fix: declare utf-8 for oauth callback html

roomote · edelauna · commit 9df9ede4319a · 2026-05-20T08:18:53.000-04:00
diff --git a/src/services/mcp/utils/__tests__/callbackServer.spec.ts b/src/services/mcp/utils/__tests__/callbackServer.spec.ts
@@ -6,22 +6,38 @@ vi.mock("http", () => ({
 	createServer: vi.fn(),
 }))
 
+function createMockServer() {
+	const mockServer = {
+		listen: vi.fn((port, host, callback) => {
+			callback()
+			return mockServer
+		}),
+		address: vi.fn(() => ({ port: 3000 })),
+		on: vi.fn(),
+		close: vi.fn(),
+	}
+
+	return mockServer
+}
+
+function createMockResponse() {
+	return {
+		writeHead: vi.fn(),
+		end: vi.fn(),
+		on: vi.fn((event, cb) => {
+			if (event === "finish") setImmediate(cb)
+		}),
+	}
+}
+
 describe("startCallbackServer", () => {
 	beforeEach(() => {
 		vi.restoreAllMocks()
 		delete process.env.MCP_OAUTH_TEST_MODE
 	})
 
 	it("should start server and resolve with callback result", async () => {
-		const mockServer = {
-			listen: vi.fn((port, host, callback) => {
-				callback()
-				return mockServer
-			}),
-			address: vi.fn(() => ({ port: 3000 })),
-			on: vi.fn(),
-			close: vi.fn(),
-		}
+		const mockServer = createMockServer()
 
 		;(http.createServer as any).mockReturnValue(mockServer)
 
@@ -38,31 +54,24 @@ describe("startCallbackServer", () => {
 			url: "/callback?code=test-code&state=test-state",
 			method: "GET",
 		}
-		const mockRes = {
-			writeHead: vi.fn(),
-			end: vi.fn(),
-			on: vi.fn((event, cb) => {
-				if (event === "finish") setImmediate(cb)
-			}),
-		}
+		const mockRes = createMockResponse()
 
 		requestHandler(mockReq, mockRes)
 
 		const callbackResult = await result
 		expect(callbackResult.code).toBe("test-code")
 		expect(callbackResult.state).toBe("test-state")
+		expect(mockRes.writeHead).toHaveBeenCalledWith(
+			200,
+			expect.objectContaining({
+				"Content-Type": "text/html; charset=utf-8",
+			}),
+		)
+		expect(mockRes.end).toHaveBeenCalledWith(expect.stringContaining('<meta charset="utf-8">'))
 	})
 
 	it("should reject invalid state", async () => {
-		const mockServer = {
-			listen: vi.fn((port, host, callback) => {
-				callback()
-				return mockServer
-			}),
-			address: vi.fn(() => ({ port: 3000 })),
-			on: vi.fn(),
-			close: vi.fn(),
-		}
+		const mockServer = createMockServer()
 
 		;(http.createServer as any).mockReturnValue(mockServer)
 
@@ -76,17 +85,18 @@ describe("startCallbackServer", () => {
 			url: "/callback?code=test-code&state=wrong-state",
 			method: "GET",
 		}
-		const mockRes = {
-			writeHead: vi.fn(),
-			end: vi.fn(),
-			on: vi.fn((event, cb) => {
-				if (event === "finish") setImmediate(cb)
-			}),
-		}
+		const mockRes = createMockResponse()
 
 		requestHandler(mockReq, mockRes)
 
 		await expect(result).rejects.toThrow("Invalid state parameter")
+		expect(mockRes.writeHead).toHaveBeenCalledWith(
+			400,
+			expect.objectContaining({
+				"Content-Type": "text/html; charset=utf-8",
+			}),
+		)
+		expect(mockRes.end).toHaveBeenCalledWith(expect.stringContaining('<meta charset="utf-8">'))
 	})
 })
 
diff --git a/src/services/mcp/utils/callbackServer.ts b/src/services/mcp/utils/callbackServer.ts
@@ -2,6 +2,9 @@ import * as http from "http"
 import { t } from "../../../i18n"
 import { OAUTH_FLOW_TIMEOUT_MS } from "../constants"
 
+const HTML_RESPONSE_CONTENT_TYPE = "text/html; charset=utf-8"
+const CHARSET_META_TAG = '<meta charset="utf-8">'
+
 export interface CallbackResult {
 	code?: string
 	error?: string
@@ -93,13 +96,14 @@ export function startCallbackServer(
 					// Verify state for CSRF protection
 					if (expectedState && state !== expectedState) {
 						res.writeHead(400, {
-							"Content-Type": "text/html",
+							"Content-Type": HTML_RESPONSE_CONTENT_TYPE,
 							"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'",
 						})
 						res.end(`
 						         <!DOCTYPE html>
 						         <html>
 						           <head>
+						             ${CHARSET_META_TAG}
 						             <title>${t("mcp:oauth.callback.title")}</title>
 						           </head>
 						           <body>
@@ -115,14 +119,15 @@ export function startCallbackServer(
 
 					// Send HTML response
 					res.writeHead(200, {
-						"Content-Type": "text/html",
+						"Content-Type": HTML_RESPONSE_CONTENT_TYPE,
 						"Content-Security-Policy":
 							"default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'",
 					})
 					res.end(`
 <!DOCTYPE html>
 <html>
   <head>
+    ${CHARSET_META_TAG}
     <title>${t("mcp:oauth.callback.title")}</title>
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <style>
