Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Skills: URI traversal validation skips percent-encoded dot-segments

Open Beginner friendly
  • Is something wrong?
#3,685 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@Varshith-Kali is already working on this.

Since Oct 13, 2026.

  • #3703 by @chauvuusvn — closed without merging

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Read src/mcp/shared/skills.py, focusing on _validate_resource_uri_in_skill() and validate_directory_result(). Start by tracing how each function splits and checks URI path segments, then add regression coverage for percent-encoded dot-segments in both validation paths. Done means encoded . and .. segments are rejected while valid resource URIs and direct children still pass.

Written by the indexing model from the issue text.

Description

bug v2
Initial Checks
Release line

2.x (current stable)

Description

In src/mcp/shared/skills.py (added in #3485 for the SEP-2640 Skills extension), _validate_resource_uri_in_skill() and validate_directory_result() check for directory traversal segments against the raw URI path segments:

# src/mcp/shared/skills.py (line 253)
if any(segment in (".", "..") for segment in resource_parts.path.split("/")):
    raise ValueError(f"resource URI {resource_uri!r} contains a traversal segment")

Because URI paths are not URL-unquoted prior to validation, percent-encoded traversal segments (e.g. %2e%2e, %2E%2E, or %2e) bypass this check.

Specifically:

  1. In _validate_resource_uri_in_skill(), a resource URI such as skill://acme/billing/refunds/%2e%2e/other/secret.txt starts with root + "/" (/billing/refunds/), but its segments (["", "billing", "refunds", "%2e%2e", "other", "secret.txt"]) do not literally equal ".." or ".". As a result, the resource is admitted as a valid member of skill://acme/billing/refunds/SKILL.md.
  2. In validate_directory_result(), line 293 checks relative in (".", ".."). A child URI containing %2e%2e or %2e bypasses this check and is admitted as a valid direct child.
Example Code
from mcp.shared.skills import Skill, SkillResource, ReadDirectoryResult, validate_directory_result
from mcp_types import Resource

root = "skill://git-workflow/SKILL.md"
digest = "sha256:" + "a" * 64

# 1. Percent-encoded traversal bypasses manifest validation:
s = Skill(
    uri=root,
    frontmatter={"name": "git-workflow", "description": "d"},
    resources=[
        SkillResource(uri=root, digest=digest, size=10),
        SkillResource(uri="skill://git-workflow/%2e%2e/evil.md", digest=digest, size=10)
    ]
)
# Expected: ValueError / ValidationError for traversal segment
# Observed: Accepted without error

# 2. Percent-encoded dot-segment bypasses directory validation:
res = ReadDirectoryResult(resources=[Resource(uri="skill://pdf/templates/%2e%2e", name="x")])
validate_directory_result("skill://pdf/templates", res)
# Expected: ValueError ("is not a direct child")
# Observed: Accepted without error
Proposed Fix

Normalize path segments with urllib.parse.unquote() before splitting and inspecting dot-segments in both _validate_resource_uri_in_skill and validate_directory_result.

I have a minimal regression test and fix ready and would be happy to submit a PR if this looks good.

Dominant language
Python
Stars
24.6k
Forks
4.2k
Avg merge
18h
Merged PRs (30d)
39

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/python-sdk

All issues in modelcontextprotocol/python-sdk

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.