Harden Trustify MCP HTTP and authentication handling - #77
Open
rh-jfuller wants to merge 5 commits into
Open
rh-jfuller wants to merge 5 commits into
rh-jfuller wants to merge 5 commits into
Conversation
Add HTTP timeouts, request and response size limits, bounded pagination, and maximum PURL counts. Add regression tests for oversized inputs and responses.
Use reqwest URL builders for encoded path segments and query parameters, and remove the requirement for callers to pre-encode PURLs. Add reserved character URL coverage.
Combine SBOM URI, query, and limit into one package-list request object so all parameters are visible and usable by MCP clients.
Check AUTH_DISABLED before loading OIDC variables and add regression tests for disabled-mode initialization and boolean parsing.
Reviewer's GuideThe PR hardens Trustify MCP networking by replacing blocking calls with bounded async reqwest operations, safely constructing URLs and payloads, enforcing pagination and PURL limits, correcting package-list schema exposure, and permitting explicitly disabled authentication without OIDC settings, with targeted regression coverage. Sequence diagram for hardened Trustify API callssequenceDiagram
participant Tool as MCP tool
participant Client as Async reqwest client
participant API as Trustify API
Tool->>Tool: validate_limit()
Tool->>Tool: validate_purls()
Tool->>Tool: build_api_url()
Tool->>Client: send()
Client->>API: HTTP request with timeout
API-->>Client: HTTP response
Client-->>Tool: response body
Tool->>Tool: read_response_body()
Tool->>Tool: deserialize_response()
Tool-->>Tool: Return MCP result
Sequence diagram for disabled authentication startupsequenceDiagram
participant Startup as Router startup
participant Env as Environment
participant OIDC as OIDC configuration
participant Router as Protected router
Startup->>Env: Read AUTH_DISABLED
alt AUTH_DISABLED is true
Startup->>Router: Return router without authentication
else Authentication enabled
Startup->>Env: Read OPENID_ISSUER_URL and OPENID_CLIENT_ID
Startup->>OIDC: Configure authenticator
OIDC-->>Router: Authentication middleware
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="tests/integration_test.rs" line_range="89-110" />
<code_context>
"name": "trustify_sbom_details",
"description": "Get the details of a SBOM from a trustify instance by SBOM URI",
- "inputSchema": {
- "type": "object",
- "properties": {
- "sbom_uri": {
- "description": "Sbom URI",
- "type": "string"
- }
- },
- "required": [
- "sbom_uri"
- ],
+ "inputSchema": {
+ "type": "object",
</code_context>
<issue_to_address>
**issue (testing):** The expected MCP schema adds `query` and `limit` to `trustify_sbom_details`, but the implementation still exposes `SbomUriRequest` for that tool and only accepts `sbom_uri`. The schema regression test therefore fails because the expected schema is attached to the wrong tool; those fields belong to `trustify_sbom_list_packages`.
**Triggers:** When the integration tool-list tests run.
**Suggested fix:** Keep `trustify_sbom_details`'s expected schema limited to `sbom_uri` and add `query` and `limit` to the expected `trustify_sbom_list_packages` schema.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and when AUTH_DISABLED is true, this change bypasses the authentication middleware entirely and allows every request through without OIDC configuration. If that policy is wrong, the resulting unauthorized access or data exposure occurs immediately and cannot be fully undone by reverting.
Blocking findings: tests/integration_test.rs:110
Comment on lines
+89
to
+110
| "type": "object", | ||
| "properties": { | ||
| "sbom_uri": { | ||
| "description": "Sbom URI", | ||
| "type": "string" | ||
| }, | ||
| "query": { | ||
| "description": "Search query for packages within the SBOM", | ||
| "type": "string" | ||
| }, | ||
| "limit": { | ||
| "description": "Maximum number of packages to return", | ||
| "type": "integer", | ||
| "format": "uint", | ||
| "minimum": 0 | ||
| } | ||
| }, | ||
| "required": [ | ||
| "sbom_uri", | ||
| "query", | ||
| "limit" | ||
| ], |
There was a problem hiding this comment.
issue (testing): The expected MCP schema adds query and limit to trustify_sbom_details, but the implementation still exposes SbomUriRequest for that tool and only accepts sbom_uri. The schema regression test therefore fails because the expected schema is attached to the wrong tool; those fields belong to trustify_sbom_list_packages.
Triggers: When the integration tool-list tests run.
Suggested fix: Keep trustify_sbom_details's expected schema limited to sbom_uri and add query and limit to the expected trustify_sbom_list_packages schema.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Harden Trustify MCP HTTP and authentication handling with asynchronous, bounded, safely encoded requests and more robust configuration behavior.
Bug Fixes:
Enhancements:
Build:
Tests: