Skip to content

fix(mcp): reject control characters in FinDrive filenames - #561

Open
Deez-Automations wants to merge 2 commits into
GenAI-Security-Project:mainfrom
Deez-Automations:fix/findrive-filename-log-injection-360
Open

fix(mcp): reject control characters in FinDrive filenames#561
Deez-Automations wants to merge 2 commits into
GenAI-Security-Project:mainfrom
Deez-Automations:fix/findrive-filename-log-injection-360

Conversation

@Deez-Automations

Copy link
Copy Markdown

Summary

Fixes #360.

upload_file (FinDrive MCP server) passed filename straight through to storage and into a log line with no validation at all. A filename containing a newline is stored verbatim in the DB and, more importantly, injects a fake log line into the application log — corrupting the audit trail and potentially deceiving anyone monitoring logs for suspicious activity.

Fix

Rejects \n, \r, \t, and \x00 in filenames before they reach storage or logging, matching the fix proposed in the issue. Ordinary filenames are unaffected.

Test plan

  • New test file tests/unit/mcp/test_findrive.py — reproduces the vulnerability first (confirmed failing against the unfixed code), then confirms the fix
  • Covers newline, carriage return, and null byte injection
  • Regression test confirms ordinary valid filenames continue to work unaffected
  • pytest tests/unit/mcp/test_findrive.py — 4/4 passing

…rity-Project#360)

upload_file passed filename straight through to storage and into a log
line with zero validation. A filename containing a newline gets stored
verbatim and, more importantly, injects a fake log line into the
application log -- corrupting the audit trail and deceiving anyone
monitoring logs for suspicious activity.

Rejects \n, \r, \t, and \x00 in filenames before they reach storage or
logging. Ordinary filenames are unaffected.

Fixes GenAI-Security-Project#360
Copilot AI lite review requested due to automatic review settings August 11, 2026 15:08

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses FinDrive MCP upload_file filename log-injection risk by validating filenames before they reach persistence or logging, aligning with Issue #360’s acceptance criteria.

Changes:

  • Added filename validation in upload_file to reject control characters (\n, \r, \t, \x00).
  • Added unit tests covering rejection of newline, carriage return, and null byte filenames, plus a regression test for valid filenames.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File Description
finbot/mcp/servers/findrive/server.py Adds a control-character guard in upload_file before DB write and logging.
tests/unit/mcp/test_findrive.py Introduces unit/regression coverage for the filename validation behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +36 to +38
async def test_fd_fname_003_newline_in_filename_enables_log_injection(
self, db, session_context
):
Comment on lines +61 to +63
@pytest.mark.unit
@pytest.mark.asyncio
async def test_fd_fname_003c_null_byte_in_filename_rejected(self, db, session_context):
Clarified the naming convention on the test that verbatim-matches issue
GenAI-Security-Project#360's own acceptance-criteria test name (name describes the
vulnerability being guarded against, not the assertion direction --
kept as-is for traceability rather than renamed, per Copilot's flag).
Added the missing tab-character coverage: the fix already rejects \t,
but the original test suite only exercised newline/CR/null byte.
@Deez-Automations

Copy link
Copy Markdown
Author

Addressed the Copilot review feedback:

  • Test naming: kept test_fd_fname_003_newline_in_filename_enables_log_injection as-is since it matches issue Bug_151_MUST_FIX: FD-FNAME-003 — Newline character in filename enables log injection #360's own specified acceptance-criteria test name verbatim (useful for traceability back to the issue), but added a docstring note clarifying the name describes the vulnerability being guarded against, not the assertion direction.
  • Missing tab-character coverage: added a dedicated test — the fix already rejected \t, but the original suite only covered newline, carriage return, and null byte.

5/5 tests passing after both changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug_151_MUST_FIX: FD-FNAME-003 — Newline character in filename enables log injection

2 participants