codeant-ai-for-open-source[bot] commented on code in PR #42767:
URL: https://github.com/apache/superset/pull/42767#discussion_r3717126953
##########
superset/mcp_service/middleware.py:
##########
@@ -476,6 +477,19 @@ async def on_call_tool(
success = False
raise
finally:
+ # user_id was captured before call_next() ran the tool, i.e.
+ # before the @tool auth decorator (superset/mcp_service/auth.py)
+ # resolves the user. It sets g.user on a per-call app context
+ # that _get_app_context_manager() pushes and pops around the
+ # tool's execution (see its docstring), so g.user/get_user_id()
+ # are back to their pre-call state by the time we get here —
+ # re-reading get_user_id() would still yield the stale value.
+ # _mcp_user_id_var is a plain ContextVar (not tied to that Flask
+ # app-context lifecycle) that _setup_user_context() sets before
+ # the context pops, so it survives to this point.
+ resolved_user_id = _mcp_user_id_var.get(None)
+ if resolved_user_id is not None:
+ user_id = resolved_user_id
Review Comment:
**Suggestion:** The ContextVar value is never cleared after this middleware
invocation. Because `_setup_user_context()` only resets it for authenticated
tool paths, a later `on_message()` call or unprotected/internal call in the
same asyncio task can read the previous tool's user ID and write that identity
into its audit log instead of using the current call's fallback snapshot.
Capture/reset the ContextVar for each middleware invocation, including when
logging completes. [stale reference]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ MCP message audit logs can contain the previous user's ID.
- ⚠️ Resource and prompt audit attribution becomes order-dependent.
- ⚠️ Same-task sequential MCP requests can cross-contaminate identity.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=cfa88dc0f3484ba1817e7850926907ac&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=cfa88dc0f3484ba1817e7850926907ac&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/mcp_service/middleware.py
**Line:** 490:492
**Comment:**
*Stale Reference: The ContextVar value is never cleared after this
middleware invocation. Because `_setup_user_context()` only resets it for
authenticated tool paths, a later `on_message()` call or unprotected/internal
call in the same asyncio task can read the previous tool's user ID and write
that identity into its audit log instead of using the current call's fallback
snapshot. Capture/reset the ContextVar for each middleware invocation,
including when logging completes.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42767&comment_hash=caa6632d556c006cfb0cc2ff3a43d0a827087d2fc0ef9534cdb14c8d8163e776&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42767&comment_hash=caa6632d556c006cfb0cc2ff3a43d0a827087d2fc0ef9534cdb14c8d8163e776&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
