fix(server): build progress notification JSON with Jackson instead of String.format #88

Merged

fred merged 1 commit from fix/50-json-injection-progress into main

2026-09-07 18:38:53 +00:00

hauschel.fred commented

2026-09-07 18:23:10 +00:00

Collaborator

Summary

McpStdioServer.sendProgress() built the notifications/progress message via String.format() and only escaped ". Backslashes, control characters and newlines in the message (e.g. from a Windows path or a test name) produced invalid JSON and could break the NDJSON framing on stdout.

Fix: build the notification with the ObjectMapper already used elsewhere in the server (McpProtocolHandler follows the same ObjectNode + writeValueAsString pattern), instead of hand-rolled string escaping.

Test plan

mvn -pl org.naturzukunft.jdt.mcp -am compile (with the entity-limit MAVEN_OPTS) — BUILD SUCCESS
mvn clean package — full product build succeeds
tests/smoke-test.sh against the built product — 9 passed, 0 failed
Manual check: called sendProgress() with a message containing \, ", \n, \t, \r (e.g. C:\Users\fred\weird "path"\nwith\ttab\rand newline) — output is single-line, valid JSON per jq, and round-trips the original message content correctly.

Closes #50

🤖 Generated with Claude Code

https://claude.ai/code/session_016tHV1dzUTdTwMLgx6yotVd

## Summary `McpStdioServer.sendProgress()` built the `notifications/progress` message via `String.format()` and only escaped `"`. Backslashes, control characters and newlines in the `message` (e.g. from a Windows path or a test name) produced invalid JSON and could break the NDJSON framing on stdout. Fix: build the notification with the `ObjectMapper` already used elsewhere in the server (`McpProtocolHandler` follows the same `ObjectNode` + `writeValueAsString` pattern), instead of hand-rolled string escaping. ## Test plan - [x] `mvn -pl org.naturzukunft.jdt.mcp -am compile` (with the entity-limit `MAVEN_OPTS`) — BUILD SUCCESS - [x] `mvn clean package` — full product build succeeds - [x] `tests/smoke-test.sh` against the built product — 9 passed, 0 failed - [x] Manual check: called `sendProgress()` with a message containing `\`, `"`, `\n`, `\t`, `\r` (e.g. `C:\Users\fred\weird "path"\nwith\ttab\rand newline`) — output is single-line, valid JSON per `jq`, and round-trips the original message content correctly. Closes #50 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_016tHV1dzUTdTwMLgx6yotVd

hauschel.fred added 1 commit

2026-09-07 18:23:10 +00:00

fix(server): build progress notification JSON with Jackson instead of String.format d75134eeec

sendProgress() only escaped double quotes, leaving backslashes, control
characters and newlines in messages to produce invalid JSON and break
the NDJSON framing on stdout. Use the ObjectMapper already used
elsewhere in the server to build the notification, matching the
pattern in McpProtocolHandler.

Closes #50

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016tHV1dzUTdTwMLgx6yotVd