furyhawk/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-21 10:16:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateway): reject malformed MCP sandbox policy

Browse Source
This commit is contained in:
Peter Steinberger
2026-07-18 01:59:09 +01:00
parent 6f0f6af62e
commit b351580ba6
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gateway/mcp-app-sandbox-http.ts
+6 -1
View File
@@ -30,9 +30,14 @@ function handleMcpAppSandboxHttpRequest(req: IncomingMessage, res: ServerRespons
return;
}
const encodedCsp = url.searchParams.get("csp");
let csp;
try {
csp = decodeMcpAppSandboxCsp(url.searchParams.get("csp"));
csp = decodeMcpAppSandboxCsp(encodedCsp);
// The decoder also returns undefined for malformed input; only an absent query may use defaults.
if (encodedCsp !== null && !csp) {
throw new Error("invalid MCP App sandbox policy");
}
} catch {
res.statusCode = 400;
res.setHeader("Content-Type", "text/plain; charset=utf-8");