fix(megamcp): reject env var values containing '}' in ApplyAuthFormat (#252)

55b3f5e1510524f70a340436b2071276988eb4e4 · 2026-04-24 17:13:21 -0700 · Dinakar Sarbada

Co-authored-by: Dinakar Sarbada <dinakars777@users.noreply.github.com>

Files touched

M internal/megamcp/auth.go
M internal/megamcp/auth_test.go

Diff

commit 55b3f5e1510524f70a340436b2071276988eb4e4
Author: Dinakar Sarbada <sarbadadinu@gmail.com>
Date:   Fri Apr 24 17:13:21 2026 -0700

    fix(megamcp): reject env var values containing '}' in ApplyAuthFormat (#252)
    
    Co-authored-by: Dinakar Sarbada <dinakars777@users.noreply.github.com>
---
 internal/megamcp/auth.go      | 3 +++
 internal/megamcp/auth_test.go | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/internal/megamcp/auth.go b/internal/megamcp/auth.go
index 11b8708e..d0863db2 100644
--- a/internal/megamcp/auth.go
+++ b/internal/megamcp/auth.go
@@ -58,6 +58,9 @@ func ApplyAuthFormat(format string, envVars map[string]string) (string, error) {
 
 	// Perform substitutions.
 	for key, value := range replacements {
+		if strings.Contains(value, "}") {
+			return "", fmt.Errorf("env var value for %s contains invalid character }", key)
+		}
 		result = strings.ReplaceAll(result, "{"+key+"}", value)
 	}
 
diff --git a/internal/megamcp/auth_test.go b/internal/megamcp/auth_test.go
index 3c1cd205..3e0f4edc 100644
--- a/internal/megamcp/auth_test.go
+++ b/internal/megamcp/auth_test.go
@@ -63,6 +63,12 @@ func TestApplyAuthFormat(t *testing.T) {
 			envVars: map[string]string{},
 			want:    "",
 		},
+		{
+			name:    "value with closing brace rejected",
+			format:  "Bearer {token}",
+			envVars: map[string]string{"token": "abc}123"},
+			wantErr: "invalid character }",
+		},
 	}
 
 	for _, tt := range tests {

← d35f25bc chore(main): release 2.3.1 (#266) · back to Cli Printing Press · fix(cli): avoid duplicate batch store upsert generation (#23 24785ee5 →