fix(schema): stop upstream tool schemas from loading local files (#1788)

## Bug

Two validators compile the JSON Schema that an upstream server declares
for its tools:

- `internal/outputvalidation/validator.go` `compile()`: the
`outputSchema`, used for output-schema validation (Spec 056; on by
default in `warn` mode).
- `internal/server/mcp_input_validation.go` `compileInputSchema()`: the
`inputSchema`, used for pre-dispatch argument validation (Spec 085;
always on).

Both call `jsonschema.NewCompiler()` without setting a loader. In
`santhosh-tekuri/jsonschema/v6` the default loader is `FileLoader`,
which opens any `file://` URL. So when a schema contains `{"$ref":
"file:///any/path.json"}`, mcpproxy opens that path on the user's
machine, parses it, and compiles it into the tool's schema. The verdict
then depends on a local file the upstream chose.

## Trigger

Any upstream, including a remote HTTP one, can list a tool whose
`inputSchema` or `outputSchema` contains a `file://` `$ref`. The file is
read on the first call to that tool. No user action is needed beyond
calling the tool.

## Fix

Call `c.UseLoader(jsonschema.SchemeURLLoader{})` on both compilers. The
empty loader rejects every external URL scheme. Two things keep working:

- In-document refs (`#/$defs/...`) resolve against the in-memory
resource and never reach the loader.
- The standard `$schema` metaschemas are embedded in the library and are
served before the loader is consulted.

A schema that uses an external ref now fails to compile and takes the
existing fail-open path (FR-A9 / FR-013b).

## Tests

- `TestCompile_RefusesFileRef` (outputvalidation) and
`TestCompileInputSchema_RefusesFileRef` (server): a temp file holds
`{"type":"string"}`, and the schema is `{"$ref":"file://<that file>"}`.
With the fix it must not compile.
- `TestCompile_LocalRefsAndMetaSchemaStillWork` and
`TestCompileInputSchema_LocalRefStillWorks`: a `#/$defs` ref and the
draft 2020-12 `$schema` still compile and validate.

## Commands run

- `CGO_ENABLED=0 go test -count=1 -run 'Test'
./internal/outputvalidation/`: ok
- `CGO_ENABLED=0 go test -count=1 -run
'TestCompileInputSchema_|TestPreDispatchValidation_'
./internal/server/`: ok
- `CGO_ENABLED=0 go vet ./internal/outputvalidation/`: ok
- On current `main` (and again with both one-line fixes reverted), both
`RefusesFileRef` tests fail, with `schema with $ref file:///…/local.json
compiled; the local file was loaded`.

I did not run the full `./internal/server` package locally.

Author: rudycelekli

internal/outputvalidation/file_ref_test.go

@@ -0,0 +1,54 @@
+package outputvalidation
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// fileURL turns an absolute path into a file:// URL on every OS.
+func fileURL(p string) string {
+	s := filepath.ToSlash(p)
+	if !strings.HasPrefix(s, "/") {
+		s = "/" + s
+	}
+	return "file://" + s
+}
+
+// An output schema comes from the upstream server. A $ref to a file:// URL
+// must not make the proxy open a local file and compile it into the schema.
+func TestCompile_RefusesFileRef(t *testing.T) {
+	local := filepath.Join(t.TempDir(), "local.json")
+	if err := os.WriteFile(local, []byte(`{"type":"string"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	ref, _ := json.Marshal(map[string]string{"$ref": fileURL(local)})
+
+	if entry := compile(string(ref)); !entry.sentinel {
+		t.Fatalf("schema with $ref %s compiled; the local file was loaded", fileURL(local))
+	}
+
+	v := New(0, 0, nil)
+	if verdict := v.Validate("srv:tool", string(ref), map[string]any{"id": 1}); verdict.IsViolation() {
+		t.Fatalf("verdict was driven by the local file's contents: %s", verdict.Reason)
+	}
+}
+
+func TestCompile_LocalRefsAndMetaSchemaStillWork(t *testing.T) {
+	schema := `{
+		"$schema": "https://json-schema.org/draft/2020-12/schema",
+		"$defs": {"id": {"type": "integer"}},
+		"type": "object",
+		"properties": {"id": {"$ref": "#/$defs/id"}}
+	}`
+	if entry := compile(schema); entry.sentinel {
+		t.Fatal("schema with an in-document $ref and the standard $schema failed to compile")
+	}
+
+	v := New(0, 0, nil)
+	if verdict := v.Validate("srv:tool", schema, map[string]any{"id": "x"}); !verdict.IsViolation() {
+		t.Fatal("expected a violation for a string id")
+	}
+}

internal/outputvalidation/validator.go

@@ -208,6 +208,9 @@ func compile(schemaJSON string) *cacheEntry {
 	// validation error messages (which are surfaced in audit records).
 	const schemaURI = "mem://outputschema/schema"
 	c := jsonschema.NewCompiler()
+	// The schema is upstream-controlled: an empty loader stops a $ref from
+	// reading local files (the default loader serves file:// URLs).
+	c.UseLoader(jsonschema.SchemeURLLoader{})
 	if err := c.AddResource(schemaURI, doc); err != nil {
 		return &cacheEntry{sentinel: true}
 	}

internal/server/mcp_input_validation.go

@@ -141,6 +141,9 @@ func compileInputSchema(paramsJSON string) *inputSchemaEntry {
 		return &inputSchemaEntry{sentinel: true}
 	}
 	c := jsonschema.NewCompiler()
+	// The schema is upstream-controlled: an empty loader stops a $ref from
+	// reading local files (the default loader serves file:// URLs).
+	c.UseLoader(jsonschema.SchemeURLLoader{})
 	if err := c.AddResource(inputSchemaURI, doc); err != nil {
 		return &inputSchemaEntry{sentinel: true}
 	}

internal/server/mcp_input_validation_file_ref_test.go

@@ -0,0 +1,34 @@
+package server
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// A tool's input schema comes from the upstream server. A $ref to a file://
+// URL must not make the proxy open a local file and compile it into the schema.
+func TestCompileInputSchema_RefusesFileRef(t *testing.T) {
+	local := filepath.Join(t.TempDir(), "local.json")
+	if err := os.WriteFile(local, []byte(`{"type":"string"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	u := filepath.ToSlash(local)
+	if !strings.HasPrefix(u, "/") {
+		u = "/" + u
+	}
+	ref, _ := json.Marshal(map[string]string{"$ref": "file://" + u})
+
+	if entry := compileInputSchema(string(ref)); !entry.sentinel {
+		t.Fatalf("input schema with $ref file://%s compiled; the local file was loaded", u)
+	}
+}
+
+func TestCompileInputSchema_LocalRefStillWorks(t *testing.T) {
+	schema := `{"$defs":{"q":{"type":"string"}},"type":"object","properties":{"q":{"$ref":"#/$defs/q"}}}`
+	if entry := compileInputSchema(schema); entry.sentinel {
+		t.Fatal("input schema with an in-document $ref failed to compile")
+	}
+}