bito-code-review[bot] commented on code in PR #44146:
URL: https://github.com/apache/superset/pull/44146#discussion_r4058346074
##########
superset/core/mcp/core_mcp_injection.py:
##########
@@ -210,7 +210,10 @@ def decorator(func: F) -> F:
if protect:
from superset.mcp_service.auth import mcp_auth_hook
- wrapped_func = mcp_auth_hook(func)
+ # Pass the registered (extension-prefixed) name so call-time
+ # checks keyed on tool identity cannot be confused by an
+ # extension tool that shares a base name with a host tool.
+ wrapped_func = mcp_auth_hook(func, tool_name=tool_name)
Review Comment:
<!-- Bito Reply -->
The decision to maintain the current fail-closed behavior for extension
tools is appropriate given the security design requirements. The existing
implementation correctly prevents extension tools from inheriting the
allowlisted status of built-in tools by using the registered,
extension-prefixed name. This ensures that extension-owned code cannot bypass
dataset scope restrictions by simply sharing a base function name with a host
tool.
**superset/core/mcp/core_mcp_injection.py**
```
# Pass the registered (extension-prefixed) name so call-time
# checks keyed on tool identity cannot be confused by an
# extension tool that shares a base name with a host tool.
wrapped_func = mcp_auth_hook(func, tool_name=tool_name)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
