This is an automated email from the ASF dual-hosted git repository. davsclaus pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel.git
commit 58e9a6ed96b0e53fb20b5841cae5a2952dd59366 Author: Claus Ibsen <[email protected]> AuthorDate: Fri Jul 10 18:33:12 2026 +0200 chore: harden MCP server request validation and file access Co-Authored-By: Claude Opus 4.6 <[email protected]> Signed-off-by: Claus Ibsen <[email protected]> --- .../apache/camel/dsl/jbang/core/commands/tui/McpFacade.java | 4 ++-- .../camel/dsl/jbang/core/commands/tui/TuiMcpServer.java | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java index 79edb125357c..044d1d9158d9 100644 --- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java +++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/McpFacade.java @@ -686,8 +686,8 @@ class McpFacade { return null; } if (file != null && !file.isEmpty()) { - Path filePath = dir.resolve(file); - if (!Files.isRegularFile(filePath)) { + Path filePath = dir.resolve(file).normalize(); + if (!filePath.startsWith(dir) || !Files.isRegularFile(filePath)) { return null; } try { diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java index a4cca6563049..cd44e12ba311 100644 --- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java +++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/TuiMcpServer.java @@ -156,6 +156,18 @@ class TuiMcpServer { return; } + String origin = exchange.getRequestHeaders().getFirst("Origin"); + if (origin != null) { + exchange.sendResponseHeaders(403, -1); + return; + } + + String contentType = exchange.getRequestHeaders().getFirst("Content-Type"); + if (contentType == null || !contentType.startsWith("application/json")) { + exchange.sendResponseHeaders(415, -1); + return; + } + String body; try (InputStream is = exchange.getRequestBody()) { body = new String(is.readAllBytes(), StandardCharsets.UTF_8);
