tuoluzhe8521 opened a new pull request, #242: URL: https://github.com/apache/doris-mcp-server/pull/242
A valid read-only query such as `SELECT 'ios_created_time_parse_failure' AS metric` is rejected as `CREATE` because the keyword blocklist searches for substrings inside literal and comment tokens. Ordinary comments such as `SELECT 1 /* CREATE TABLE example */` fail for the same reason. This change matches actual SQL keyword tokens instead of inspecting non-executable token contents. It preserves configured compound keywords, recognizes `CREATE OR REPLACE`, and retains statement-leading commands such as `KILL` and `SHUTDOWN` when sqlparse classifies them as names. Reported blocked operations are deduplicated and sorted. Regression tests cover literals, ordinary comments, quoted identifiers, CTEs, real blocked operations, and configured compound keywords. Existing injection checks, the canonical read-only guard, error codes, and query complexity limits are unchanged. Validation (Python 3.12, frozen development environment): - `uv run pytest -q -W error`: 1880 passed, 85 skipped; 68.13% coverage. - SQL validation, injection, and operation-policy suites: 151 passed. - `uv run ruff check .`, `uv run mypy doris_mcp_server`, and Bandit source scan passed. - Lock-file check, generated tool-catalog check, and domain coverage floors passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
