fix(auth): sanitize authorization URL (#16)

Author: superboy-zjc

package.json

@@ -30,6 +30,7 @@
     "prompts": "^2.4.2",
     "uri-template": "^2.0.0",
     "yocto-spinner": "^0.2.2",
-    "yoctocolors": "^2.1.1"
+    "yoctocolors": "^2.1.1",
+    "strict-url-sanitise": "^0.0.1"
   }
 }

src/oauth/provider.js

@@ -2,6 +2,7 @@
 
 import open from 'open'
 import { config } from '../config.js'
+import { sanitizeUrl } from 'strict-url-sanitise'
 
 /** @typedef {import("@modelcontextprotocol/sdk/client/auth.js").OAuthClientProvider} OAuthClientProvider */
 /** @implements {OAuthClientProvider} */
@@ -39,7 +40,7 @@ export class McpOAuthClientProvider {
   }
 
   async redirectToAuthorization(authorizationUrl) {
-    await open(authorizationUrl.toString())
+    await open(sanitizeUrl(authorizationUrl.toString()))
   }
 
   async codeVerifier() {