mcp_json_rest_bridge: percent-encode '.' and '/' in path-template values (fixes #45931)

[omkhar]

Summary

The mcp_json_rest_bridge HTTP filter builds the upstream REST request URL by substituting values from the (untrusted) JSON-RPC arguments object into a configured path template. constructBaseUrl() percent-encodes each substituted value with:

Http::Utility::PercentEncoding::encode(jsonValueToString(*template_value_json), ReservedChars);

ReservedChars (http_request_builder.h) left [-_./0-9a-zA-Z] unescaped. Because . and / were unescaped, an attacker-controlled template value could inject additional path segments into the upstream URL.

Impact

For a template /v1/users/{userId}/profile, a value of ../../admin yields /v1/users/../../admin/profile (path traversal) and 7/actions/delete yields /v1/users/7/actions/delete/profile (segment injection). The value originates from the untrusted MCP request body, so a client can reach REST resources/verbs outside the single path segment the template author intended (CWE-22 / CWE-88).

Reproduction

Substituting the routines (PercentEncoding::encode, constructBaseUrl, ReservedChars) into a standalone harness shows the injection through ordinary filter use:

arg userId=alice            -> /v1/users/alice/profile
arg userId=../../admin      -> /v1/users/../../admin/profile          (injection)
arg userId=7/actions/delete -> /v1/users/7/actions/delete/profile     (injection)

Fix

Add . and / to ReservedChars so path separators in a substituted path-template value are percent-encoded. This matches the Google API path-template semantics (a single {var} binds one path segment) and prevents segment/traversal injection. After the fix the same inputs encode safely and benign values are unchanged:

arg userId=alice            -> /v1/users/alice/profile
arg userId=../../admin      -> /v1/users/%2E%2E%2F%2E%2E%2Fadmin/profile
arg userId=7/actions/delete -> /v1/users/7%2Factions%2Fdelete/profile

Fixes #45931