Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

chore(review): small hardening items in MCP guard, RPC client, sandbox runner, CSV export, file launch

Open
  • Is something wrong?
#1,565 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
dart, flutter, postgresql
Domain
backend, database, security

Research direction

Start with the listed files: lib/core/mcp/mcp_sql_guard.dart, lib/core/mcp/mcp_socket_host.dart, lib/core/extensions/rpc/json_rpc_stdio_client.dart, lib/core/extensions/sandbox/sandbox_process_runner.dart, the CSV export files, and lib/core/platform/file_launch_service.dart. Read each relevant function and its existing tests, then choose one finding to address; the issue suggests splitting larger items. Done means the chosen behavior is fixed and covered by a focused test.

Written by the indexing model from the issue text.

Description

core enhancement P3 stability

Small findings from a review of areas with no open issues. Split into separate issues if any grows.

  • MCP SQL guard (lib/core/mcp/mcp_sql_guard.dart:40-49): _forbiddenFunctions lacks QUERY_TO_XML* / CURSOR_TO_XML / TABLE_TO_XML*, PG_ADVISORY_*, PG_SLEEP, LO_*, NEXTVAL / SETVAL. No bypass found (the read-only session is the second layer), this is defence in depth. _explainForbidden includes REPLACE, which refuses EXPLAIN SELECT REPLACE(...) (false positive).
  • McpSocketHost (lib/core/mcp/mcp_socket_host.dart:90-95): a line before authentication has no length limit and the number of unauthenticated sockets is unbounded (loopback only, 5 s handshake).
  • JsonRpcStdioClient.sendRequest (lib/core/extensions/rpc/json_rpc_stdio_client.dart:86-95): _stdin.writeln is outside the try; on a closed sink it throws synchronously and leaves _pending[id] behind.
  • SandboxProcessRunner.start (lib/core/extensions/sandbox/sandbox_process_runner.dart:123-145): the scratch directory is created before SandboxLaunchCommand.build; an exception there leaks it.
  • CSV export (lib/core/csv/result_grid_csv.dart, save_result_grid_csv.dart): no UTF-8 BOM (Excel misreads Cyrillic), no formula-injection guard for cells starting with = + - @, \n instead of CRLF while documented as RFC 4180, the write error cause is swallowed.
  • FileLaunchService (lib/core/platform/file_launch_service.dart): hasPendingTarget duplicates hasPendingTargets; path comparison in resolveOrRegisterSqliteConnection is case-sensitive (duplicate connections on Windows/macOS).
Dominant language
Dart
Stars
23
Forks
1
Avg merge
45m
Merged PRs (30d)
529

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from QueryaHub/Querya-Desktop

All issues in QueryaHub/Querya-Desktop

Similar issues

More Dart issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.