fix(megamcp): validate placeholders before substitution in ApplyAuthFormat (#262)

2c802afe51115d90ef69fc64b00a47fe3d279e60 · 2026-04-24 14:04:30 -0700 · Dinakar Sarbada

Co-authored-by: Dinakar Sarbada <dinakars777@users.noreply.github.com>

Files touched

M internal/megamcp/auth.go

Diff

commit 2c802afe51115d90ef69fc64b00a47fe3d279e60
Author: Dinakar Sarbada <sarbadadinu@gmail.com>
Date:   Fri Apr 24 14:04:30 2026 -0700

    fix(megamcp): validate placeholders before substitution in ApplyAuthFormat (#262)
    
    Co-authored-by: Dinakar Sarbada <dinakars777@users.noreply.github.com>
---
 internal/megamcp/auth.go | 33 ++++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/internal/megamcp/auth.go b/internal/megamcp/auth.go
index 11986924..11b8708e 100644
--- a/internal/megamcp/auth.go
+++ b/internal/megamcp/auth.go
@@ -21,19 +21,39 @@ func ApplyAuthFormat(format string, envVars map[string]string) (string, error) {
 
 	result := format
 
-	// Build replacement map: env var names and their semantic aliases.
 	replacements := make(map[string]string)
+	validPlaceholders := make(map[string]bool)
 	var firstValue string
 	for name, value := range envVars {
 		replacements[name] = value
+		validPlaceholders["{"+name+"}"] = true
 		if firstValue == "" {
 			firstValue = value
 		}
 	}
-	// Semantic placeholders map to the first env var value.
 	if firstValue != "" {
 		replacements["token"] = firstValue
 		replacements["access_token"] = firstValue
+		validPlaceholders["{token}"] = true
+		validPlaceholders["{access_token}"] = true
+	}
+
+	// Validate all placeholders in the format string before substitution.
+	for i := 0; i < len(result); {
+		idx := strings.Index(result[i:], "{")
+		if idx < 0 {
+			break
+		}
+		idx += i
+		closeIdx := strings.Index(result[idx:], "}")
+		if closeIdx < 0 {
+			break
+		}
+		placeholder := result[idx : idx+closeIdx+1]
+		if !validPlaceholders[placeholder] {
+			return "", fmt.Errorf("unrecognized placeholder %s in auth format %q", placeholder, format)
+		}
+		i = idx + closeIdx + 1
 	}
 
 	// Perform substitutions.
@@ -41,15 +61,6 @@ func ApplyAuthFormat(format string, envVars map[string]string) (string, error) {
 		result = strings.ReplaceAll(result, "{"+key+"}", value)
 	}
 
-	// Reject if any unrecognized placeholders remain.
-	if idx := strings.Index(result, "{"); idx >= 0 {
-		end := strings.Index(result[idx:], "}")
-		if end > 0 {
-			placeholder := result[idx : idx+end+1]
-			return "", fmt.Errorf("unrecognized placeholder %s in auth format %q", placeholder, format)
-		}
-	}
-
 	return result, nil
 }

← 28ba1e01 fix(openapi): collect paths to delete before mutation in str · back to Cli Printing Press · chore(main): release 2.3.1 (#266) d35f25bc →