mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-19 12:04:18 +02:00
d779414f8a* Add ResourceSecurity screening for templated resources (defaults on)
* Add tests for resource path-security screening
* Document resource path-security; fix ty in tests
* Carry child template security policy through provider mount
Preserve a mounted template's explicit ResourceSecurity (per-param
exemptions or a deliberate opt-out) through FastMCPProviderResourceTemplate.wrap
so the parent read chokepoint honours it instead of the parent default.
* Defer mcp SDK import so fastmcp.resources loads without the [mcp] extra
* Make resource path-security docs examples self-contained and runnable
* Match exempt_params under both hyphen and underscore spellings
Template placeholders like {git-ref} extract as git_ref, so an exemption
written with the natural URI-template spelling never matched.
* Docs: describe net-depth traversal rule accurately; make example runnable
The screening only rejects .. segments that escape the starting depth
(foo/../bar passes) — saying any standalone .. is rejected overstated
the guarantee. Also define DOCS_ROOT so the example runs.
|
||
|---|---|---|
| .. | ||
| auth | ||
| http | ||
| middleware | ||
| mount | ||
| providers | ||
| sampling | ||
| tasks | ||
| telemetry | ||
| transforms | ||
| versioning | ||
| __init__.py | ||
| test_app_state.py | ||
| test_auth_integration.py | ||
| test_auth_integration_errors.py | ||
| test_cache_hints.py | ||
| test_context.py | ||
| test_dependencies.py | ||
| test_dependencies_advanced.py | ||
| test_event_store.py | ||
| test_fastapi_testclient_compat.py | ||
| test_file_server.py | ||
| test_icons.py | ||
| test_input_validation.py | ||
| test_log_level.py | ||
| test_logging.py | ||
| test_pagination.py | ||
| test_protocol_eras.py | ||
| test_providers.py | ||
| test_server.py | ||
| test_server_docket.py | ||
| test_server_lifespan.py | ||
| test_server_safety.py | ||
| test_session_visibility.py | ||
| test_streamable_http_no_redirect.py | ||
| test_tool_annotations.py | ||
| test_tool_transformation.py | ||
| test_transport.py | ||