From 8e07ef642ece552f16f6d8ee6becbb2a6b7d89e1 Mon Sep 17 00:00:00 2001 From: YeonGyu-Kim Date: Tue, 12 May 2026 12:54:24 +0900 Subject: [PATCH] fix(mcp-oauth): use fixed localhost base for callback URL parsing Cubic AI reviewer flagged the use of the untrusted Host header as the URL base in startCallbackServer. The server only binds to 127.0.0.1, so hardcoding "http://127.0.0.1" as the URL base is robust against malformed or manipulated Host values and matches upstream behavior prior to the node:http refactor. --- src/features/mcp-oauth/callback-server.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/features/mcp-oauth/callback-server.ts b/src/features/mcp-oauth/callback-server.ts index 64ff35a19..0d4b3410b 100644 --- a/src/features/mcp-oauth/callback-server.ts +++ b/src/features/mcp-oauth/callback-server.ts @@ -57,8 +57,7 @@ export async function startCallbackServer(startPort: number = DEFAULT_PORT): Pro }, TIMEOUT_MS) const server = createServer((request: IncomingMessage, response: ServerResponse) => { - const host = request.headers.host ?? "127.0.0.1" - const url = new URL(request.url ?? "/", `http://${host}`) + const url = new URL(request.url ?? "/", "http://127.0.0.1") if (url.pathname !== "/oauth/callback") { response.statusCode = 404