Skip to content

internal/jsonrpc2: reject fractional and out-of-range request IDs - #1178

Open
ez-lbz wants to merge 1 commit into
modelcontextprotocol:mainfrom
ez-lbz:fix/jsonrpc2-reject-fractional-request-ids
Open

internal/jsonrpc2: reject fractional and out-of-range request IDs#1178
ez-lbz wants to merge 1 commit into
modelcontextprotocol:mainfrom
ez-lbz:fix/jsonrpc2-reject-fractional-request-ids

Conversation

@ez-lbz

@ez-lbz ez-lbz commented Aug 16, 2026

Copy link
Copy Markdown

Summary

MakeID currently truncates any float64 request ID with int64(), so a request carrying {"id": 1.9, ...} is answered with {"id": 1, ...}. JSON-RPC 2.0 specifies that request IDs must be integers, strings, or null; silently rewriting a non-integer ID breaks response correlation for clients that match responses by ID, and can cause responses for distinct requests to be mixed up.

This change validates that float64 IDs are whole numbers within the int64 range before converting, and returns a parse error otherwise.

Behavior

Request ID Before After
1.9 accepted as 1 parse error
2.5 accepted as 2 parse error
9.3e18 truncated/overflow parse error
42 accepted as 42 accepted as 42

Tests

  • Added TestMakeIDRejectsNonInteger, TestMakeIDAcceptsInteger, and TestDecodeMessageRejectsFractionalID in internal/jsonrpc2/wire_test.go.

MakeID currently truncates any float64 request ID with int64(), so a
request with id 1.9 is answered with id 1. JSON-RPC 2.0 specifies that
request IDs must be integers, strings, or null; silently rewriting a
non-integer ID breaks response correlation for the client and can cause
responses for distinct requests to be mixed up.

Validate that float64 IDs are whole numbers within the int64 range and
return a parse error otherwise, matching the behavior of the other
official SDKs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant