| 1 | package mcpinteraction |
| 2 | |
| 3 | import ( |
| 4 | "net/url" |
| 5 | "strings" |
| 6 | ) |
| 7 | |
| 8 | // allowedURL reports whether a server-provided elicitation URL may be shown to |
| 9 | // the user: http/https only, host present, and no userinfo or embedded |
| 10 | // credentials. The UI still shows server identity plus target domain and only |
| 11 | // opens the browser on explicit user action. |
| 12 | func allowedURL(raw string) bool { |
| 13 | if strings.TrimSpace(raw) == "" { |
| 14 | return false |
| 15 | } |
| 16 | u, err := url.Parse(raw) |
| 17 | if err != nil { |
| 18 | return false |
| 19 | } |
| 20 | switch strings.ToLower(u.Scheme) { |
| 21 | case "http", "https": |
| 22 | default: |
| 23 | return false |
| 24 | } |
| 25 | if u.User != nil { |
| 26 | return false |
| 27 | } |
| 28 | if u.Host == "" { |
| 29 | return false |
| 30 | } |
| 31 | if u.RawQuery != "" && strings.Contains(strings.ToLower(u.RawQuery), "password=") { |
| 32 | return false |
| 33 | } |
| 34 | return true |
| 35 | } |
| 36 |