From 838a380315796bc3ab64b1ab3321a25bc2bb0fc9 Mon Sep 17 00:00:00 2001 From: Koichi ITO Date: Sat, 31 Oct 2026 01:50:37 +0900 Subject: [PATCH] Read the wire `_meta` member back through JSON in the Skills server test ## Motivation and Context The test that checks `skills/list` and `skills/get` emit a skill's `_meta` under that key sliced the generated JSON with the regexp `/"_meta":\{[^}]*\}/`. CodeQL flags the pattern as polynomial on a crafted subject (code scanning alert 14): on a subject that repeats `"_meta":{` without a closing brace, the unanchored match restarts at every occurrence and `[^}]*` scans to the end before `\}` fails, so the work grows with the square of the length. The subject here is the server's own output, so nothing untrusted reaches the regexp, but the test needs no regexp at all: parsing the generated JSON back and reading `"_meta"` checks the same thing, the key the wire carries, without a pattern a scanner has to reason about. ## How Has This Been Tested? test/mcp/server_skills_test.rb; the test still fails when `Skill#to_h` emits the member under another key. ## Breaking Changes None. --- test/mcp/server_skills_test.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/mcp/server_skills_test.rb b/test/mcp/server_skills_test.rb index f55b1ddd..aeaa35eb 100644 --- a/test/mcp/server_skills_test.rb +++ b/test/mcp/server_skills_test.rb @@ -102,7 +102,8 @@ def initialize_capabilities(server) got = server.handle(request("skills/get", { uri: "skill://git/SKILL.md" }))[:result] assert_equal annotated.to_h, got[:skill] assert_equal({ "com.example/origin" => "catalog" }, got[:skill][:_meta]) - assert_equal '"_meta":{"com.example/origin":"catalog"}', JSON.generate(got[:skill])[/"_meta":\{[^}]*\}/] + # Read back through JSON, so the key the wire carries is checked, not the Symbol the Hash holds. + assert_equal({ "com.example/origin" => "catalog" }, JSON.parse(JSON.generate(got[:skill]))["_meta"]) end end