mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-27 02:44:50 +01:00
DottaandClaude Opus 5
fc9f6619b1
A generic remote MCP connection points at an arbitrary authorization server, so `error`, `error_description`, `error_uri` and the response body are all attacker-chosen. Paperclip was returning the provider's `error_description` verbatim as the public error message on the callback-denial, token-exchange and dynamic-client-registration paths, and the callback did it before validating the state at all. A hostile provider could therefore plant a canary secret, ANSI escapes, or "paste your recovery key here" instructions into API responses, board UI copy, and 4xx log lines — in Paperclip's own voice. The operator now only ever reads text Paperclip authored: - `normalizeOAuthProviderError` reduces the provider's `error` to a bounded, allowlisted label (RFC 6749 §4.1.2.1/§5.2, RFC 7591 §3.2.2, OIDC Core §3.1.2.6). An unrecognized code collapses to `unrecognized` rather than being echoed, since the label is still untrusted input. - `oauthProviderErrorMessage` maps that label to stable Paperclip copy. The label plus the upstream HTTP status stay in structured `details` for diagnosis; the description and body are never read on any path. - `error_description` is gone from the callback route and from the `completeOAuthCallback` input type, so there is nothing left to reflect through, and `redactSensitive` scrubs it from the request query that `customProps` copies into 4xx log lines. - The callback validates the state binding and the actor before acting on a provider-reported failure, and consumes the state so a denial is terminal. Refresh goes through the same token-exchange path, and revocation makes no provider call, so both are covered. Tests plant a canary secret, ANSI escapes and markdown in `error_description` and assert none of it reaches an API response, a thrown message, a console line, an audit row or an activity detail; both assertions were negative-controlled by restoring the reflection. PAP-17108. Finding 3 of the PAP-17088 security review. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>