Add BurpSuite MCP Bridge (resolves #191 — conflict resolved)#285
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request registers the new burpsuite-mcp-bridge plugin across the marketplace configuration, main README, and plugins index. It introduces the plugin's core files, including configuration examples, assets, and a Python-based MCP server (server.py) that acts as a bridge for Burp Suite traffic. A security review comment points out a potential path traversal vulnerability on Windows systems in server.py where the user-controlled label parameter is sanitized for forward slashes but not backslashes, and provides a code suggestion to resolve this issue.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| else: | ||
| detail = burp_flow_get(flow_id=flow_id, source=source, include_bodies=include_bodies) | ||
| ARTIFACT_ROOT.mkdir(parents=True, exist_ok=True) | ||
| safe_label = (label or f"{source}-{flow_id}").replace("/", "_").replace(" ", "-") |
There was a problem hiding this comment.
The label parameter is user-controlled and can contain path traversal sequences. While replacing / with _ mitigates path traversal on Unix-like systems, it does not prevent path traversal on Windows where backslashes (\\) are also treated as path separators. If the MCP server runs natively on Windows, a label like ..\\\\..\\\\..\\\\malicious would allow writing files outside of the intended ARTIFACT_ROOT directory.
To resolve this, also replace backslashes (\\) with underscores (_).
| safe_label = (label or f"{source}-{flow_id}").replace("/", "_").replace(" ", "-") | |
| safe_label = (label or f"{source}-{flow_id}").replace("/", "_").replace("\\", "_").replace(" ", "-") |
Resolved conflicts in plugins.json (added BurpSuite entry, kept main's count) and scripts/generate_plugins_json.py (kept both EXTRA_MIRROR_PATHS entries). Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
4159e34 to
ca094a7
Compare
2 participants
Resolves merge conflict in #191 by merging latest main and keeping all entries.
Original PR: #191 by @6jeffr3y
Co-authored-by: 6jeffr3y 6jeffr3y@users.noreply.github.com