fix(server/mcp): guard nil dereference in sseManager.get (#2557)

marlonbarreto-git · duwenxin99 · web-flow · commit e534196303c2 · 2026-03-02T02:59:48.000Z
## Description `sseManager.get()` unconditionally accesses `session.lastActive` after a map lookup, even when the session ID doesn't exist. Since the zero value for a `*sseSession` pointer is `nil`, this causes a nil pointer dereference panic at runtime. This can happen when a client sends a request with a stale or invalid `sessionId` query parameter — for example, after a network reconnection or if a session was cleaned up by `cleanupRoutine`. ## Changes Add an `ok` guard before accessing `session.lastActive`: ```go session, ok := m.sseSessions[id] if ok { session.lastActive = time.Now() } ``` ## Test Added `TestSseManagerGetNonExistentSession` that calls `get()` with a non-existent ID and verifies it returns `nil, false` without panicking. Fixes #2548 Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>
diff --git a/internal/server/mcp.go b/internal/server/mcp.go
@@ -61,7 +61,9 @@ func (m *sseManager) get(id string) (*sseSession, bool) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	session, ok := m.sseSessions[id]
-	session.lastActive = time.Now()
+	if ok {
+		session.lastActive = time.Now()
+	}
 	return session, ok
 }
 
diff --git a/internal/server/mcp_test.go b/internal/server/mcp_test.go
@@ -1168,3 +1168,19 @@ func TestStdioSession(t *testing.T) {
 		t.Fatalf("unexpected read: got %s, want %s", read, want)
 	}
 }
+
+func TestSseManagerGetNonExistentSession(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	m := newSseManager(ctx)
+
+	// Must not panic when session ID doesn't exist in the map.
+	session, ok := m.get("non-existent-id")
+	if ok {
+		t.Error("expected ok to be false for non-existent session")
+	}
+	if session != nil {
+		t.Error("expected nil session for non-existent ID")
+	}
+}
