fastmcp/tests/utilities
Jeremiah Lowin b720fc5e38
fix: prevent path traversal in skill download (#3493)
* fix: prevent path traversal in skill download via malicious skill names

Co-authored-by: Claude <noreply@anthropic.com>

* fix: resolve skill_dir once and use consistently to prevent overwrite bypass

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-03-15 11:22:13 -04:00
..
json_schema_type Fix ty 0.0.17 diagnostics and bump lockfile 2026-02-16 16:13:38 -05:00
openapi fix: URL-encode path params to prevent SSRF/path traversal (GHSA-vv7q-7jx5-f767) (#3507) 2026-03-15 10:45:24 -04:00
__init__.py restore 1.x code 2025-04-09 11:54:42 -04:00
test_async_utils.py Fix async partial callables rejected by iscoroutinefunction (#3438) 2026-03-07 12:10:09 -05:00
test_auth.py feat: option to add upstream claims to the FastMCP proxy JWT (#2997) 2026-01-28 15:57:24 -05:00
test_cli.py Fix path resolution in install commands (#1951) 2025-09-29 20:04:12 -04:00
test_components.py Harden fastmcp metadata parsing in proxy paths (#3412) 2026-03-07 11:40:49 -05:00
test_inspect.py Split large test files to comply with loq line limit (#3328) 2026-02-28 11:21:11 -05:00
test_inspect_icons.py Split large test files to comply with loq line limit (#3328) 2026-02-28 11:21:11 -05:00
test_json_schema.py fix: restrict $ref resolution to local refs only (SSRF/LFI) (#3502) 2026-03-14 16:35:53 -04:00
test_logging.py Add enable_rich_logging setting to disable rich formatting (#2893) 2026-01-16 20:29:29 -05:00
test_skills.py fix: prevent path traversal in skill download (#3493) 2026-03-15 11:22:13 -04:00
test_tests.py Add FASTMCP_TRANSPORT setting for default transport selection (#1796) 2026-03-02 18:08:59 -05:00
test_typeadapter.py Fix method-bound tools (#1360) 2025-08-04 09:41:05 -04:00
test_types.py Preserve kw-only defaults when rebuilding functions for resolved annotations (#3429) 2026-03-07 12:10:01 -05:00
test_version_check.py Add CLI update notifications (#2840) 2026-01-10 18:27:03 -05:00