ai-workspace-services/opencode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(mcp): escape OAuth callback errors (#32242)

Browse Source
This commit is contained in:
Aiden Cline 2026-06-14 20:14:36 -05:00 committed by GitHub
parent 85e278b728
commit e4ccb505bf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 41 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
packages/opencode/src/mcp/oauth-callback.ts
View File

@ -26,6 +26,15 @@ const HTML_SUCCESS = `<!DOCTYPE html>
</body>
</html>`
function escapeHtml(value: string) {
return value
.replaceAll("&", "&amp;")
.replaceAll("<", "&lt;")
.replaceAll(">", "&gt;")
.replaceAll('"', "&quot;")
.replaceAll("'", "&#39;")
}
const HTML_ERROR = (error: string) => `<!DOCTYPE html>
<html>
<head>
@ -42,7 +51,7 @@ const HTML_ERROR = (error: string) => `<!DOCTYPE html>
<div class="container">
<h1>Authorization Failed</h1>
<p>An error occurred during authorization.</p>
<div class="error">${error}</div>
<div class="error">${escapeHtml(error)}</div>
</div>
</body>
</html>`
@ -87,7 +96,7 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
// Enforce state parameter presence
if (!state) {
const errorMsg = "Missing required state parameter - potential CSRF attack"
res.writeHead(400, { "Content-Type": "text/html" })
res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR(errorMsg))
return
}
@ -101,13 +110,13 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
cleanupStateIndex(state)
pending.reject(new Error(errorMsg))
}
res.writeHead(200, { "Content-Type": "text/html" })
res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR(errorMsg))
return
}
if (!code) {
res.writeHead(400, { "Content-Type": "text/html" })
res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR("No authorization code provided"))
return
}
@ -115,7 +124,7 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
// Validate state parameter
if (!pendingAuths.has(state)) {
const errorMsg = "Invalid or expired state parameter - potential CSRF attack"
res.writeHead(400, { "Content-Type": "text/html" })
res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_ERROR(errorMsg))
return
}
@ -127,7 +136,7 @@ function handleRequest(req: import("http").IncomingMessage, res: import("http").
cleanupStateIndex(state)
pending.resolve(code)
res.writeHead(200, { "Content-Type": "text/html" })
res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
res.end(HTML_SUCCESS)
}

26
packages/opencode/test/mcp/oauth-callback.test.ts
View File

@ -31,4 +31,30 @@ describe("McpOAuthCallback.ensureRunning", () => {
await McpOAuthCallback.ensureRunning("http://127.0.0.1:18000/custom/callback")
expect(McpOAuthCallback.isRunning()).toBe(true)
})
test("escapes provider error markup in callback HTML", async () => {
const redirectUri = "http://127.0.0.1:18001/custom/callback"
await McpOAuthCallback.ensureRunning(redirectUri)
const error = `<script>alert("xss" & 'more')</script>`
const response = await fetch(
`${redirectUri}?state=test&error=access_denied&error_description=${encodeURIComponent(error)}`,
)
const body = await response.text()
expect(response.headers.get("content-type")).toBe("text/html; charset=utf-8")
expect(body).toContain("&lt;script&gt;alert(&quot;xss&quot; &amp; &#39;more&#39;)&lt;/script&gt;")
expect(body).not.toContain(error)
})
test("keeps normal provider errors readable", async () => {
const redirectUri = "http://127.0.0.1:18002/custom/callback"
await McpOAuthCallback.ensureRunning(redirectUri)
const response = await fetch(
`${redirectUri}?state=test&error=access_denied&error_description=${encodeURIComponent("The user denied access")}`,
)
expect(await response.text()).toContain('<div class="error">The user denied access</div>')
})
})