Repository navigation
fix(core): reject dot segments in API request paths - #470
Conversation
![ferrfleet-interne[bot]](https://avatars.githubusercontent.com/in/5311663?s=60&v=4){kind=small}
There was a problem hiding this comment.
Blocking: percent-encoded (%2e%2e) and backslash dot segments get past assertNoDotSegments, and fetch still normalises them away. Fix inline. The rest looks right: the error class, the export, and where the check runs (before assertCredentialTarget).
There was a problem hiding this comment.
The earlier finding is fixed in 1860687: %2e and backslash segments are now rejected and tested. Blocking: tabs and newlines inside a segment still get past the check (see inline).
There was a problem hiding this comment.
The tab/newline bypass is fixed in 6172fc0: tab, LF and CR are stripped before splitting, %2e is decoded afterwards, and both cases are in the test table. No blocking findings left. I couldn't run node here, so this rests on reading the URL spec, not on running the tests.
## [10.14.2] - 2026-10-25 ### Bug Fixes - fix(core): reject dot segments in API request paths (#470)
encodeURIComponentleaves.and..untouched, so an id argument of..retargets the request to a parent route oncefetchnormalizes the URL.apiRequestnow throwsInvalidApiPathErrorfor any.or..path segment before fetching. The check lives in mcp-core, so every tool and product server built on it is covered without touching each schema.Tests cover rejected paths (including with a query string) and allowed dots inside a segment or the query.
Closes #463