Files
github--github-mcp-server/pkg/github
Owen Niblock 60ebbe13a6 Fix runtime description leak on list_issue_fields legacy variant
The pkg/translations TranslationHelper is first-write-wins on cache
hits: if two callers pass the same key with different fallback
strings, only the first fallback is remembered. Both ListIssueFields
(MS-aware) and ListIssueFieldsLegacy shared the translation key
TOOL_LIST_ISSUE_FIELDS_DESCRIPTION, so at runtime the second-registered
variant (legacy) inherited the first's description — leaking the
MS-flavoured 'single_select, multi_select' text into the FF-off surface.

Only list_issue_fields was affected: issue_write and list_issues use
identical top-level descriptions across variants (their MS-vs-legacy
differentiation is in InputSchema property descriptions, which are
hardcoded strings not routed through the translation helper).

Fix: give the legacy variant its own translation key
(TOOL_LIST_ISSUE_FIELDS_LEGACY_DESCRIPTION). Simplify buildListIssueFields
to accept the already-resolved description string, so the two variants
resolve their translation before calling the shared builder.

Live-verified against a local binary:

- FF off: description no longer contains 'multi_select'
- FF on:  description contains 'multi_select'

Regression test: Test_ListIssueFields_LegacyDoesNotLeakMSDescription
UnderRealTranslationHelper uses an in-test cache that mimics the real
helper's first-write-wins behaviour. Confirmed the test fails if both
variants share a key and passes with them split.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-06 13:01:57 +01:00
..
2026-01-06 17:38:12 +00:00