fix: reject cross-origin Link headers and redact tokens from logs

- Validate that pagination next-page URLs from Link response headers
  share the same origin as the configured API endpoint; cross-origin
  URLs are rejected to prevent access token exfiltration
- Add redactToken() utility that strips access_token query parameter
  values from strings before they reach log output or MCP client error
  responses (network errors include the full request URL in their
  message which would otherwise expose the token)
- Remove full URL from info/debug level pagination log messages

Author: zmofei

src/tools/MapboxApiBasedTool.ts

@@ -13,6 +13,11 @@ import { context, trace, SpanStatusCode } from '@opentelemetry/api';
 import type { ToolExecutionContext } from '../utils/tracing.js';
 import { createToolExecutionContext } from '../utils/tracing.js';
 
+/** Remove access_token query parameter values from strings before logging or returning to callers. */
+export function redactToken(s: string): string {
+  return s.replace(/access_token=[^&\s#"']+/g, 'access_token=***');
+}
+
 /**
  * Standard error response format from Mapbox API
  */
@@ -126,8 +131,8 @@ export abstract class MapboxApiBasedTool<
       toolContext.span.end();
       return result;
     } catch (error) {
-      const errorMessage =
-        error instanceof Error ? error.message : String(error);
+      const rawMessage = error instanceof Error ? error.message : String(error);
+      const errorMessage = redactToken(rawMessage);
       this.log(
         'error',
         `${this.name}: Error during execution: ${errorMessage}`

src/tools/list-tokens-tool/ListTokensTool.ts

@@ -4,7 +4,7 @@
 import { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import type { HttpRequest } from '../../utils/types.js';
 import type { ToolExecutionContext } from '../../utils/tracing.js';
-import { MapboxApiBasedTool } from '../MapboxApiBasedTool.js';
+import { MapboxApiBasedTool, redactToken } from '../MapboxApiBasedTool.js';
 import {
   ListTokensSchema,
   ListTokensInput
@@ -110,7 +110,7 @@ export class ListTokensTool extends MapboxApiBasedTool<
       while (url) {
         pageCount++;
         this.log('info', `ListTokensTool: Fetching page ${pageCount}`);
-        this.log('debug', `ListTokensTool: Fetching URL: ${url}`);
+        this.log('debug', `ListTokensTool: Fetching URL: ${redactToken(url)}`);
 
         const response = await this.httpRequest(url, {
           method: 'GET',
@@ -157,26 +157,34 @@ export class ListTokensTool extends MapboxApiBasedTool<
         if (linkHeader) {
           const links = this.parseLinkHeader(linkHeader);
           if (links.next) {
-            // Ensure the next URL includes the access token
             const nextUrl = new URL(links.next);
-            if (!nextUrl.searchParams.has('access_token')) {
-              nextUrl.searchParams.append('access_token', accessToken);
-            }
-            const nextUrlString = nextUrl.toString();
-
-            if (shouldAutoPaginate) {
-              url = nextUrlString;
-              this.log('info', `ListTokensTool: Next page available: ${url}`);
+            // Reject cross-origin Link headers to prevent token exfiltration
+            const apiOrigin = new URL(ListTokensTool.mapboxApiEndpoint).origin;
+            if (nextUrl.origin !== apiOrigin) {
+              this.log(
+                'warning',
+                `ListTokensTool: Refusing cross-origin Link header: ${nextUrl.origin}`
+              );
             } else {
-              // For manual pagination, extract the start parameter from the next URL
-              const nextUrl = new URL(links.next);
-              const startParam = nextUrl.searchParams.get('start');
-              if (startParam) {
-                nextPageUrl = startParam;
-                this.log(
-                  'info',
-                  `ListTokensTool: Next page start token saved for manual pagination: ${nextPageUrl}`
-                );
+              // Ensure the next URL includes the access token
+              if (!nextUrl.searchParams.has('access_token')) {
+                nextUrl.searchParams.append('access_token', accessToken);
+              }
+              const nextUrlString = nextUrl.toString();
+
+              if (shouldAutoPaginate) {
+                url = nextUrlString;
+                this.log('info', 'ListTokensTool: Next page available');
+              } else {
+                // For manual pagination, extract the start parameter from the next URL
+                const startParam = nextUrl.searchParams.get('start');
+                if (startParam) {
+                  nextPageUrl = startParam;
+                  this.log(
+                    'info',
+                    'ListTokensTool: Next page start token saved for manual pagination'
+                  );
+                }
               }
             }
           }

test/tools/list-tokens-tool/ListTokensTool.test.ts

@@ -427,6 +427,41 @@ describe('ListTokensTool', () => {
       expect(responseData.next_start).toBeUndefined();
     });
 
+    it('refuses cross-origin Link header to prevent token exfiltration', async () => {
+      const mockTokens = [
+        {
+          id: 'cktest123',
+          note: 'Token',
+          usage: 'pk',
+          client: 'api',
+          token: 'pk.eyJ1IjoidGVzdHVzZXIifQ.test123',
+          scopes: ['styles:read'],
+          created: '2023-01-01T00:00:00.000Z',
+          modified: '2023-01-01T00:00:00.000Z',
+          default: false
+        }
+      ];
+
+      const { httpRequest, mockHttpRequest } = setupHttpRequest();
+      const headers = new Headers();
+      headers.set('Link', '<https://attacker.example.com/collect>; rel="next"');
+
+      mockHttpRequest.mockResolvedValueOnce({
+        ok: true,
+        headers,
+        json: async () => mockTokens
+      } as Response);
+
+      const tool = createListTokensTool(httpRequest);
+      const result = await tool.run({});
+
+      expect(result.isError).toBe(false);
+      const responseData = JSON.parse((result.content[0] as TextContent).text);
+      expect(responseData.tokens).toHaveLength(1);
+      // Pagination should stop — no second request made to the attacker URL
+      expect(mockHttpRequest).toHaveBeenCalledTimes(1);
+    });
+
     it('filters by token usage type', async () => {
       const mockTokens = [
         {