Skip to content

fix: bound MCP input before line parsing#3

Merged
smiggleworth merged 1 commit into
mainfrom
fix/security-mcp-byte-limit
Jul 26, 2026
Merged

fix: bound MCP input before line parsing#3
smiggleworth merged 1 commit into
mainfrom
fix/security-mcp-byte-limit

Conversation

@smiggleworth

Copy link
Copy Markdown
Contributor

Closes #2. Replaces unbounded readline accumulation with a byte-capped parser and proves oversized chunked input is rejected before newline buffering.

Copilot AI review requested due to automatic review settings July 26, 2026 16:50
@smiggleworth
smiggleworth merged commit ab9f316 into main Jul 26, 2026
4 checks passed
@smiggleworth
smiggleworth deleted the fix/security-mcp-byte-limit branch July 26, 2026 16:52

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the MCP stdio transport by replacing readline-based line accumulation with a bounded byte parser so oversized input can be rejected as soon as it exceeds maxLineBytes, before a newline is received/buffered.

Changes:

  • Replaces Node readline line handling with a custom incremental byte parser that enforces maxLineBytes during streaming reads.
  • Adds a regression test ensuring oversized input is rejected even when no newline has yet been buffered.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
src/mcp.ts Implements bounded streaming line parsing and input listener cleanup to enforce maxLineBytes before newline completion.
tests/mcp.test.ts Adds test coverage for rejecting oversized input prior to newline buffering.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/mcp.ts
Comment on lines +144 to +151
const newline = bytes.indexOf(0x0a, offset);
const end = newline < 0 ? bytes.byteLength : newline;
const segmentBytes = end - offset;
if (!discardingOversizedLine) {
if (lineBytes + segmentBytes > maxLineBytes) {
discardingOversizedLine = true;
lineBytes = 0;
rejectOversizedLine();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: enforce MCP byte limits before line buffering

2 participants