Amin Ghadersohi fd80f76661 fix(mcp): validate api_key_prefixes in CompositeTokenVerifier — filter empty/non-string entries ...

Empty-string prefixes match every Bearer token (DoS/misclassification vector).
Non-string entries cause TypeError in str.startswith(). Filter both in __init__,
warn on invalid entries, and only store valid non-empty string prefixes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-14 16:34:36 +00:00

..

advanced_data_type

…

annotation_layers

…

async_events

…

charts

…

columns

…

commands

…

common

…

connectors

…

dao

…

daos

…

dashboards

…

databases

…

datasets

…

datasource

…

db_engine_specs

…

distributed_lock

…

examples

…

explore

…

extensions

…

fixtures

…

importexport

…

key_value

…

mcp_service

fix(mcp): validate api_key_prefixes in CompositeTokenVerifier — filter empty/non-string entries

2026-05-14 16:34:36 +00:00

migrations

…

models

…

pandas_postprocessing

…

queries

…

reports

…

scripts

…

security

…

sql

…

sql_validators

…

tables

…

tags

…

tasks

…

themes

…

thumbnails

…

utils

…

views

…

__init__.py

…

config_test.py

…

conftest.py

…

core_tests.py

…

dataframe_test.py

…

extension_tests.py

…

feature_flag_test.py

…

initialization_test.py

…

jinja_context_test.py

…

legacy_tests.py

…

result_set_test.py

…

sql_lab_execution_context.py

…

sql_lab_test.py

…