aminghadersohi opened a new pull request, #41593: URL: https://github.com/apache/superset/pull/41593
## Summary - The `find_users` MCP tool was building its LIKE pattern directly from raw user input, so `query="%"` matched every row in the users table — directly contradicting the docstring claim that the tool does not enumerate the full user directory. - Escape backslash first (to avoid double-escaping), then `%`, then `_`, before wrapping in the surrounding `%…%` wildcards. - Pass `escape="\\"` to every `.ilike()` call so the database treats the escape sequences as literals. - Add unit tests for `query="%"`, `query="_"`, and a query containing a literal backslash. ## Test plan - [ ] `pytest tests/unit_tests/mcp_service/system/tool/test_find_users.py` — 16 tests, all pass - [ ] Verify `query="%"` produces needle `%\%%` with `escape="\\"` (not `%%%`) - [ ] Verify `query="_"` produces needle `%\_%` with `escape="\\"` (not `%_%`) - [ ] Verify `query="\\"` produces needle `%\\%` with `escape="\\"` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
