Skip to content

fix/3811-pipe-validation-issue #3814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brian-hussey merged 9 commits into from
Mar 27, 2026
Merged

fix/3811-pipe-validation-issue #3814

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
11c0dab
fix(validation): remove single pipe from forbidden description patterns
Nayana-R-Gowda Mar 27, 2026
d0501bc
fix(env): align .env.example JWT secret with docker-compose default
crivetimihai Mar 27, 2026
aab6f25
chore: apply linter and formatter fixes
crivetimihai Mar 27, 2026
7d14c99
fix(env): align all JWT secret defaults with docker-compose (#3889)
crivetimihai Mar 27, 2026
d5582d2
fix(security): detect both JWT default secrets in guard paths
crivetimihai Mar 27, 2026
3cf41d1
chore: update .secrets.baseline line numbers after reformatting
crivetimihai Mar 27, 2026
d7b783c
chore: allowlist test JWT secrets for detect-secrets hook
crivetimihai Mar 27, 2026
d9ab152
chore: update .secrets.baseline after allowlist pragmas
crivetimihai Mar 27, 2026
afc0d2d
baseline
crivetimihai Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ BASIC_AUTH_PASSWORD=changeme

# JWT secret used to sign tokens
# PRODUCTION: Use a strong, unique value
JWT_SECRET_KEY=my-test-key
JWT_SECRET_KEY=my-test-key-but-now-longer-than-32-bytes

# Passphrase used to encrypt stored auth secrets
# PRODUCTION: Use a strong, unique value
Expand Down Expand Up @@ -731,7 +731,7 @@ OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
# Secret used to sign JWTs (required for HMAC algorithms: HS256, HS384, HS512)
# PRODUCTION: Use a strong, random secret (minimum 32 characters)
# Generate with: openssl rand -base64 32
# JWT_SECRET_KEY=my-test-key
# JWT_SECRET_KEY=my-test-key-but-now-longer-than-32-bytes

# === RSA/ECDSA (Asymmetric) Configuration - Recommended for Production ===
# Public and private key paths (required for asymmetric algorithms: RS*, ES*)
Expand Down
116 changes: 27 additions & 89 deletions .secrets.baseline
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"files": "package-lock.json|Cargo.lock|^.secrets.baseline$|scripts/sign_image.sh|scripts/zap|sonar-project.properties|^/Users/brian/dev/github.ibm.com/contextforge-org/sps-pipeline-config/.secrets.baseline$|^./.secrets.baseline$",
"lines": null
},
"generated_at": "2026-03-27T11:29:30Z",
"generated_at": "2026-03-27T15:57:24Z",
"plugins_used": [
{
"name": "AWSKeyDetector"
Expand Down Expand Up @@ -765,14 +765,6 @@
"line_number": 90,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "58c9f274f0f40ca6d9a5eb4e3dc87e9eb08cc333",
"is_secret": false,
"is_verified": false,
"line_number": 124,
"type": "Secret Keyword",
"verified_result": null
}
],
"charts/mcp-stack/values.yaml": [
Expand Down Expand Up @@ -847,14 +839,6 @@
"line_number": 1741,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "58c9f274f0f40ca6d9a5eb4e3dc87e9eb08cc333",
"is_secret": false,
"is_verified": false,
"line_number": 1774,
"type": "Secret Keyword",
"verified_result": null
}
],
"docker-compose-debug.yml": [
Expand Down Expand Up @@ -5094,31 +5078,31 @@
"hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
"is_secret": false,
"is_verified": false,
"line_number": 4196,
"line_number": 4194,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "559b05f1b2863e725b76e216ac3dadecbf92e244",
"is_secret": false,
"is_verified": false,
"line_number": 4804,
"line_number": 4802,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "a8af4759392d4f7496d613174f33afe2074a4b8d",
"is_secret": false,
"is_verified": false,
"line_number": 4806,
"line_number": 4804,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "85b60d811d16ff56b3654587d4487f713bfa33b7",
"is_secret": false,
"is_verified": false,
"line_number": 14835,
"line_number": 14821,
"type": "Secret Keyword",
"verified_result": null
}
Expand Down Expand Up @@ -5234,7 +5218,7 @@
"hashed_secret": "83af00f2e79329f549c1438dec118e0cba4ad111",
"is_secret": false,
"is_verified": false,
"line_number": 17,
"line_number": 18,
"type": "Hex High Entropy String",
"verified_result": null
}
Expand Down Expand Up @@ -5322,7 +5306,7 @@
"hashed_secret": "10b36c8089b5791d82f0700828fd23a9c782101f",
"is_secret": false,
"is_verified": false,
"line_number": 18,
"line_number": 19,
"type": "Hex High Entropy String",
"verified_result": null
}
Expand Down Expand Up @@ -5426,7 +5410,7 @@
"hashed_secret": "74cf584eb4fffdfa472c808000adb71841786f3e",
"is_secret": false,
"is_verified": false,
"line_number": 13,
"line_number": 14,
"type": "Hex High Entropy String",
"verified_result": null
}
Expand Down Expand Up @@ -5896,7 +5880,7 @@
"hashed_secret": "d3ecb0d890368d7659ee54010045b835dacb8efe",
"is_secret": false,
"is_verified": false,
"line_number": 611,
"line_number": 610,
"type": "Secret Keyword",
"verified_result": null
}
Expand All @@ -5906,47 +5890,47 @@
"hashed_secret": "c377074d6473f35a91001981355da793dc808ffd",
"is_secret": false,
"is_verified": false,
"line_number": 4099,
"line_number": 4101,
"type": "Hex High Entropy String",
"verified_result": null
},
{
"hashed_secret": "6367c48dd193d56ea7b0baad25b19455e529f5ee",
"is_secret": false,
"is_verified": false,
"line_number": 5212,
"line_number": 5214,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
"is_secret": false,
"is_verified": false,
"line_number": 5376,
"line_number": 5378,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "f42a3fabe1e9bed059d727f47eb752e3aa61b977",
"is_secret": false,
"is_verified": false,
"line_number": 5433,
"line_number": 5435,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "b85788b459aa4d67e1070930dae6d0827756aadb",
"is_secret": false,
"is_verified": false,
"line_number": 5471,
"line_number": 5473,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "52dcc83ec1e54426ad58a64854d1eb8d5f5d9685",
"is_secret": false,
"is_verified": false,
"line_number": 5472,
"line_number": 5474,
"type": "Secret Keyword",
"verified_result": null
}
Expand Down Expand Up @@ -6290,7 +6274,7 @@
"hashed_secret": "e2eea31cf61d791c922b110554ce1f0a6ed046e9",
"is_secret": false,
"is_verified": false,
"line_number": 177,
"line_number": 178,
"type": "Hex High Entropy String",
"verified_result": null
}
Expand All @@ -6300,31 +6284,31 @@
"hashed_secret": "e6a51c968d41fd1d3437e6b7d9101e527ee1b83f",
"is_secret": false,
"is_verified": false,
"line_number": 66,
"line_number": 67,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "9c4006403b5388cd34ccfe3ed1b1d3e53cf35700",
"is_secret": false,
"is_verified": false,
"line_number": 80,
"line_number": 81,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "d01e71e4c47a4022acd25c74bffedd2641a60c70",
"is_secret": false,
"is_verified": false,
"line_number": 95,
"line_number": 96,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "39fc8e4accd6a3563c4be159e507195ad3d7274c",
"is_secret": false,
"is_verified": false,
"line_number": 105,
"line_number": 106,
"type": "Secret Keyword",
"verified_result": null
}
Expand Down Expand Up @@ -7251,14 +7235,6 @@
"line_number": 45,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "58c9f274f0f40ca6d9a5eb4e3dc87e9eb08cc333",
"is_secret": false,
"is_verified": false,
"line_number": 48,
"type": "Secret Keyword",
"verified_result": null
}
],
"scripts/lib/common.sh": [
Expand Down Expand Up @@ -7290,14 +7266,6 @@
}
],
"scripts/test_email_auth_api.py": [
{
"hashed_secret": "58c9f274f0f40ca6d9a5eb4e3dc87e9eb08cc333",
"is_secret": false,
"is_verified": false,
"line_number": 53,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "55ae024ac61278627948dc9375b31bbbbfd7b442",
"is_secret": false,
Expand Down Expand Up @@ -7457,16 +7425,6 @@
"verified_result": null
}
],
"tests/e2e/test_mcp_plugin_parity.py": [
{
"hashed_secret": "58c9f274f0f40ca6d9a5eb4e3dc87e9eb08cc333",
"is_secret": false,
"is_verified": false,
"line_number": 50,
"type": "Secret Keyword",
"verified_result": null
}
],
"tests/e2e/test_mcp_rbac_transport.py": [
{
"hashed_secret": "6e2e8a100b17f5c9083b5f8c6f2ed58ae6286e5b",
Expand Down Expand Up @@ -7931,16 +7889,6 @@
"verified_result": null
}
],
"tests/performance/config.yaml": [
{
"hashed_secret": "58c9f274f0f40ca6d9a5eb4e3dc87e9eb08cc333",
"is_secret": false,
"is_verified": false,
"line_number": 4,
"type": "Secret Keyword",
"verified_result": null
}
],
"tests/performance/scenarios/gateway-core-benchmark.sh": [
{
"hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
Expand Down Expand Up @@ -7971,16 +7919,6 @@
"verified_result": null
}
],
"tests/performance/utils/setup-auth.sh": [
{
"hashed_secret": "cf0882ad29ec9afa054619ea99d5f9ac8e80c359",
"is_secret": false,
"is_verified": false,
"line_number": 28,
"type": "Secret Keyword",
"verified_result": null
}
],
"tests/playwright/README.md": [
{
"hashed_secret": "0df7be1bea60575a7469f5e07e13124ce428d263",
Expand Down Expand Up @@ -10978,55 +10916,55 @@
"hashed_secret": "277fd76456880437641f76de1bfa6d7ef61ae861",
"is_secret": false,
"is_verified": false,
"line_number": 750,
"line_number": 770,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "4ea8d2335b430796cf3f500368c5b0f5b1dc90f5",
"is_secret": false,
"is_verified": false,
"line_number": 931,
"line_number": 951,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "57b2ad99044d337197c0c39fd3823568ff81e48a",
"is_secret": false,
"is_verified": false,
"line_number": 936,
"line_number": 956,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "3d12349760de61e8070eea4704d2c471731bdd15",
"is_secret": false,
"is_verified": false,
"line_number": 962,
"line_number": 982,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "640d87e741e6aa4c669a82a4cd304787960513ab",
"is_secret": false,
"is_verified": false,
"line_number": 980,
"line_number": 1000,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
"is_secret": false,
"is_verified": false,
"line_number": 1183,
"line_number": 1208,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "8db15e8ba2f571ba5d630b4edf3a52d265668f0a",
"is_secret": false,
"is_verified": false,
"line_number": 1299,
"line_number": 1324,
"type": "Secret Keyword",
"verified_result": null
}
Expand Down
2 changes: 1 addition & 1 deletion DEVELOPING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -475,7 +475,7 @@ make dev
# Setup environment
export MCP_GATEWAY_BASE_URL=http://localhost:4444
export MCP_SERVER_URL=http://localhost:4444/servers/UUID/mcp
export MCP_AUTH="Bearer $(python3 -m mcpgateway.utils.create_jwt_token --username admin --exp 0 --secret my-test-key)"
export MCP_AUTH="Bearer $(python3 -m mcpgateway.utils.create_jwt_token --username admin --exp 0 --secret my-test-key-but-now-longer-than-32-bytes)"

# Launch Inspector with SSE (direct)
npx @modelcontextprotocol/inspector
Expand Down
4 changes: 2 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1434,7 +1434,7 @@ inspector-up: ## Start MCP Inspector (interactive M
@echo ""
@echo " Generate a JWT token:"
@echo " python -m mcpgateway.utils.create_jwt_token \\"
@echo " --username admin@example.com --exp 10080 --secret my-test-key --algo HS256"
@echo " --username admin@example.com --exp 10080 --secret my-test-key-but-now-longer-than-32-bytes --algo HS256"
@echo ""

inspector-down: ## Stop MCP Inspector
Expand Down Expand Up @@ -2559,7 +2559,7 @@ JMETER_RENDERED_DIR := $(CURDIR)/.jmeter/rendered
JMETER_RENDER := python3 $(JMETER_DIR)/render_fragments.py --out $(JMETER_RENDERED_DIR)
JMETER_GATEWAY_URL ?= http://localhost:8080
export JMETER_OPTS ?= -Djava.util.prefs.userRoot=/tmp/jmeter-prefs -Djava.util.prefs.systemRoot=/tmp/jmeter-prefs
JMETER_JWT_SECRET ?= $(or $(JWT_SECRET_KEY),my-test-key)
JMETER_JWT_SECRET ?= $(or $(JWT_SECRET_KEY),my-test-key-but-now-longer-than-32-bytes)
JMETER_TOKEN ?= $(shell python3 -m mcpgateway.utils.create_jwt_token --data '{"sub":"admin@example.com","is_admin":true,"teams":null}' --exp 10080 --secret $(JMETER_JWT_SECRET) 2>/dev/null || echo "")
JMETER_SERVER_ID ?=
JMETER_FAST_TIME_URL ?= http://localhost:8888
Expand Down
Loading
Loading