You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by da...@apache.org on 2026/07/10 16:40:19 UTC
(camel) 18/19: chore: harden MCP server request validation and file access
This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
commit 58e9a6ed96b0e53fb20b5841cae5a2952dd59366
Author: Claus Ibsen <cl...@gmail.com>
AuthorDate: Fri Jul 10 18:33:12 2026 +0200
chore: harden MCP server request validation and file access
Co-Authored-By: Claude Opus 4.6 <no...@anthropic.com>
Signed-off-by: Claus Ibsen <cl...@gmail.com>
---
.../apache/camel/dsl/jbang/core/commands/tui/McpFacade.java | 4 ++--
.../camel/dsl/jbang/core/commands/tui/TuiMcpServer.java | 12 ++++++++++++
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java
index 79edb125357c..044d1d9158d9 100644
--- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java
+++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java
@@ -686,8 +686,8 @@ class McpFacade {
return null;
}
if (file != null && !file.isEmpty()) {
- Path filePath = dir.resolve(file);
- if (!Files.isRegularFile(filePath)) {
+ Path filePath = dir.resolve(file).normalize();
+ if (!filePath.startsWith(dir) || !Files.isRegularFile(filePath)) {
return null;
}
try {
diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java
index a4cca6563049..cd44e12ba311 100644
--- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java
+++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java
@@ -156,6 +156,18 @@ class TuiMcpServer {
return;
}
+ String origin = exchange.getRequestHeaders().getFirst("Origin");
+ if (origin != null) {
+ exchange.sendResponseHeaders(403, -1);
+ return;
+ }
+
+ String contentType = exchange.getRequestHeaders().getFirst("Content-Type");
+ if (contentType == null || !contentType.startsWith("application/json")) {
+ exchange.sendResponseHeaders(415, -1);
+ return;
+ }
+
String body;
try (InputStream is = exchange.getRequestBody()) {
body = new String(is.readAllBytes(), StandardCharsets.UTF_8);