Ruben FiszelandClaude Opus 4.7 ad5ec293b5 fix: reject path traversal in MCP endpoint path parameters (#9211) ...

* fix: reject path traversal in MCP endpoint path parameters

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: narrow MCP path-param validator to structural escapes only

Codex review: rejecting whitespace/`:`/`@` regressed legitimate
Windmill paths (app paths with spaces, email-style usernames like
u/admin@windmill.dev/...). These are ordinary path-segment data in an
absolute URL and cannot redirect the request. Reject only structural
escapes: control chars, `\`, `%`, `?`, `#`, and `.`/`..`/empty segments.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-18 23:33:39 +00:00

..

auto_generated_endpoints.rs

fix: include endpoint descriptions in mcp tools (#8925)

2026-04-23 16:21:15 +00:00

core.rs

fix(mcp): sanitize and enrich nested resource schemas (#9158)

2026-05-14 06:54:32 +00:00

mod.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

oauth_server.rs

fix(mcp): validate oauth dynamic client registration redirect_uris (#9197)

2026-05-17 14:00:06 +00:00

utils.rs

fix: reject path traversal in MCP endpoint path parameters (#9211)

2026-05-18 23:33:39 +00:00