fix: decode body as UTF-8 explicitly to reject UTF-16/32 JSON

json.loads() auto-detects UTF-8/16/32 per RFC 4627 sec. 3, so a POST
body that is valid JSON when read as UTF-16 or UTF-32 was parsed and
accepted even though the MCP spec requires UTF-8. Decoding the body
explicitly before parsing closes that gap; UnicodeDecodeError still
subclasses ValueError, so it's caught by the existing parse-error
branch and reported as HTTP 400 PARSE_ERROR.

Parameterizes the regression test across cp1252, utf-16, and utf-32.

Reported-by: iamroylim

Author: tirthfx

src/mcp/server/streamable_http.py

@@ -491,7 +491,11 @@ async def _handle_post_request(self, scope: Scope, request: Request, receive: Re
             body = await request.body()
 
             try:
-                raw_message = json.loads(body)
+                # Decode explicitly rather than passing bytes to json.loads(): the latter
+                # auto-detects UTF-8/16/32 (RFC 4627 sec. 3), so a UTF-16/32 body that is
+                # otherwise valid JSON would parse successfully even though the MCP spec
+                # requires UTF-8.
+                raw_message = json.loads(body.decode("utf-8"))
             except ValueError as e:
                 # Both json.JSONDecodeError (bad syntax) and UnicodeDecodeError (body bytes
                 # that are not valid UTF-8) subclass ValueError; both are client errors.

tests/server/test_streamable_http_manager.py

@@ -443,13 +443,21 @@ async def mock_receive():
         assert error_data["error"]["message"] == "Session not found"
 
 
+@pytest.mark.parametrize(
+    "encoding",
+    ["cp1252", "utf-16", "utf-32"],
+)
 @pytest.mark.anyio
-async def test_non_utf8_body_returns_parse_error(caplog: pytest.LogCaptureFixture):
+async def test_non_utf8_body_returns_parse_error(caplog: pytest.LogCaptureFixture, encoding: str):
     """A POST body that is not valid UTF-8 is a client error, not a server error.
 
-    json.loads() raises UnicodeDecodeError rather than json.JSONDecodeError for such a
-    body, so it used to escape the parse-error branch and surface as HTTP 500 with an
+    For cp1252, json.loads() raises UnicodeDecodeError rather than json.JSONDecodeError,
+    so it used to escape the parse-error branch and surface as HTTP 500 with an
     ERROR-level traceback.
+
+    For utf-16/utf-32, json.loads() auto-detects the encoding (per RFC 4627 sec. 3) and
+    parses the body successfully even though the MCP spec requires UTF-8, so it used to
+    bypass error handling entirely.
     """
     app = Server("test-non-utf8-body")
     manager = StreamableHTTPSessionManager(app=app, stateless=True)
@@ -474,8 +482,11 @@ async def mock_send(message: Message):
             ],
         }
 
-        # Valid JSON syntax, but encoded as Windows-1252: the em dash is byte 0x97.
-        body = '{"jsonrpc": "2.0", "id": 1, "method": "x — y"}'.encode("cp1252")
+        # Valid JSON syntax, but encoded as something other than UTF-8. For cp1252 the
+        # em dash (byte 0x97) makes the body invalid UTF-8; for utf-16/utf-32 the body
+        # is well-formed under that encoding and would otherwise be auto-detected and
+        # accepted by json.loads().
+        body = '{"jsonrpc": "2.0", "id": 1, "method": "x — y"}'.encode(encoding)
 
         async def mock_receive():
             return {"type": "http.request", "body": body, "more_body": False}