mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-03-15 12:16:33 +01:00
f32907cd36
* fix: MCP server configuration validation and schema - Added tests to reject URLs containing environment variable references for SSE, streamable-http, and websocket types in the MCP routes. - Introduced a new schema in the data provider to ensure user input URLs do not resolve environment variables, enhancing security against potential leaks. - Updated existing MCP server user input schema to utilize the new validation logic, ensuring consistent handling of user-supplied URLs across the application. * fix: MCP URL validation to reject env variable references - Updated tests to ensure that URLs for SSE, streamable-http, and websocket types containing environment variable patterns are rejected, improving security against potential leaks. - Refactored the MCP server user input schema to enforce stricter validation rules, preventing the resolution of environment variables in user-supplied URLs. - Introduced new test cases for various URL types to validate the rejection logic, ensuring consistent handling across the application. * test: Enhance MCPServerUserInputSchema tests for environment variable handling - Introduced new test cases to validate the prevention of environment variable exfiltration through user input URLs in the MCPServerUserInputSchema. - Updated existing tests to confirm that URLs containing environment variable patterns are correctly resolved or rejected, improving security against potential leaks. - Refactored test structure to better organize environment variable handling scenarios, ensuring comprehensive coverage of edge cases. |
||
|---|---|---|
| .. | ||
| __tests__ | ||
| admin | ||
| agents | ||
| assistants | ||
| files | ||
| types | ||
| accessPermissions.js | ||
| accessPermissions.test.js | ||
| actions.js | ||
| apiKeys.js | ||
| auth.js | ||
| balance.js | ||
| banner.js | ||
| categories.js | ||
| config.js | ||
| convos.js | ||
| endpoints.js | ||
| index.js | ||
| keys.js | ||
| mcp.js | ||
| memories.js | ||
| messages.js | ||
| models.js | ||
| oauth.js | ||
| presets.js | ||
| prompts.js | ||
| prompts.test.js | ||
| roles.js | ||
| search.js | ||
| settings.js | ||
| share.js | ||
| static.js | ||
| tags.js | ||
| user.js | ||