ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-09 15:19:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Sanitize untrusted output in fastmcp list and fastmcp call (#3409)

Browse source 
* Sanitize untrusted CLI client output

🤖 Generated with GPT-5.2-Codex

* Fix ruff format violations
This commit is contained in:
Jeremiah Lowin 2026-03-07 12:31:46 -05:00 • committed by GitHub
commit 08f590fa9e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 61 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

25
tests/cli/test_client_commands.py
View file

@ -16,6 +16,7 @@ from fastmcp.cli.client import (
_build_stdio_from_command,
_format_call_result_text,
_is_http_target,
_sanitize_untrusted_text,
call_command,
coerce_value,
format_tool_signature,
@ -555,3 +556,27 @@ class TestFormatCallResult:
_format_call_result_text(result)
captured = capsys.readouterr()
assert "value" in captured.out
def test_escapes_rich_markup_and_control_chars(
self, capsys: pytest.CaptureFixture[str]
):
result = CallToolResult(
content=[mcp.types.TextContent(type="text", text="[red]x[/red]\x1b[2J")],
structured_content=None,
meta=None,
data=None,
is_error=False,
)
_format_call_result_text(result)
captured = capsys.readouterr()
assert "[red]x[/red]" in captured.out
assert "\\x1b" in captured.out
assert "\x1b" not in captured.out
class TestSanitizeUntrustedText:
def test_sanitize_untrusted_text(self):
value = "[bold]hello[/bold]\x07"
sanitized = _sanitize_untrusted_text(value)
assert sanitized == "\\[bold]hello\\[/bold]\\x07"