fix(mcp): handle URLSearchParams OAuth bodies and copy stream chunks

- toUndiciRequestBody serializes a URLSearchParams body (the MCP SDK's OAuth
  token/refresh exchange sends one); undici.request rejects it otherwise.
- Default content-type application/x-www-form-urlencoded when the caller didn't
  set one (fetch parity).
- nodeReadableToWebStream enqueues a copy (new Uint8Array(chunk)) not a view, so
  undici recycling the pooled source buffer can't corrupt queued chunks.
- Tests for both.

Author: waleedlatif1

apps/sim/lib/core/security/guarded-request-fetch.server.test.ts

@@ -132,6 +132,54 @@ describe('createSsrfGuardedFetchWithDispatcher (undici.request backed)', () => {
     expect(Buffer.from(options.body).toString()).toBe('payload')
   })
 
+  it('serializes a URLSearchParams body and defaults the form content-type (OAuth token exchange)', async () => {
+    mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, byteStream('{}')))
+    const { fetch } = createSsrfGuardedFetchWithDispatcher()
+
+    await fetch('https://auth.example.com/token', {
+      method: 'POST',
+      body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: 'r-1' }),
+    })
+
+    const [, options] = mockUndiciRequest.mock.calls[0]
+    expect(options.body).toBe('grant_type=refresh_token&refresh_token=r-1')
+    expect(options.headers['content-type']).toBe('application/x-www-form-urlencoded;charset=UTF-8')
+  })
+
+  it('does not override an explicit content-type on a URLSearchParams body', async () => {
+    mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, byteStream('{}')))
+    const { fetch } = createSsrfGuardedFetchWithDispatcher()
+
+    await fetch('https://auth.example.com/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ grant_type: 'authorization_code' }),
+    })
+
+    const [, options] = mockUndiciRequest.mock.calls[0]
+    expect(options.body).toBe('grant_type=authorization_code')
+    expect(options.headers['Content-Type']).toBe('application/x-www-form-urlencoded')
+    expect(options.headers['content-type']).toBeUndefined()
+  })
+
+  it('copies each chunk so a recycled source buffer cannot corrupt queued data', async () => {
+    const source = new Readable({ read() {} })
+    mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, source))
+    const { fetch } = createSsrfGuardedFetchWithDispatcher()
+
+    const response = await fetch('https://mcp.example.com/stream', { method: 'GET' })
+    const reader = response.body!.getReader()
+
+    // Emit a chunk, then mutate the SAME backing buffer (as undici's pool reuse would).
+    const buf = Buffer.from('AB')
+    source.push(buf)
+    const first = await reader.read()
+    buf[0] = 0x00 // corrupt the source buffer after the chunk was enqueued
+    expect(Buffer.from(first.value!).toString()).toBe('AB') // copy is unaffected
+    source.push(null)
+    await reader.read()
+  })
+
   it('rejects the reader when the source is destroyed without an error (abort/reset)', async () => {
     const source = new Readable({ read() {} }) // stays open, never pushes
     mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, source))

apps/sim/lib/core/security/input-validation.server.ts

@@ -660,6 +660,9 @@ function toUndiciRequestBody(
   body: UndiciRequestInit['body']
 ): string | Buffer | Uint8Array | Readable | undefined {
   if (body == null) return undefined
+  // fetch accepts URLSearchParams (form-encoded) and undici.request does not — the MCP SDK's
+  // OAuth token/refresh exchange sends one. Serialize it to its wire form.
+  if (body instanceof URLSearchParams) return body.toString()
   if (body instanceof ArrayBuffer) return Buffer.from(body)
   if (ArrayBuffer.isView(body) && !(body instanceof Uint8Array)) {
     return Buffer.from(body.buffer, body.byteOffset, body.byteLength)
@@ -689,7 +692,10 @@ function nodeReadableToWebStream(nodeStream: Readable): ReadableStream<Uint8Arra
     start(controller) {
       nodeStream.on('data', (chunk: Buffer) => {
         try {
-          controller.enqueue(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength))
+          // Copy, not a view: undici may recycle the pooled buffer backing `chunk` after
+          // this handler returns, which would corrupt a chunk still queued for a slow
+          // consumer. `new Uint8Array(chunk)` allocates a fresh backing buffer.
+          controller.enqueue(new Uint8Array(chunk))
         } catch {
           // Controller already closed (consumer cancelled) — stop the source, drop the chunk.
           nodeStream.destroy()
@@ -775,10 +781,21 @@ async function undiciRequestAsResponse(
 
   const method = (effectiveInit.method ?? 'GET').toUpperCase()
   const canHaveBody = method !== 'GET' && method !== 'HEAD'
+  const requestHeaders = toUndiciRequestHeaders(effectiveInit.headers) ?? {}
+  const requestBody = canHaveBody ? toUndiciRequestBody(effectiveInit.body) : undefined
+  // fetch auto-adds a form content-type for a URLSearchParams body; preserve that parity
+  // when the caller didn't set one (the MCP SDK does set it explicitly, but not every caller).
+  if (
+    canHaveBody &&
+    effectiveInit.body instanceof URLSearchParams &&
+    !Object.keys(requestHeaders).some((key) => key.toLowerCase() === 'content-type')
+  ) {
+    requestHeaders['content-type'] = 'application/x-www-form-urlencoded;charset=UTF-8'
+  }
   const { statusCode, headers, body } = await undiciRequest(url, {
     method: method as Dispatcher.HttpMethod,
-    headers: toUndiciRequestHeaders(effectiveInit.headers),
-    body: canHaveBody ? toUndiciRequestBody(effectiveInit.body) : undefined,
+    headers: requestHeaders,
+    body: requestBody,
     signal: effectiveInit.signal ?? undefined,
     dispatcher,
     // No `maxRedirections`: request() does not auto-follow by default, so the caller's