sdcvalidator 4.5.1__tar.gz → 4.5.2__tar.gz

{sdcvalidator-4.5.1 → sdcvalidator-4.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sdcvalidator
-Version: 4.5.1
+Version: 4.5.2
 Summary: SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema
 Author: Axius SDC, Inc.
 License-Expression: Apache-2.0

{sdcvalidator-4.5.1 → sdcvalidator-4.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sdcvalidator"
-version = "4.5.1"
+version = "4.5.2"
 description = "SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema"
 license = "Apache-2.0"
 requires-python = ">=3.10"

{sdcvalidator-4.5.1 → sdcvalidator-4.5.2}/src/sdcvalidator/__init__.py

@@ -14,7 +14,7 @@ Thin wrapper over xmlschema with two-tier error classification and the SDC4
 "quarantine-and-tag" recovery pattern (ISO 21090 ExceptionalValues).
 """
 
-__version__ = "4.5.1"
+__version__ = "4.5.2"
 
 # etree_tostring is re-exported from xmlschema so callers can serialize the
 # ElementTree returned by validate_with_recovery() without importing xmlschema

{sdcvalidator-4.5.1 → sdcvalidator-4.5.2}/src/sdcvalidator/mcp_server.py

@@ -36,7 +36,7 @@ from sdcvalidator.schema_checker import validate_sdc4_schema_compliance
 JSONRPC_VERSION = "2.0"
 MCP_PROTOCOL_VERSION = "2024-11-05"
 SERVER_NAME = "sdcvalidator"
-SERVER_VERSION = "4.5.1"
+SERVER_VERSION = "4.5.2"
 
 # Validator cache: schema_path -> SDC4Validator
 _validators: dict[str, SDC4Validator] = {}
@@ -201,10 +201,24 @@ def _jsonrpc_error(id: Any, code: int, message: str, data: Any = None) -> dict:
     return {"jsonrpc": JSONRPC_VERSION, "id": id, "error": error}
 
 
-def _handle_request(request: dict) -> dict | None:
+def _handle_request(request) -> dict | None:
+    # ★ Attacker-reachable input over stdio with no authentication. A JSON
+    # value that is not an object, or an object whose params is not one,
+    # used to raise AttributeError and kill the server (VSL rollout R9).
+    # Every shape the protocol does not allow is answered with -32600.
+    if not isinstance(request, dict):
+        return _jsonrpc_error(None, -32600, "Invalid Request: a JSON-RPC request is an object")
+    req_id = request.get("id")
+    if not isinstance(req_id, (str, int, type(None))):
+        return _jsonrpc_error(None, -32600, "Invalid Request: id must be a string, a number or null")
     method = request.get("method", "")
+    if not isinstance(method, str):
+        return _jsonrpc_error(req_id, -32600, "Invalid Request: method must be a string")
     params = request.get("params", {})
-    req_id = request.get("id")
+    if params is None:
+        params = {}
+    if not isinstance(params, dict):
+        return _jsonrpc_error(req_id, -32600, "Invalid Request: params must be an object")
 
     if method == "initialize":
         result = {
@@ -228,6 +242,12 @@ def _handle_request(request: dict) -> dict | None:
     elif method == "tools/call":
         tool_name = params.get("name", "")
         tool_args = params.get("arguments", {})
+        if tool_args is None:
+            tool_args = {}
+        if not isinstance(tool_name, str) or not isinstance(tool_args, dict):
+            return _jsonrpc_error(
+                req_id, -32602, "Invalid params: name must be a string and arguments an object"
+            )
 
         handler = TOOL_HANDLERS.get(tool_name)
         if handler is None:

{sdcvalidator-4.5.1 → sdcvalidator-4.5.2}/src/sdcvalidator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sdcvalidator
-Version: 4.5.1
+Version: 4.5.2
 Summary: SDC4 structural validator with ExceptionalValue recovery — thin wrapper over xmlschema
 Author: Axius SDC, Inc.
 License-Expression: Apache-2.0

{sdcvalidator-4.5.1 → sdcvalidator-4.5.2}/tests/test_mcp_server.py

@@ -137,3 +137,55 @@ class TestConsistentSerialization:
             assert content[0]["type"] == "text"
             parsed = json.loads(content[0]["text"])
             assert parsed is not None
+
+class TestMalformedRequestsDoNotKillTheServer:
+    """
+    VSL rollout inventory R9. Six inputs that are valid JSON but not a
+    JSON-RPC request raised AttributeError in _handle_request and ended the
+    process. Each is now answered with -32600 (or -32602 for bad tool params)
+    and the loop keeps reading.
+    """
+
+    @pytest.mark.parametrize("payload", [[], ["tools/list"], "tools/list", 7, None, True])
+    def test_a_non_object_request_is_invalid_request(self, payload):
+        response = _handle_request(payload)
+        assert response["error"]["code"] == -32600
+        assert response["id"] is None
+
+    @pytest.mark.parametrize("params", [[], "x", 3, True])
+    def test_non_object_params_are_invalid_request(self, params):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": params})
+        assert response["error"]["code"] == -32600
+        assert response["id"] == 1
+
+    def test_null_params_are_treated_as_empty(self):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": None})
+        assert "result" in response
+
+    def test_a_non_string_method_is_invalid_request(self):
+        response = _handle_request({"jsonrpc": "2.0", "id": 1, "method": ["tools/list"]})
+        assert response["error"]["code"] == -32600
+
+    @pytest.mark.parametrize("arguments", [[], "x", 3])
+    def test_non_object_tool_arguments_are_invalid_params(self, arguments):
+        response = _handle_request({
+            "jsonrpc": "2.0", "id": 1, "method": "tools/call",
+            "params": {"name": list(TOOL_HANDLERS)[0], "arguments": arguments},
+        })
+        assert response["error"]["code"] == -32602
+
+    def test_the_stdio_loop_survives_every_one_of_them(self, monkeypatch, capsys):
+        import io
+        import sys
+
+        from sdcvalidator.mcp_server import run_stdio
+
+        lines = ["[]", "\"tools/list\"", "7", "null",
+                 json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": []}),
+                 json.dumps({"jsonrpc": "2.0", "id": 2, "method": "ping"})]
+        monkeypatch.setattr(sys, "stdin", io.StringIO("\n".join(lines) + "\n"))
+        run_stdio()
+        out = [json.loads(l) for l in capsys.readouterr().out.strip().splitlines()]
+        assert len(out) == 6
+        assert [o.get("error", {}).get("code") for o in out[:5]] == [-32600] * 5
+        assert out[5] == {"jsonrpc": "2.0", "id": 2, "result": {}}