Security hardening for Agent and MCP subsystems - #997
Merged
Conversation
Add protections and warnings to MCP/Agent subsystems to reduce SSRF, XSS, and sensitive-data leakage. Key changes: - Block MCP client connections to private/internal addresses (RFC1918, loopback, link-local, IPv6 unique-local, cloud metadata endpoints) via URL validation in client and registerServer. - Sanitize MCP error strings before broadcasting (strip control characters and truncate to 500 chars). - Remove OAuth state value from consumeState warning logs to avoid logging sensitive tokens. - Add one-time deprecation warnings: sendIdentityOnConnect default will change in next major; warn when CORS allows Authorization with a wildcard origin. - Adjust CORS helpers/worker transport to respect explicit origin/headers and emit the new warning when applicable. - Add unit tests covering SSRF URL validation and CORS header behavior. These changes aim to mitigate SSRF/XSS risks and reduce accidental exposure of sensitive OAuth state in logs.
🦋 Changeset detectedLatest commit: c5170bf The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
commit: |
Fix isBlockedUrl IPv6 checks to handle hostnames that include brackets (e.g. "[fc00::1]"). The code now detects bracketed IPv6 hostnames, strips the brackets, lowercases the address into `addr`, and correctly checks unique-local (fc00::/7) and link-local (fe80::/10) prefixes. Also updates related comments for clarity.
Merged
dmmulroy
pushed a commit
that referenced
this pull request
Feb 26, 2026
* Security hardening: SSRF, sanitization, CORS Add protections and warnings to MCP/Agent subsystems to reduce SSRF, XSS, and sensitive-data leakage. Key changes: - Block MCP client connections to private/internal addresses (RFC1918, loopback, link-local, IPv6 unique-local, cloud metadata endpoints) via URL validation in client and registerServer. - Sanitize MCP error strings before broadcasting (strip control characters and truncate to 500 chars). - Remove OAuth state value from consumeState warning logs to avoid logging sensitive tokens. - Add one-time deprecation warnings: sendIdentityOnConnect default will change in next major; warn when CORS allows Authorization with a wildcard origin. - Adjust CORS helpers/worker transport to respect explicit origin/headers and emit the new warning when applicable. - Add unit tests covering SSRF URL validation and CORS header behavior. These changes aim to mitigate SSRF/XSS risks and reduce accidental exposure of sensitive OAuth state in logs. * Handle IPv6 hostnames with brackets Fix isBlockedUrl IPv6 checks to handle hostnames that include brackets (e.g. "[fc00::1]"). The code now detects bracketed IPv6 hostnames, strips the brackets, lowercases the address into `addr`, and correctly checks unique-local (fc00::/7) and link-local (fe80::/10) prefixes. Also updates related comments for clarity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security hardening for the Agent class and MCP subsystem, addressing findings from a security review.
Changes
SSRF protection (
src/mcp/client.ts)isBlockedUrl()validation toregisterServer()andconnect()fc00::/7) and link-local (fe80::/10) rangesOAuth log redaction (
src/mcp/do-oauth-client-provider.ts)consumeStatewarning log to prevent sensitive data leakageError sanitization (
src/index.ts)sanitizeErrorString()— strips C0 control characters and truncates to 500 charsgetMcpServers()before broadcastingconnectionErrorto clients, mitigating XSS riskDeprecation warnings (non-breaking, prep for next major)
sendIdentityOnConnect: one-timeconsole.warnwhen default (true) is used without explicit opt-in (src/index.ts)Authorizationheader: one-timeconsole.warnwhenAuthorizationis in allowed headers with wildcard origin (src/mcp/worker-transport.ts,src/mcp/utils.ts)Tests
client-manager.test.ts)client-manager.test.ts)worker-transport.test.ts)Non-breaking
All changes are backward-compatible. The two items that will become breaking in the next major version (identity default, CORS Authorization default) are behind deprecation warnings only.