Skip to content

bridge::resources::make_uri bypasses encode_rfc3986_path_chars, can leak reserved chars in lsp-diagnostics:// URIs #265

Description

@bug-ops

Description

bridge::resources::make_uri (crates/mcpls-core/src/bridge/resources.rs:64-72) builds lsp-diagnostics:// URIs directly from Url::from_file_path, without routing through encode_rfc3986_path_chars the way bridge::state::try_path_to_uri does for file:// URIs. As a result, paths containing [, ], ^, or | produce lsp-diagnostics:// URIs with those characters left unencoded — non-conformant per RFC 3986 §2.2.

Found during review of #264 (which added a regression test pinning encode_rfc3986_path_chars's behavior for #168, scoped explicitly to the file:// conversion path only).

Reproduction Steps

  1. Configure a workspace containing a file whose path includes one of [ ] ^ | (e.g. test[]^|.ts).
  2. Trigger a code path that calls make_uri for that file (production callers: mcp/server.rs:511,592,642, lib.rs:133).
  3. Observe the resulting lsp-diagnostics:// URI.

Expected Behavior

lsp-diagnostics:// URIs should have the same RFC 3986 §2.2 "other reserved" characters ([ ] ^ | { } backtick) percent-encoded as file:// URIs produced by try_path_to_uri.

Actual Behavior

Empirically verified against url 2.5.8: make_uri emits lsp-diagnostics:///home/user/test[]^|%7B%7D%60.ts[ ] ^ | raw, only { } backtick encoded (via the url crate's default WHATWG percent-encode set). try_path_to_uri on the same path correctly gives file:///home/user/test%5B%5D%5E%7C%7B%7D%60.ts.

Environment

Logs / Evidence

Found by the rust-critic agent during adversarial review of PR #264 (issue #168's fix). Risk is low in practice — rust-analyzer, pyright, and most LSP servers use permissive WHATWG URL parsing — but the inconsistency between the two URI-building paths is real and worth closing for conformance.

Metadata

Metadata

Assignees

Labels

P3Low: cosmetic, edge case unlikely in practicebugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions