FreeOnePlus opened a new pull request, #204: URL: https://github.com/apache/doris-mcp-server/pull/204
## Summary - Enforce fail-closed read-only SQL validation at the database boundary and narrowly allow only code-owned session controls. - Bound auxiliary HTTP request bodies, ignore spoofable forwarding headers for token-management authorization, and reduce default Compose exposure and privilege. - Raise vulnerable runtime dependency floors, remove unused vulnerable dependency chains, and refresh generated dependency manifests. - Add regression coverage and document the safer deployment defaults. ## Security impact This closes gaps where Doris-specific state-changing statements not represented in the legacy blocked-keyword configuration could bypass the documented read-only query boundary. The canonical guard now applies even when no authentication context or legacy security manager is configured. ## Validation - Full suite: 1815 passed, 83 skipped - Ruff, Mypy, and Bandit passed - Protocol, authentication, and core-manager coverage gates passed - Lockfile, generated tool catalog, and requirements consistency checks passed - Runtime dependency audit reported no known vulnerabilities - Clean Python 3.12 wheel installation, CLI, import, and runtime dependency smoke passed - Docker Compose configuration validation passed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
