From 10daa522e0d44ac44ec24a49ca8a9ca9b4574965 Mon Sep 17 00:00:00 2001 From: Edgar Arakelyan Date: Sun, 18 Oct 2026 12:39:48 -0700 Subject: [PATCH] test(mcp): count both plain-route observations in the request-target regression The previous commit added a second successful route call to the regression but left the single-observation assertion in place. Co-Authored-By: Claude Fable 5.1 --- src/server/http/serveStreamableHttp.test.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/server/http/serveStreamableHttp.test.ts b/src/server/http/serveStreamableHttp.test.ts index 5a884a67c7..6e72d4d2ba 100644 --- a/src/server/http/serveStreamableHttp.test.ts +++ b/src/server/http/serveStreamableHttp.test.ts @@ -668,7 +668,8 @@ it("keeps a network-path request target as a path and refuses absolute-form targ expect((await rawTargetRequest(url, "/card?x=1")).status).toBe(200); const plain = await rawTargetRequest(url, "/card"); expect(plain.status).toBe(200); - expect(seen).toEqual([`127.0.0.1:${url.port}`]); + // Both successful route calls saw only the bound host, never the attacker-selected one. + expect(seen).toEqual([`127.0.0.1:${url.port}`, `127.0.0.1:${url.port}`]); }); it("lets only a lone initialize replace a session, not a batch that carries one", async () => {