// Copyright 2025 The Go MCP SDK Authors. All rights reserved.
// Use of this source code is governed by an MIT-style
// license that can be found in the LICENSE file.
//go:build mcp_go_client_oauth
package oauthex
import (
"context"
"encoding/json"
"net/http"
"net/http/httptest"
"strings"
"testing"
)
// TestCheckURLScheme tests the checkURLScheme function directly.
func TestCheckURLScheme(t *testing.T) {
tests := []struct {
name string
url string
wantErr bool
}{
// Valid schemes
{"empty string", "", false},
{"https url", "https://example.com/path", false},
{"http url", "http://example.com/path", false},
{"custom scheme", "myapp://callback", false},
// Dangerous schemes that should be blocked
{"javascript scheme", "javascript:alert('xss')", true},
{"javascript uppercase", "JAVASCRIPT:alert('xss')", true},
{"javascript mixed case", "JaVaScRiPt:alert('xss')", true},
{"data scheme", "data:text/html,<script>alert('xss')</script>", true},
{"data uppercase", "DATA:text/html,test", true},
{"vbscript scheme", "vbscript:msgbox('xss')", true},
{"vbscript uppercase", "VBSCRIPT:test", true},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
err := checkURLScheme(tt.url)
if (err != nil) != tt.wantErr {
t.Errorf("checkURLScheme(%q): got err %v, want err %v", tt.url, err != nil, tt.wantErr)
}
})
}
}
// TestValidateAuthServerMetaURLs tests validation of AuthServerMeta URL fields.
func TestValidateAuthServerMetaURLs(t *testing.T) {
validMeta := &AuthServerMeta{
Issuer: "https://auth.example.com",
AuthorizationEndpoint: "https://auth.example.com/authorize",
TokenEndpoint: "https://auth.example.com/token",
JWKSURI: "https://auth.example.com/.well-known/jwks.json",
RegistrationEndpoint: "https://auth.example.com/register",
ServiceDocumentation: "https://docs.example.com",
OpPolicyURI: "https://example.com/policy",
OpTOSURI: "https://example.com/tos",
RevocationEndpoint: "https://auth.example.com/revoke",
IntrospectionEndpoint: "https://auth.example.com/introspect",
}
t.Run("valid metadata", func(t *testing.T) {
if err := validateAuthServerMetaURLs(validMeta); err != nil {
t.Errorf("validateAuthServerMetaURLs(): got err %v, want nil", err)
}
})
// Test each URL field with a dangerous scheme
dangerousFields := []struct {
name string
setField func(*AuthServerMeta)
}{
{"authorization_endpoint", func(m *AuthServerMeta) { m.AuthorizationEndpoint = "javascript:alert(1)" }},
{"token_endpoint", func(m *AuthServerMeta) { m.TokenEndpoint = "javascript:alert(1)" }},
{"jwks_uri", func(m *AuthServerMeta) { m.JWKSURI = "data:text/html,test" }},
{"registration_endpoint", func(m *AuthServerMeta) { m.RegistrationEndpoint = "vbscript:test" }},
{"service_documentation", func(m *AuthServerMeta) { m.ServiceDocumentation = "javascript:void(0)" }},
{"op_policy_uri", func(m *AuthServerMeta) { m.OpPolicyURI = "javascript:x" }},
{"op_tos_uri", func(m *AuthServerMeta) { m.OpTOSURI = "data:,test" }},
{"revocation_endpoint", func(m *AuthServerMeta) { m.RevocationEndpoint = "javascript:1" }},
{"introspection_endpoint", func(m *AuthServerMeta) { m.IntrospectionEndpoint = "javascript:2" }},
}
for _, tt := range dangerousFields {
t.Run("dangerous "+tt.name, func(t *testing.T) {
// Copy valid metadata
meta := *validMeta
// Set one field to a dangerous value
tt.setField(&meta)
err := validateAuthServerMetaURLs(&meta)
if err == nil {
t.Errorf("validateAuthServerMetaURLs(): got nil error, want error for dangerous %s", tt.name)
} else if !strings.Contains(err.Error(), tt.name) {
t.Errorf("validateAuthServerMetaURLs(): got error %v, want error containing %q", err, tt.name)
}
})
}
t.Run("empty optional fields are valid", func(t *testing.T) {
meta := &AuthServerMeta{
Issuer: "https://auth.example.com",
AuthorizationEndpoint: "https://auth.example.com/authorize",
TokenEndpoint: "https://auth.example.com/token",
JWKSURI: "https://auth.example.com/.well-known/jwks.json",
// All optional fields left empty
}
if err := validateAuthServerMetaURLs(meta); err != nil {
t.Errorf("validateAuthServerMetaURLs(): got err %v, want nil", err)
}
})
}
// TestValidateClientRegistrationURLs tests validation of ClientRegistrationMetadata URL fields.
func TestValidateClientRegistrationURLs(t *testing.T) {
validMeta := &ClientRegistrationMetadata{
RedirectURIs: []string{"https://app.example.com/callback", "myapp://callback"},
ClientURI: "https://example.com",
LogoURI: "https://example.com/logo.png",
TOSURI: "https://example.com/tos",
PolicyURI: "https://example.com/policy",
JWKSURI: "https://example.com/.well-known/jwks.json",
}
t.Run("valid metadata", func(t *testing.T) {
if err := validateClientRegistrationURLs(validMeta); err != nil {
t.Errorf("validateClientRegistrationURLs(): got err %v, want nil", err)
}
})
t.Run("dangerous redirect_uri", func(t *testing.T) {
meta := *validMeta
meta.RedirectURIs = []string{"https://safe.com/cb", "javascript:alert(1)"}
err := validateClientRegistrationURLs(&meta)
if err == nil {
t.Error("validateClientRegistrationURLs(): got nil error, want error for dangerous redirect_uri")
} else if !strings.Contains(err.Error(), "redirect_uris[1]") {
t.Errorf("validateClientRegistrationURLs(): got error %v, want error containing \"redirect_uris[1]\"", err)
}
})
// Test each URL field with a dangerous scheme
dangerousFields := []struct {
name string
setField func(*ClientRegistrationMetadata)
}{
{"client_uri", func(m *ClientRegistrationMetadata) { m.ClientURI = "javascript:alert(1)" }},
{"logo_uri", func(m *ClientRegistrationMetadata) { m.LogoURI = "data:image/svg,<script>alert(1)</script>" }},
{"tos_uri", func(m *ClientRegistrationMetadata) { m.TOSURI = "vbscript:test" }},
{"policy_uri", func(m *ClientRegistrationMetadata) { m.PolicyURI = "javascript:void(0)" }},
{"jwks_uri", func(m *ClientRegistrationMetadata) { m.JWKSURI = "data:application/json,{}" }},
}
for _, tt := range dangerousFields {
t.Run("dangerous "+tt.name, func(t *testing.T) {
meta := *validMeta
tt.setField(&meta)
err := validateClientRegistrationURLs(&meta)
if err == nil {
t.Errorf("validateClientRegistrationURLs(): got nil error, want error for dangerous %s", tt.name)
} else if !strings.Contains(err.Error(), tt.name) {
t.Errorf("validateClientRegistrationURLs(): got error %v, want error containing %q", err, tt.name)
}
})
}
t.Run("empty optional fields are valid", func(t *testing.T) {
meta := &ClientRegistrationMetadata{
RedirectURIs: []string{"https://app.example.com/callback"},
// All optional URL fields left empty
}
if err := validateClientRegistrationURLs(meta); err != nil {
t.Errorf("validateClientRegistrationURLs(): got err %v, want nil", err)
}
})
}
// TestGetAuthServerMetaRejectsDangerousURLs tests that GetAuthServerMeta rejects
// metadata containing dangerous URL schemes.
func TestGetAuthServerMetaRejectsDangerousURLs(t *testing.T) {
tests := []struct {
name string
metadata AuthServerMeta
wantErrText string
}{
{
name: "javascript authorization_endpoint",
metadata: AuthServerMeta{
Issuer: "", // Will be set dynamically
AuthorizationEndpoint: "javascript:alert('xss')",
TokenEndpoint: "https://auth.example.com/token",
JWKSURI: "https://auth.example.com/.well-known/jwks.json",
ResponseTypesSupported: []string{"code"},
CodeChallengeMethodsSupported: []string{"S256"},
},
wantErrText: "authorization_endpoint",
},
{
name: "data token_endpoint",
metadata: AuthServerMeta{
Issuer: "",
AuthorizationEndpoint: "https://auth.example.com/authorize",
TokenEndpoint: "data:text/html,<script>alert(1)</script>",
JWKSURI: "https://auth.example.com/.well-known/jwks.json",
ResponseTypesSupported: []string{"code"},
CodeChallengeMethodsSupported: []string{"S256"},
},
wantErrText: "token_endpoint",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
meta := tt.metadata
meta.Issuer = "https://" + r.Host
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(meta)
}))
defer server.Close()
ctx := context.Background()
issuer := server.URL
metadataURL := issuer
_, err := GetAuthServerMeta(ctx, metadataURL, issuer, server.Client())
if err == nil {
t.Fatal("GetAuthServerMeta(): got nil error, want error")
}
if !strings.Contains(err.Error(), tt.wantErrText) {
t.Errorf("GetAuthServerMeta(): got error %v, want error containing %q", err, tt.wantErrText)
}
})
}
}
// TestGetProtectedResourceMetadataRejectsDangerousURLs tests that
// GetProtectedResourceMetadataFromID rejects metadata with dangerous authorization server URLs.
func TestGetProtectedResourceMetadataRejectsDangerousURLs(t *testing.T) {
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
serverURL := "https://" + r.Host
meta := ProtectedResourceMetadata{
Resource: serverURL,
AuthorizationServers: []string{"javascript:alert('xss')"},
}
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(meta)
}))
defer server.Close()
ctx := context.Background()
_, err := GetProtectedResourceMetadataFromID(ctx, server.URL, server.Client())
if err == nil {
t.Fatal("GetProtectedResourceMetadataFromID(): got nil error, want error")
}
if !strings.Contains(err.Error(), "disallowed scheme") {
t.Errorf("GetProtectedResourceMetadataFromID(): got error %v, want error containing \"disallowed scheme\"", err)
}
}
// TestRegisterClientRejectsDangerousURLs tests that RegisterClient rejects
// responses containing dangerous URL schemes.
func TestRegisterClientRejectsDangerousURLs(t *testing.T) {
tests := []struct {
name string
responseJSON string
wantErrText string
}{
{
name: "javascript redirect_uri in response",
responseJSON: `{
"client_id": "test-client",
"redirect_uris": ["javascript:alert(1)"]
}`,
wantErrText: "redirect_uris[0]",
},
{
name: "data client_uri",
responseJSON: `{
"client_id": "test-client",
"redirect_uris": ["https://app.example.com/callback"],
"client_uri": "data:text/html,<script>alert(1)</script>"
}`,
wantErrText: "client_uri",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusCreated)
w.Write([]byte(tt.responseJSON))
}))
defer server.Close()
ctx := context.Background()
clientMeta := &ClientRegistrationMetadata{
RedirectURIs: []string{"https://app.example.com/callback"},
}
_, err := RegisterClient(ctx, server.URL+"/register", clientMeta, server.Client())
if err == nil {
t.Fatal("RegisterClient(): got nil error, want error")
}
if !strings.Contains(err.Error(), tt.wantErrText) {
t.Errorf("RegisterClient(): got error %v, want error containing %q", err, tt.wantErrText)
}
})
}
}