[Server] Reject a placeholder-less resource template URI at registration - #477
Open
wachterjohannes wants to merge 1 commit into
Conversation
A URI template without a placeholder was accepted by Builder::addResourceTemplate() and only rejected when the registry was loaded. Loading is lazy by default, so that happened while a request was being served, aborted the whole load and left every other element unreachable: one malformed template answered tools/list and tools/call with -32602 and the template's message. The builder now refuses it where it is written, naming the handler and pointing a URI that addresses a single resource at addResource(). Fixes modelcontextprotocol#476
wachterjohannes
requested review from
CodeWithKyrian,
Nyholm,
chr-hertel and
soyuka
as code owners
August 23, 2026 20:30
chr-hertel
reviewed
Aug 23, 2026
| ): self { | ||
| if (!ResourceTemplate::isValidUriTemplate($uriTemplate)) { | ||
| throw new InvalidArgumentException(\sprintf('Invalid URI template "%s" for resource template handler %s: a template needs a scheme and at least one placeholder, e.g. "user://{userId}/profile". Use addResource() for a URI that addresses a single resource.', $uriTemplate, $this->describeHandler($handler))); | ||
| } |
Member
There was a problem hiding this comment.
bringing the validation logic into Builder is not a real option to me. even tho you tried to mitigate with that new isValidUriTemplate method, this still is a bit leaky and wouldn't scale nice - think of bringing all those validation+exception paths to the Builder ... 😬
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #476.
A URI template without a placeholder was accepted by
Builder::addResourceTemplate()and only rejected when the registry was loaded. Loading is lazy by default, so that happened while a request was being served, aborted the whole load, and left every other element unreachable: one malformed template answeredtools/listandtools/callwith-32602and the template's message.The builder now refuses it where it is written, naming the handler and pointing a URI that addresses a single resource at
addResource().Builder::add()already validated eagerly, since it takes a constructedResourceTemplate, so this brings the two registration entry points in line.Adds
ResourceTemplate::isValidUriTemplate()so the check lives with the pattern it belongs to.Not addressed here, both worth a separate look: a
ConfigurationExceptionreaching the client as-32602(Invalid params) for a server-side configuration error, and a single failing element aborting the whole registry load.