-
Notifications
You must be signed in to change notification settings - Fork 266
Labels
bugSomething isn't workingSomething isn't workingmcpgateway.translateIssues and features related to the translate componentIssues and features related to the translate componentpythonPython / backend development (FastAPI)Python / backend development (FastAPI)securityImproves securityImproves securitytriageIssues / Features awaiting triageIssues / Features awaiting triage
Milestone
Description
Description
Bandit detected multiple issues including assert
statements that are removed with optimization flags, hardcoded bind to all interfaces, and HTTP requests without timeouts.
Affected Code
# mcpgateway/translate.py:225, 299, 614
assert self._proc.stdin and self._proc.stdout # B101
assert self._proc and self._proc.stdout # B101
assert process.stdout # B101
# mcpgateway/translate.py:550
host="0.0.0.0", # B104: hardcoded bind all interfaces
# mcpgateway/translate.py:605
async with httpx.AsyncClient(headers=headers, timeout=None) # B113: no timeout
Impact
- Severity: Low-Medium
- CWEs: CWE-703, CWE-605, CWE-400
- Potential issues:
- Assert checks removed with
python -O
causing AttributeErrors - Binding to 0.0.0.0 exposes service to all network interfaces
- HTTP requests without timeout can hang indefinitely
- Assert checks removed with
Fix
- Replace all
assert
statements with explicit runtime checks - Make bind interface configurable with secure default (
127.0.0.1
) - Add proper timeout to HTTP client (30s default)
- Add
--host
CLI argument for bind interface configuration - Updated all docstrings with new parameters and Raises sections
Steps to Reproduce
- Run
bandit mcpgateway/translate.py
- Observe B101, B104, and B113 warnings
Expected Behavior
Secure defaults with configurable options and proper error handling regardless of Python optimization level.
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't workingmcpgateway.translateIssues and features related to the translate componentIssues and features related to the translate componentpythonPython / backend development (FastAPI)Python / backend development (FastAPI)securityImproves securityImproves securitytriageIssues / Features awaiting triageIssues / Features awaiting triage