Files
modelcontextprotocol--pytho…/tests
Max Isbey 19822fbbeb fix: reject {expr}{+var} adjacency to close ReDoS gap
The adjacency check rejected {+a}{b} but not the symmetric {a}{+b}.
Both produce overlapping greedy quantifiers; a 64KB crafted input
against prefix{a}{+b}.json takes ~23s to reject.

Added prev_path_expr tracking so {+var} immediately after any path
expression is rejected. {expr}{#var} remains allowed since the #
operator prepends a literal '#' that the preceding group's character
class excludes, giving a natural boundary.

Also adds the missing 'from typing import Any' to the three low-level
server examples in docs/server/resources.md.
2026-03-27 13:31:10 +00:00
..
2024-09-24 22:04:19 +01:00
2025-02-05 11:02:51 +00:00