CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

Summary

The ckan_get_mqa_quality and ckan_get_mqa_quality_details tools restrict their server_url argument to dati.gov.it via a regular expression. The regex is anchored only at the start and places no boundary after the host, so any URL whose host merely begins with dati.gov.it — or that uses dati.gov.it as URL userinfo before an @ — passes validation while actually targeting an attacker-controlled host.

Affected code

// src/tools/quality.ts
const ALLOWED_SERVER_PATTERNS = [
  /^https?:\/\/(www\.)?dati\.gov\.it/i        // <-- no end anchor / host boundary
];
export function isValidMqaServer(serverUrl: string): boolean {
  return ALLOWED_SERVER_PATTERNS.some(pattern => pattern.test(serverUrl));
}

All of the following return true:

URL	Real host
https://dati.gov.it.attacker.com/x	dati.gov.it.attacker.com (attacker)
http://dati.gov.it.evil.example/api	dati.gov.it.evil.example (attacker)
https://[email protected]/x	attacker.com (userinfo trick)

After passing this check, server_url flows into getMqaQuality/getMqaQualityDetails, which call makeCkanRequest(serverUrl, "package_show", { id }). The server therefore issues a request to the attacker-controlled host and returns its (parsed) response to the caller.

Impact

• The intended "dati.gov.it only" trust boundary for the MQA tools is defeated; they can be driven against arbitrary external hosts.
• The attacker host receives the request (including the dataset_id) and controls the response body that is surfaced back to the model/user — enabling response spoofing and, in an agentic setting, indirect prompt-injection content delivered under the guise of a trusted-portal tool.
• Contributes to SSRF surface: while makeCkanRequest blocks private/internal IPs, this bypass removes the domain restriction that the code intends to enforce for these tools.

The @-userinfo variant is the most severe form because validation passes on a string whose actual host is fully attacker-chosen.