fix: last #54 println, HTTP progress JSON injection (#50 follow-up) #92

Merged

fred merged 2 commits from fix/54-rest-projectinfo-http-progress into main

2026-09-07 19:07:23 +00:00

hauschel.fred commented

2026-09-07 18:50:50 +00:00

Collaborator

Two small remainders from already-merged PRs, module org.naturzukunft.jdt.mcp only.

Closes #54: PR #89 replaced 33 System.err.println calls with McpLogger, but left one in ProjectInfoTools.getJavaProject() open because parallel work touched the file. Routed through McpLogger.error(...), same pattern as the sibling tool classes. No System.err.println remains in the module outside McpLogger.java itself (verified by grep).
Refs #50: McpHttpServer.sendProgress() (SSE transport) had the same JSON-injection issue #50 fixed for McpStdioServer.sendProgress() — it only escaped ", leaving backslashes, newlines and other control characters to produce invalid JSON. Fixed with the same Jackson ObjectMapper/ObjectNode pattern already merged for the stdio transport.

Verification

mvn -pl org.naturzukunft.jdt.mcp -am compile — clean
mvn clean package — clean, tests/smoke-test.sh green (9/9, readiness marker intact)
McpHttpServer.sendProgress() verified end-to-end standalone: started a real McpHttpServer on a free port, opened a real SSE connection, sent a message containing \n, \, " and a tab, captured the raw SSE data: line and validated it with jq — parses correctly and the message round-trips byte-for-byte.

🤖 Generated with Claude Code

https://claude.ai/code/session_016tHV1dzUTdTwMLgx6yotVd

Two small remainders from already-merged PRs, module `org.naturzukunft.jdt.mcp` only. - **Closes #54**: PR #89 replaced 33 `System.err.println` calls with `McpLogger`, but left one in `ProjectInfoTools.getJavaProject()` open because parallel work touched the file. Routed through `McpLogger.error(...)`, same pattern as the sibling tool classes. No `System.err.println` remains in the module outside `McpLogger.java` itself (verified by grep). - **Refs #50**: `McpHttpServer.sendProgress()` (SSE transport) had the same JSON-injection issue #50 fixed for `McpStdioServer.sendProgress()` — it only escaped `"`, leaving backslashes, newlines and other control characters to produce invalid JSON. Fixed with the same Jackson `ObjectMapper`/`ObjectNode` pattern already merged for the stdio transport. ## Verification - `mvn -pl org.naturzukunft.jdt.mcp -am compile` — clean - `mvn clean package` — clean, `tests/smoke-test.sh` green (9/9, readiness marker intact) - `McpHttpServer.sendProgress()` verified end-to-end standalone: started a real `McpHttpServer` on a free port, opened a real SSE connection, sent a message containing `\n`, `\`, `"` and a tab, captured the raw SSE `data:` line and validated it with `jq` — parses correctly and the message round-trips byte-for-byte. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_016tHV1dzUTdTwMLgx6yotVd

hauschel.fred added 2 commits

2026-09-07 18:50:50 +00:00

refactor(logging): route ProjectInfoTools through McpLogger 84122b7df9

The last of 33 System.err.println calls from #54 was left for a
follow-up because parallel work touched the file. Route it through
McpLogger like the other tool classes, so it gets timestamps,
rotation and level filtering and lands in the log file.

Closes #54

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016tHV1dzUTdTwMLgx6yotVd

fix(http): build progress notification JSON with Jackson instead of String.format 5947e69da1

McpHttpServer.sendProgress() (SSE transport) had the same JSON
injection issue #50 fixed for McpStdioServer: it only escaped double
quotes, leaving backslashes, control characters and newlines in
messages to produce invalid JSON. Apply the same fix, an ObjectMapper
building the notification via ObjectNode, matching the pattern
already merged for the stdio transport.

Refs #50

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016tHV1dzUTdTwMLgx6yotVd