coverage Stats

269 of 274 new or added lines in 6 files covered. (98.18%)

55 existing lines in 4 files now uncovered.

92905 of 128041 relevant lines covered (72.56%)

136.63 hits per line