Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

Skills: URI traversal validation skips percent-encoded dot-segments

未關閉 適合新手
  • 哪裡不對？
#3,685 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
2/5
預估耗時
1-3 小時
新手友好度
78/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
python
領域
security

研究方向

閱讀 src/mcp/shared/skills.py，著重檢視 _validate_resource_uri_in_skill() 和 validate_directory_result()。先追蹤每個函式如何拆分並檢查 URI 路徑區段，再為兩條驗證路徑中的百分比編碼點區段新增回歸測試。完成標準是拒絕編碼後的 . 和 .. 區段，同時有效的資源 URI 和直接子項仍可通過。

由索引模型根據 Issue 內容生成。

描述

bug v2
Initial Checks
Release line

2.x (current stable)

Description

In src/mcp/shared/skills.py (added in #3485 for the SEP-2640 Skills extension), _validate_resource_uri_in_skill() and validate_directory_result() check for directory traversal segments against the raw URI path segments:

# src/mcp/shared/skills.py (line 253)
if any(segment in (".", "..") for segment in resource_parts.path.split("/")):
    raise ValueError(f"resource URI {resource_uri!r} contains a traversal segment")

Because URI paths are not URL-unquoted prior to validation, percent-encoded traversal segments (e.g. %2e%2e, %2E%2E, or %2e) bypass this check.

Specifically:

  1. In _validate_resource_uri_in_skill(), a resource URI such as skill://acme/billing/refunds/%2e%2e/other/secret.txt starts with root + "/" (/billing/refunds/), but its segments (["", "billing", "refunds", "%2e%2e", "other", "secret.txt"]) do not literally equal ".." or ".". As a result, the resource is admitted as a valid member of skill://acme/billing/refunds/SKILL.md.
  2. In validate_directory_result(), line 293 checks relative in (".", ".."). A child URI containing %2e%2e or %2e bypasses this check and is admitted as a valid direct child.
Example Code
from mcp.shared.skills import Skill, SkillResource, ReadDirectoryResult, validate_directory_result
from mcp_types import Resource

root = "skill://git-workflow/SKILL.md"
digest = "sha256:" + "a" * 64

# 1. Percent-encoded traversal bypasses manifest validation:
s = Skill(
    uri=root,
    frontmatter={"name": "git-workflow", "description": "d"},
    resources=[
        SkillResource(uri=root, digest=digest, size=10),
        SkillResource(uri="skill://git-workflow/%2e%2e/evil.md", digest=digest, size=10)
    ]
)
# Expected: ValueError / ValidationError for traversal segment
# Observed: Accepted without error

# 2. Percent-encoded dot-segment bypasses directory validation:
res = ReadDirectoryResult(resources=[Resource(uri="skill://pdf/templates/%2e%2e", name="x")])
validate_directory_result("skill://pdf/templates", res)
# Expected: ValueError ("is not a direct child")
# Observed: Accepted without error
Proposed Fix

Normalize path segments with urllib.parse.unquote() before splitting and inspecting dot-segments in both _validate_resource_uri_in_skill and validate_directory_result.

I have a minimal regression test and fix ready and would be happy to submit a PR if this looks good.

主要語言
Python
星號
24.5k
分支
4k
平均合併
18 小時 31 分鐘
30 天內合併 PR
38

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

modelcontextprotocol/python-sdk 的其他 Issue

查看 modelcontextprotocol/python-sdk 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。