(superset) branch master updated: fix(mcp): bound chart_ids length in the generate-dashboard request (#44071)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/master by this push:
     new ea8aac12739 fix(mcp): bound chart_ids length in the generate-dashboard request (#44071)
ea8aac12739 is described below

commit ea8aac12739a2390dcd21f34e71701f4afcd3885
Author: Shaitan <10...@users.noreply.github.com>
AuthorDate: Thu Sep 17 00:53:22 2026 +0100

    fix(mcp): bound chart_ids length in the generate-dashboard request (#44071)
    
    Co-authored-by: Claude Opus 4.8 <no...@anthropic.com>
---
 superset/mcp_service/dashboard/schemas.py                     |  5 ++++-
 .../mcp_service/dashboard/test_dashboard_schemas.py           | 11 +++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/superset/mcp_service/dashboard/schemas.py b/superset/mcp_service/dashboard/schemas.py
index e022c87a527..ea321c400b3 100644
--- a/superset/mcp_service/dashboard/schemas.py
+++ b/superset/mcp_service/dashboard/schemas.py
@@ -645,7 +645,10 @@ class GenerateDashboardRequest(BaseModel):
     model_config = ConfigDict(populate_by_name=True)
 
     chart_ids: List[int] = Field(
-        ..., description="List of chart IDs to include in the dashboard", min_length=1
+        ...,
+        description="List of chart IDs to include in the dashboard",
+        min_length=1,
+        max_length=250,
     )
     dashboard_title: str | None = Field(
         None,
diff --git a/tests/unit_tests/mcp_service/dashboard/test_dashboard_schemas.py b/tests/unit_tests/mcp_service/dashboard/test_dashboard_schemas.py
index 7be4185fd6f..82f0987aebd 100644
--- a/tests/unit_tests/mcp_service/dashboard/test_dashboard_schemas.py
+++ b/tests/unit_tests/mcp_service/dashboard/test_dashboard_schemas.py
@@ -1053,3 +1053,14 @@ class TestRequestSchemaAliasChoices:
     def test_add_chart_to_dashboard_chart_alias(self) -> None:
         req = AddChartToDashboardRequest.model_validate({"dashboard_id": 1, "chart": 2})
         assert req.chart_id == 2
+
+
+def test_generate_dashboard_request_chart_ids_is_bounded() -> None:
+    """chart_ids is bounded (min 1, max 250) to prevent an unbounded array,
+    matching the length caps on sibling MCP request schemas."""
+    GenerateDashboardRequest(chart_ids=[1])
+    GenerateDashboardRequest(chart_ids=list(range(250)))
+    with pytest.raises(ValidationError):
+        GenerateDashboardRequest(chart_ids=[])
+    with pytest.raises(ValidationError):
+        GenerateDashboardRequest(chart_ids=list(range(251)))