fix(mcp): guard decoder errors and null-body drain against unhandled crashes

- Attach the stream bridge's error listener before piping into the zlib decoder, so
  a synchronous zlib error (server mislabeling a non-gzip body as gzip) rejects the
  reader instead of crashing the process.
- Attach an error listener before draining a null-body response, and wrap Response
  construction in try/catch that destroys the source (no socket leak) on an
  out-of-range status. Adds an invalid-gzip regression test.

Author: waleedlatif1

apps/sim/lib/core/security/guarded-request-fetch.server.test.ts

@@ -202,6 +202,21 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     expect(response.headers.get('content-length')).toBeNull()
   })
 
+  it('rejects the reader (not crash) when Content-Encoding is gzip but the body is not', async () => {
+    const source = new Readable({ read() {} })
+    source.push(Buffer.from('this is definitely not gzip'))
+    source.push(null)
+    mockUndiciRequest.mockResolvedValueOnce(
+      undiciReply(200, { 'content-type': 'application/json', 'content-encoding': 'gzip' }, source)
+    )
+    const { fetch } = createSsrfGuardedFetchWithDispatcher()
+
+    const response = await fetch('https://mcp.example.com/bad', { method: 'GET' })
+
+    // The zlib error must surface as a rejected read, never an unhandled 'error' event.
+    await expect(response.text()).rejects.toThrow()
+  })
+
   it('rejects the reader when the source is destroyed without an error (abort/reset)', async () => {
     const source = new Readable({ read() {} }) // stays open, never pushes
     mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, source))

apps/sim/lib/core/security/input-validation.server.ts

@@ -831,43 +831,53 @@ async function undiciRequestAsResponse(
     else if (value != null) responseHeaders.append(key, value)
   }
 
-  // 204/205/304 carry no body; `new Response` rejects a non-null body for them. Drain
-  // undici's (empty) stream so its socket returns to the Agent pool instead of leaking.
+  // Null-body statuses (204/205/304) can't carry a body; drain undici's (empty) stream so its
+  // socket returns to the pool. Attach an error listener first so a socket reset mid-drain
+  // surfaces as a handled event, not an unhandled 'error' that crashes the process.
   const isNullBody = statusCode === 204 || statusCode === 205 || statusCode === 304
   if (isNullBody) {
+    body.on('error', () => {})
     body.resume()
     const response = new Response(null, { status: statusCode, headers: responseHeaders })
     Object.defineProperty(response, 'url', { value: url, configurable: true })
     return response
   }
 
   // Decode Content-Encoding like `fetch` does (`request()` returns raw bytes). `maxResponseSize`
-  // still caps the compressed wire bytes on `body`; forward its errors into the decoder so the
-  // cap and any socket reset still surface as a stream error, and tear the source down when the
-  // decoded stream ends or is cancelled so the socket can't leak.
+  // still caps the compressed wire bytes on `body`.
   const contentEncoding = String(headers['content-encoding'] ?? '')
     .toLowerCase()
     .trim()
   const decoder = contentEncodingDecoder(contentEncoding)
-  let bodyStream: Readable = body
   if (decoder) {
-    body.once('error', (err) => decoder.destroy(err))
-    decoder.once('close', () => body.destroy())
-    bodyStream = body.pipe(decoder)
     // The bridged body is now decoded; drop framing headers that would misdescribe it.
     responseHeaders.delete('content-encoding')
     responseHeaders.delete('content-length')
   }
+  // Build the bridge over the stream the consumer reads (the decoder when decoding).
+  // `nodeReadableToWebStream` attaches its `error` listener synchronously, so wiring the pipe
+  // AFTER it means a synchronous zlib error (e.g. a server mislabeling a non-gzip body as gzip)
+  // is caught and rejects the reader instead of taking down the process.
+  const webBody = nodeReadableToWebStream(decoder ?? body)
+  if (decoder) {
+    body.once('error', (err) => decoder.destroy(err)) // forward maxResponseSize / socket reset
+    decoder.once('close', () => body.destroy()) // tear the source down so the socket can't leak
+    body.pipe(decoder)
+  }
 
-  const response = new Response(nodeReadableToWebStream(bodyStream), {
-    status: statusCode,
-    headers: responseHeaders,
-  })
-  // undici.request never sets `url`; `fetch` did, and consumers rely on it (the MCP
-  // transport's response-cap wrapper copies it; the SDK resolves relative
-  // auth-metadata URLs against it). Preserve parity.
-  Object.defineProperty(response, 'url', { value: url, configurable: true })
-  return response
+  try {
+    const response = new Response(webBody, { status: statusCode, headers: responseHeaders })
+    // undici.request never sets `url`; `fetch` did, and consumers rely on it (the MCP
+    // transport's response-cap wrapper copies it; the SDK resolves relative
+    // auth-metadata URLs against it). Preserve parity.
+    Object.defineProperty(response, 'url', { value: url, configurable: true })
+    return response
+  } catch (err) {
+    // `new Response` rejects an out-of-range status (a 1xx undici shouldn't surface, but
+    // defensively): destroy the source so its socket can't leak, then rethrow.
+    body.destroy()
+    throw err
+  }
 }
 
 /**