From 45a3cbc33d41646d83b29507a0df01f95fdcff4e Mon Sep 17 00:00:00 2001 From: Sisyphus Date: Sun, 4 Oct 2026 13:02:35 +0800 Subject: [PATCH] fix(mcp): reject YAML aliases in OpenAPI specs --- .../mcp_server/openapi_to_mcp_generator.py | 5 +++++ .../test_openapi_to_mcp_generator.py | 19 ++++++++++++++++++- 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py b/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py index 546154fa696..60fa218d2da 100644 --- a/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py +++ b/litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py @@ -183,6 +183,11 @@ def _parse_openapi_spec(text: str) -> Mapping[str, Any]: import yaml class _NoMergeSafeLoader(yaml.SafeLoader): + def compose_node(self, parent: Any, index: Any) -> Any: + if self.check_event(yaml.events.AliasEvent): + raise yaml.YAMLError("YAML aliases are not supported") + return super().compose_node(parent, index) + def flatten_mapping(self, node: Any) -> None: if any(key_node.tag == "tag:yaml.org,2002:merge" for key_node, _ in node.value): raise yaml.YAMLError("YAML merge keys are not supported") diff --git a/tests/unit/proxy/_experimental/mcp_server/test_openapi_to_mcp_generator.py b/tests/unit/proxy/_experimental/mcp_server/test_openapi_to_mcp_generator.py index 232ccb27784..38b2e08238a 100644 --- a/tests/unit/proxy/_experimental/mcp_server/test_openapi_to_mcp_generator.py +++ b/tests/unit/proxy/_experimental/mcp_server/test_openapi_to_mcp_generator.py @@ -315,7 +315,7 @@ def test_parse_openapi_spec_rejects_non_object_document() -> None: def test_parse_openapi_spec_rejects_yaml_merge_aliases() -> None: import yaml - with pytest.raises(yaml.YAMLError, match="YAML merge keys are not supported"): + with pytest.raises(yaml.YAMLError, match="YAML aliases are not supported"): gen._parse_openapi_spec( """ base: &base @@ -330,6 +330,23 @@ merged: ) +def test_parse_openapi_spec_rejects_yaml_aliases() -> None: + import yaml + + with pytest.raises(yaml.YAMLError, match="YAML aliases are not supported"): + gen._parse_openapi_spec( + """ +shared: &shared + type: string +components: + schemas: + Request: + properties: + first: *shared +""" + ) + + def _create_mock_client(method: str, response_text: str, status_code: int = 200) -> AsyncMock: """Utility to create a mocked async httpx client for the given method.