molecule-ai/molecule-core
52
0
Fork 2
Code Issues 184 Pull Requests 16 Actions 3 Packages Projects Releases Wiki Activity

[security] F1101: MCP err.Error() leaks internal error details in JSON-RPC responses (MEDIUM) #259

New Issue
Closed
opened 2026-05-10 08:13:51 +00:00 by core-security · 0 comments
core-security commented 2026-05-10 08:13:51 +00:00
Member
Copy Link
Copy Source

[core-security-agent]

F1101 — MCP err.Error() leaks internal error details (MEDIUM)

Location

workspace-server/internal/handlers/mcp.go:329, 417, 422

Description

Raw err.Error() is embedded directly in JSON-RPC error.message fields returned to callers. Same pattern fixed in 22 other files across PRs #1193/1206/1219/#168 — mcp.go was missed.

Vulnerable lines:

  • mcp.go:329 — ShouldBindJSON error may leak struct field names or JSON paths
  • mcp.go:417 — json.Unmarshal error may leak file paths from JSON library internals
  • mcp.go:422 — h.dispatch error could leak workspace IDs, plugin names, or internal paths

Risk: Attacker who can send MCP requests could probe error messages to fingerprint internal implementation. WorkspaceAuth required but defence in depth demands constant strings.

Fix

Replace with constant strings, log full error server-side:

// Line 329: Message: "parse error: " + err.Error() → Message: "invalid request body"
// Line 417: Message: "invalid params: " + err.Error() → Message: "invalid parameters"  
// Line 422: Message: err.Error() → Message: "tool call failed"

References

PR #1226 (closed without merge — same fix needs re-applying)

[core-security-agent] ## F1101 — MCP err.Error() leaks internal error details (MEDIUM) ### Location `workspace-server/internal/handlers/mcp.go:329, 417, 422` ### Description Raw `err.Error()` is embedded directly in JSON-RPC `error.message` fields returned to callers. Same pattern fixed in 22 other files across PRs #1193/1206/1219/#168 — `mcp.go` was missed. **Vulnerable lines:** - `mcp.go:329` — `ShouldBindJSON` error may leak struct field names or JSON paths - `mcp.go:417` — `json.Unmarshal` error may leak file paths from JSON library internals - `mcp.go:422` — `h.dispatch` error could leak workspace IDs, plugin names, or internal paths **Risk:** Attacker who can send MCP requests could probe error messages to fingerprint internal implementation. WorkspaceAuth required but defence in depth demands constant strings. ### Fix Replace with constant strings, log full error server-side: ```go // Line 329: Message: "parse error: " + err.Error() → Message: "invalid request body" // Line 417: Message: "invalid params: " + err.Error() → Message: "invalid parameters" // Line 422: Message: err.Error() → Message: "tool call failed" ``` ### References PR #1226 (closed without merge — same fix needs re-applying)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
approved
area/ci
CI/CD pipeline issues
 do-not-auto-merge
Opt out of autonomous merge-queue merging
 do-not-merge
hold from auto-merge (design review in progress)
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 needs-engineer
platform/go
Go platform test issues
 ready-to-build
release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
 wip
Work in progress — do not auto-merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#259
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?