Mirror_Repos/anomalyco_opencode
2
0
Fork 0
Code Issues Pull Requests Actions 74 Packages Projects Releases Wiki Activity

fix(mcp): escape OAuth callback errors (#32242)

Browse Source
This commit is contained in:
Aiden Cline
2026-06-14 20:14:36 -05:00
committed by GitHub
parent 85e278b728
commit e4ccb505bf
2 changed files with 41 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/opencode/src/mcp/oauth-callback.ts
+15 -6
View File
@@ -26,6 +26,15 @@ const HTML_SUCCESS = `<!DOCTYPE html>
</body>
</html>`
function escapeHtml(value: string) {
return value
.replaceAll("&", "&amp;")
.replaceAll("<", "&lt;")
.replaceAll(">", "&gt;")
.replaceAll('"', "&quot;")
.replaceAll("'", "&#39;")
}
const HTML_ERROR = (error: string) => `<!DOCTYPE html>
<html>
<head>
@@ -42,7 +51,7 @@ const HTML_ERROR = (error: string) => `<!DOCTYPE html>
<div class="container">
<h1>Authorization Failed</h1>
<p>An error occurred during authorization.</p>
<div class="error">${error}</div>
<div class="error">${escapeHtml(error)}</div>
</div>
</body>
</html>`
@@ -87,7 +96,7 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
// Enforce state parameter presence
if (!state) {
const errorMsg = "Missing required state parameter - potential CSRF attack"
res.writeHead(400, { "Content-Type": "text/html" })
res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR(errorMsg))
return
}
@@ -101,13 +110,13 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
cleanupStateIndex(state)
pending.reject(new Error(errorMsg))
}
res.writeHead(200, { "Content-Type": "text/html" })
res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR(errorMsg))
return
}
if (!code) {
res.writeHead(400, { "Content-Type": "text/html" })
res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR("No authorization code provided"))
return
}
@@ -115,7 +124,7 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
// Validate state parameter
if (!pendingAuths.has(state)) {
const errorMsg = "Invalid or expired state parameter - potential CSRF attack"
res.writeHead(400, { "Content-Type": "text/html" })
res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR(errorMsg))
return
}
@@ -127,7 +136,7 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
cleanupStateIndex(state)
pending.resolve(code)
res.writeHead(200, { "Content-Type": "text/html" })
res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_SUCCESS)
}