From 1dc27494303e1e0b9186017b6a82082c701b0916 Mon Sep 17 00:00:00 2001 From: Rodolfo Olivieri Date: Tue, 12 May 2026 15:16:48 -0300 Subject: [PATCH] fix: return 400 instead of panicking on invalid CSP header value (#8810) Signed-off-by: Rodolfo Olivieri --- crates/goose-server/src/routes/mcp_app_proxy.rs | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/crates/goose-server/src/routes/mcp_app_proxy.rs b/crates/goose-server/src/routes/mcp_app_proxy.rs index a2c5d157..2a4a7502 100644 --- a/crates/goose-server/src/routes/mcp_app_proxy.rs +++ b/crates/goose-server/src/routes/mcp_app_proxy.rs @@ -255,10 +255,21 @@ async fn serve_guest_html( // no-referrer would cause 401s from SDK servers. headers.insert( header::HeaderName::from_static("referrer-policy"), - "strict-origin".parse().unwrap(), + header::HeaderValue::from_static("strict-origin"), ); if !csp.is_empty() { - headers.insert(header::CONTENT_SECURITY_POLICY, csp.parse().unwrap()); + match csp.parse::() { + Ok(csp_value) => { + headers.insert(header::CONTENT_SECURITY_POLICY, csp_value); + } + Err(_) => { + return ( + StatusCode::BAD_REQUEST, + "Invalid characters in Content-Security-Policy value", + ) + .into_response(); + } + } } response }