Security: Unsanitized client name used in User-Agent construction

[tuanaiseo]

Problem

buildUserAgent appends untrusted clientName directly into a header value. If clientName contains control characters (e.g., CR/LF), it may enable header injection or malformed outbound requests depending on HTTP client behavior.

Severity: medium
File: tools/modelcontextprotocol/src/userAgent.ts

Solution

Sanitize clientName before interpolation: strip/deny CR, LF, and non-printable characters; enforce a strict allowlist regex and length limit.

Changes

• tools/modelcontextprotocol/src/userAgent.ts (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}