Patched code sample

import asyncio
import websockets

# This class is a hypothetical representation of the fixed component
# in the MCP SDK, demonstrating how the origin validation fix would be implemented.
class FixedMcpWebsocketServer:
    def __init__(self, handler, allowed_origins):
        self.handler = handler
        # The fix introduces a way to configure and enforce allowed origins.
        self.allowed_origins = set(allowed_origins)

    async def _validate_origin(self, path, request_headers):
        """
        This method contains the core validation logic that was missing in the
        vulnerable version. It checks the 'Origin' header of the incoming
        WebSocket handshake request.
        """
        origin = request_headers.get('Origin')

        # If the origin is not in the allowed set, reject the connection
        # by returning an HTTP 403 Forbidden response.
        if origin not in self.allowed_origins:
            return (403, [], b'Forbidden\n')

        # If the origin is valid, return None to allow the handshake to proceed.
        return None

    async def serve(self, host, port):
        """
        The server now applies the origin validation during the handshake
        using the `process_request` argument. A vulnerable implementation would
        omit this argument, accepting connections from any origin.
        """
        async with websockets.serve(
            self.handler,
            host,
            port,
            process_request=self._validate_origin
        ):
            await asyncio.Future()  # Run server indefinitely