FreeOnePlus opened a new pull request, #210: URL: https://github.com/apache/doris-mcp-server/pull/210
## Summary - Launch every MetricFlow provider sidecar with a fixed minimal locale and unbuffered-I/O environment. - Prevent Doris credentials, bearer tokens, OAuth/JWT secrets, and unrelated MCP Server configuration from reaching the compiler process through environment inheritance. - Add a real subprocess regression test with five secret sentinels and document the enforced process boundary. - Record the security fix in the changelog. ## Root cause The MetricFlow JSON protocol never placed Doris credentials in request payloads, but `asyncio.create_subprocess_exec` inherited the entire MCP Server process environment by default. A provider process could therefore observe database passwords and authentication material despite the documented compile-only boundary. ## Security behavior The Server now supplies only `LANG`, `LC_ALL`, and `PYTHONUNBUFFERED` when starting the sidecar. The executable remains absolute, no shell is used, request and response sizes stay bounded, and compiled SQL still returns to the guarded Doris query runtime for execution. ## Validation - Full test suite: 1,824 passed, 85 skipped - Coverage: 67.84%; protocol 89.96%, authentication 81.65%, core managers 87.03% - Ruff, Mypy, Bandit, lockfile, and generated tool-catalog checks passed - Source distribution and wheel build passed - Clean Python 3.12 wheel installation and CLI smoke passed - Real subprocess regression confirmed that Doris, token, OAuth, and JWT secret sentinels are absent from the child environment - `git diff --check` passed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
