fix: catch malformed port ValueError and reach 100% coverage

- _canonical_netloc now catches ValueError from parsed.port for
  malformed explicit ports (e.g. out-of-range), falling back to the
  original netloc instead of letting check_resource_allowed() crash
- add test coverage for the userinfo-in-netloc and IPv6-literal
  branches that were previously untested (CI requires 100% coverage)
- add regression test for the malformed-port fallback

Author: teddiesloco

src/mcp/shared/auth_utils.py

@@ -10,7 +10,11 @@ def _canonical_netloc(parsed: SplitResult) -> str:
     """Normalize netloc by lowercasing and stripping explicit default ports (RFC 3986 §6.2.3)."""
     scheme = parsed.scheme.lower()
     netloc = parsed.netloc.lower()
-    port = parsed.port
+    try:
+        port = parsed.port
+    except ValueError:
+        # Malformed explicit port (e.g. non-numeric) - not canonicalizable, fall back as-is
+        return netloc
 
     if (scheme == "http" and port == 80) or (scheme == "https" and port == 443):
         # Strip default port while preserving userinfo and IPv6 brackets

tests/shared/test_auth_utils.py

@@ -38,6 +38,23 @@ def test_resource_url_from_server_url_preserves_port():
     assert resource_url_from_server_url("https://example.com:443") == "https://example.com"
 
 
+def test_resource_url_from_server_url_strips_default_port_with_userinfo():
+    """Default port stripping must preserve userinfo in the netloc."""
+    assert resource_url_from_server_url("https://user:pass@example.com:443/mcp") == "https://user:pass@example.com/mcp"
+    assert resource_url_from_server_url("http://user@example.com:80/api") == "http://user@example.com/api"
+
+
+def test_resource_url_from_server_url_strips_default_port_with_ipv6():
+    """Default port stripping must preserve IPv6 literal brackets."""
+    assert resource_url_from_server_url("https://[::1]:443/path") == "https://[::1]/path"
+    assert resource_url_from_server_url("http://[2001:db8::1]:80/api") == "http://[2001:db8::1]/api"
+
+
+def test_resource_url_from_server_url_malformed_port_falls_back():
+    """A malformed explicit port must not raise; it should fall back to the original netloc."""
+    assert resource_url_from_server_url("https://example.com:99999999/path") == "https://example.com:99999999/path"
+
+
 def test_resource_url_from_server_url_lowercase_scheme_and_host():
     """Scheme and host should be lowercase for canonical form."""
     assert resource_url_from_server_url("HTTPS://EXAMPLE.COM/path") == "https://example.com/path"
@@ -125,6 +142,11 @@ def test_check_resource_allowed_case_insensitive_origin():
     assert check_resource_allowed("https://Example.Com:8080/api", "https://example.com:8080/api") is True
 
 
+def test_check_resource_allowed_malformed_port_does_not_raise():
+    """A malformed explicit port must not raise; check_resource_allowed should return a bool."""
+    assert check_resource_allowed("https://example.com:99999999/path", "https://example.com/path") is False
+
+
 def test_check_resource_allowed_empty_paths():
     """Empty paths should be handled correctly."""
     assert check_resource_allowed("https://example.com", "https://example.com") is True