fix(tool/bigquery): prevent `allowedDatasets` bypass in forecast query by duwenxin99 · Pull Request #3324 · googleapis/mcp-toolbox

duwenxin99 · 2026-06-01T17:26:49Z

Addressing vulnerabilities in bigquery-analyze-contribution and bigquery-forecast tools.

Updated the tool options (like column names and metrics) to automatically wrap in single quotes, preventing SQL injection.
For query inputs, the tool now dry-runs the entire fully assembled statement against BigQuery to inspect every dataset it will access, guaranteeing that hidden accesses (like those inside SQL Views) are caught and blocked.

Reported by: Matteo Panzeri

gemini-code-assist

Code Review

This pull request updates the BigQuery analyze contribution and forecast tools to use string parameters with single-quote escaping, and moves dataset validation to a dry-run query on the final generated SQL. The reviewer identified a critical SQL injection vulnerability caused by using strings.Trim to strip single quotes, which can bypass the single-quote check. To address this and other potential bugs, the reviewer recommended safely stripping exactly one leading and trailing single quote instead of using strings.Trim. Additionally, the reviewer flagged potential nil pointer dereferences when accessing dryRunJob.Statistics.Query without first checking if dryRunJob.Statistics is nil.

duwenxin99 · 2026-06-01T18:00:19Z

/gemini review

gemini-code-assist

Code Review

This pull request updates the BigQuery analyze contribution and forecast tools to support single-quote escaping for string parameters and improves dataset validation by dry-running the fully assembled SQL queries instead of just the raw input queries. The review feedback suggests refactoring the code to extract a shared helper function for stripping single quotes, avoiding duplicate SQL query construction, and adding defensive nil checks on the dry-run job results to prevent potential nil pointer dereferences.

averikitsch

Can we get a test to ensure no regressions? Thanks!

…validation

…owedDatasets

…n tests

…coupled tools

…scaped parameters

…ctations

…escaped inner errors

github-actions · 2026-06-04T20:50:59Z

🧨 Preview deployments removed.

Cloudflare Pages environments for pr-3324 have been deleted.

🤖 I have created a release *beep* *boop* --- ## [1.4.0](v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([#3231](#3231)) ([10abf3b](10abf3b)) * **datalineage:** Add Data Lineage integration ([#3285](#3285)) ([19353c3](19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([#3353](#3353)) ([5f0304f](5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([#3203](#3203)) ([b514cbd](b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([#3140](#3140)) ([defc086](defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([#3360](#3360)) ([1d8df0d](1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([#3341](#3341)) ([dfd66ee](dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([#3300](#3300)) ([9a88c72](9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([#3215](#3215)) ([fcad02d](fcad02d)) * **server/auth:** Centralize tool scopes validation ([#3335](#3335)) ([adce4ab](adce4ab)) * **server:** Return null id for batch request rejection ([#3333](#3333)) ([0b18d58](0b18d58)) * **source/dataplex:** Limit search results to pageSize ([#3323](#3323)) ([905c1f6](905c1f6)), closes [#3308](#3308) * **telemetry:** Allow GCP project override ([#2960](#2960)) ([3c83ba5](3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([#3324](#3324)) ([45df461](45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([#3340](#3340)) ([ddfd887](ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([#3219](#3219)) ([2f45f75](2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([#3289](#3289)) ([1711156](1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [1.4.0](v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([#3231](#3231)) ([10abf3b](10abf3b)) * **datalineage:** Add Data Lineage integration ([#3285](#3285)) ([19353c3](19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([#3353](#3353)) ([5f0304f](5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([#3203](#3203)) ([b514cbd](b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([#3140](#3140)) ([defc086](defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([#3360](#3360)) ([1d8df0d](1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([#3341](#3341)) ([dfd66ee](dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([#3300](#3300)) ([9a88c72](9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([#3215](#3215)) ([fcad02d](fcad02d)) * **server/auth:** Centralize tool scopes validation ([#3335](#3335)) ([adce4ab](adce4ab)) * **server:** Return null id for batch request rejection ([#3333](#3333)) ([0b18d58](0b18d58)) * **source/dataplex:** Limit search results to pageSize ([#3323](#3323)) ([905c1f6](905c1f6)), closes [#3308](#3308) * **telemetry:** Allow GCP project override ([#2960](#2960)) ([3c83ba5](3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([#3324](#3324)) ([45df461](45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([#3340](#3340)) ([ddfd887](ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([#3219](#3219)) ([2f45f75](2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([#3289](#3289)) ([1711156](1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe

🤖 I have created a release *beep* *boop* --- ## [1.4.0](googleapis/mcp-toolbox@v1.3.0...v1.4.0) (2026-06-04) ### Features * **ci:** Add support for windows/arm64 binary distribution ([googleapis#3231](googleapis#3231)) ([10abf3b](googleapis@10abf3b)) * **datalineage:** Add Data Lineage integration ([googleapis#3285](googleapis#3285)) ([19353c3](googleapis@19353c3)) * **server:** Ignore unknown tools at startup with `--ignore-unknown-tools` flag ([googleapis#3353](googleapis#3353)) ([5f0304f](googleapis@5f0304f)) * **tools/cloudsqlpg:** Add remaining vector assist tools for Cloud SQL Postgres ([googleapis#3203](googleapis#3203)) ([b514cbd](googleapis@b514cbd)) * **tools/spanner-search-catalog:** Implement search_catalog tool ([googleapis#3140](googleapis#3140)) ([defc086](googleapis@defc086)) ### Bug Fixes * **auth/generic:** Enforce issuer presence in opaque token validation ([googleapis#3360](googleapis#3360)) ([1d8df0d](googleapis@1d8df0d)) * **auth:** Separate Google and Generic MCP OAuth verification ([googleapis#3341](googleapis#3341)) ([dfd66ee](googleapis@dfd66ee)) * **mcp:** Support annotations and metadata within Tools to earlier MCP schemas ([googleapis#3300](googleapis#3300)) ([9a88c72](googleapis@9a88c72)) * **oracle:** Remove trailing semicolons from prebuilt tools ([googleapis#3215](googleapis#3215)) ([fcad02d](googleapis@fcad02d)) * **server/auth:** Centralize tool scopes validation ([googleapis#3335](googleapis#3335)) ([adce4ab](googleapis@adce4ab)) * **server:** Return null id for batch request rejection ([googleapis#3333](googleapis#3333)) ([0b18d58](googleapis@0b18d58)) * **source/dataplex:** Limit search results to pageSize ([googleapis#3323](googleapis#3323)) ([905c1f6](googleapis@905c1f6)), closes [googleapis#3308](googleapis#3308) * **telemetry:** Allow GCP project override ([googleapis#2960](googleapis#2960)) ([3c83ba5](googleapis@3c83ba5)) * **tool/bigquery:** Prevent `allowedDatasets` bypass in forecast query ([googleapis#3324](googleapis#3324)) ([45df461](googleapis@45df461)) * **tool/clickhouse:** Handle ignored ProcessParameters error ([googleapis#3340](googleapis#3340)) ([ddfd887](googleapis@ddfd887)) * **tools/clickhouse,tools/bigquery:** Validate identifier parameters to prevent injection ([googleapis#3219](googleapis#3219)) ([2f45f75](googleapis@2f45f75)) * **tools/looker:** Escape filter values for unquoted parameters ([googleapis#3289](googleapis#3289)) ([1711156](googleapis@1711156)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> d67cfbe

duwenxin99 requested review from a team as code owners June 1, 2026 17:26

duwenxin99 changed the title ~~fix(tool/bigquery): implement parameter escaping and enhance dry-run …~~ fix(tool/bigquery): implement parameter escaping Jun 1, 2026

blunderbuss-gcf Bot assigned Yuan325 Jun 1, 2026

gemini-code-assist Bot reviewed Jun 1, 2026

View reviewed changes

duwenxin99 force-pushed the fix/bigquery-input-validation branch 3 times, most recently from aec5d3b to cd77a99 Compare June 1, 2026 17:56

gemini-code-assist Bot reviewed Jun 1, 2026

View reviewed changes

duwenxin99 force-pushed the fix/bigquery-input-validation branch 3 times, most recently from fdfc9d4 to 5370cbd Compare June 1, 2026 19:22

Genesis929 approved these changes Jun 1, 2026

View reviewed changes

averikitsch requested changes Jun 2, 2026

View reviewed changes

duwenxin99 added the release candidate Use label to signal PR should be included in the next release. label Jun 3, 2026

duwenxin99 added 9 commits June 4, 2026 13:30

fix(tool/bigquery): implement parameter escaping and enhance dry-run …

67a73fd

…validation

add validation tests

c658876

fix(tool/bigquery): validate final query and remove redundant dry runs

ff2af97

test(tool/bigquery): verify dry run validates final query against all…

0793ae5

…owedDatasets

refactor(tool/bigquery): simplify column parameter validation

bb7d422

test(tool/bigquery): deduplicate mock bigquery source in unit tests

1665fa0

test(tool/bigquery): add validation breakout test cases to integratio…

a0c232c

…n tests

test(tool/bigquery): update unit tests configuration structure for de…

de06310

…coupled tools

duwenxin99 force-pushed the fix/bigquery-input-validation branch from 67bbf6e to de06310 Compare June 4, 2026 17:32

duwenxin99 changed the title ~~fix(tool/bigquery): implement parameter escaping~~ fix(tool/bigquery): prevent allowedDatasets bypass in forecast query Jun 4, 2026

averikitsch approved these changes Jun 4, 2026

View reviewed changes

duwenxin99 and others added 2 commits June 4, 2026 14:19

test(tool/bigquery): update integration test error expectations for e…

9b0e562

…scaped parameters

Merge branch 'main' into fix/bigquery-input-validation

c43bd81

duwenxin99 enabled auto-merge (squash) June 4, 2026 18:34

duwenxin99 and others added 5 commits June 4, 2026 14:59

test(tool/bigquery): fix HTML escaping issue in integration test expe…

0838f2f

…ctations

test(tool/bigquery): refactor integration tests to parse and check un…

80653d8

…escaped inner errors

Merge branch 'main' into fix/bigquery-input-validation

b5db2f8

Merge branch 'main' into fix/bigquery-input-validation

ac4352c

Merge branch 'main' into fix/bigquery-input-validation

8c5a11c

duwenxin99 merged commit 45df461 into main Jun 4, 2026
24 checks passed

duwenxin99 deleted the fix/bigquery-input-validation branch June 4, 2026 20:50

release-please Bot mentioned this pull request Jun 4, 2026

chore(main): release 1.4.0 #3301

Merged

BrewTestBot mentioned this pull request Jun 4, 2026

mcp-toolbox 1.4.0 Homebrew/homebrew-core#286359

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(tool/bigquery): prevent `allowedDatasets` bypass in forecast query#3324

fix(tool/bigquery): prevent `allowedDatasets` bypass in forecast query#3324
duwenxin99 merged 16 commits into
mainfrom
fix/bigquery-input-validation

duwenxin99 commented Jun 1, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

duwenxin99 commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

averikitsch left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

duwenxin99 commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

duwenxin99 commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

averikitsch left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

duwenxin99 commented Jun 1, 2026 •

edited

Loading