Skip to content

fix(mcp): escape OAuth callback errors#32242

Open
rekram1-node wants to merge 1 commit into
devfrom
oauth-xss
Open

fix(mcp): escape OAuth callback errors#32242
rekram1-node wants to merge 1 commit into
devfrom
oauth-xss

Conversation

@rekram1-node

Copy link
Copy Markdown
Collaborator

Summary

  • escape provider-controlled OAuth callback errors before rendering HTML
  • declare UTF-8 for callback HTML responses
  • add regression coverage for hostile markup and readable normal errors

Tests

  • bun test test/mcp/oauth-callback.test.ts (6 pass)

Closes #17364
Related to #28567

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(mcp): OAuth callback error page XSS via unescaped error parameter (CWE-79)

1 participant