Fix cross-server environment variable and argument filtering bypass #187
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Add RawEnv and RawArgs fields to ServerExecutionContext * Store unexpanded values before environment variable expansion * Update all methods to handle new fields (Get, Equals, AggregateConfigs) * Update tests to expect new fields * Add documentation for security-aware usage
* Convert filterEnv to Server receiver method * Use RawEnv to detect cross-server references before expansion * Check both raw and expanded values for comprehensive filtering * Update all test calls to use Server receiver method
* Add filterArgs method to detect cross-server references in args * Use RawArgs to check unexpanded values for security filtering * Update exportRuntimeArgs to filter args before processing * Filter both expanded and raw argument values
* Add SafeArgs() method that returns filtered command-line arguments * Rename Environ() to SafeEnv() for consistency and clarity * Update daemon to use SafeArgs() and SafeEnv() when starting servers * Ensure production usage is secure by default
* Add end-to-end tests for SafeEnv and SafeArgs methods * Verify cross-server references are filtered from environment variables and arguments * Test with realistic config files to ensure production-like scenarios
peteski22
force-pushed
the
peteski22/bug/env-filtering
branch
from
bb5ffd1 to
7c2f916
Compare
dpoulopoulos
approved these changes
Sep 24, 2025
agpituk
approved these changes
Sep 24, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary:
Fixes a security vulnerability where environment variables and command-line arguments with cross-server references (e.g.
${MCPD__DATABASE_SERVER__DB_PASSWORD}) were bypassing filtering due to premature expansion.This regression was introduced in PR #144 when environment variable expansion was moved to load time.
Changes:
RawEnv/RawArgsfields to preserve unexpanded values for filteringSafeEnv()(formerlyEnviron()) andSafeArgs()methods that filter on raw valuesSecurity Impact:
Prevents servers from accessing environment variables and arguments intended for other servers, maintaining proper isolation between MCP server configurations.