fix: validate MCP tool names and async fetch concurrency

Author: xxg1413

course-solutions.json

@@ -64,7 +64,7 @@
     {
       "slug": "mcp-server-in-python",
       "course_id": "course-mcp-tools",
-      "solution_sha256": "e9a0c348e12bd1f04d83783689f299e3ece8884f3f8a5be2f8a40655e211b790"
+      "solution_sha256": "3f58792fafaf0025f8766ca84ac8cae660e73868193fe55b61bb97548ac2aca7"
     },
     {
       "slug": "secure-ai-generated-code",

courses/mcp-server-in-python/TASK.md

@@ -15,6 +15,7 @@ Change only `starter/mcp_server.py`.
 - Supported methods:
   - `"tools/list"`: returns `{"result": {"tools": [{"name": ..., "description": ..., "inputSchema": ...}, ...]}}`.
   - `"tools/call"`: accepts `params: {"name": ..., "arguments": ..., "inputResponses": {...}?}` and calls the handler as `handler(arguments, inputResponses)`.
+    - If the tool name is missing or is not a string (including lists, objects, booleans, numbers, and null), return JSON-RPC error `-32602` (Invalid params), preserving the request ID.
     - If tool not registered: returns `{"result": {"isError": True, "content": [{"type": "text", "text": "Tool not found"}]}}`.
     - If required argument missing: returns `{"result": {"isError": True, "content": [{"type": "text", "text": "Missing required argument: <arg>"}]}}`.
     - If the handler raises `InputRequired(requests)`: returns `{"result": {"resultType": "input_required", "requests": <requests>, "content": [{"type": "text", "text": "Additional client input is required before this tool can finish."}]}}`. The client retries the same call with answers in `params.inputResponses`.

courses/mcp-server-in-python/TASK_cn.md

@@ -15,6 +15,7 @@
 - 支持的核心方法：
   - `"tools/list"`：返回 `{"result": {"tools": [{"name": ..., "description": ..., "inputSchema": ...}, ...]}}`。
   - `"tools/call"`：接收 `params: {"name": ..., "arguments": ..., "inputResponses": {...}?}`，并以 `handler(arguments, inputResponses)` 调用工具。
+    - 工具名缺失或不是字符串（包括列表、对象、布尔值、数字和 null）时，返回 JSON-RPC 错误码 `-32602`（Invalid params），并保留请求 ID。
     - 工具未找到：返回 `{"result": {"isError": True, "content": [{"type": "text", "text": "Tool not found"}]}}`。
     - 缺少 schema 中声明的必填参数：返回 `{"result": {"isError": True, "content": [{"type": "text", "text": "Missing required argument: <arg>"}]}}`。
     - 工具抛出 `InputRequired(requests)`：返回 `{"result": {"resultType": "input_required", "requests": <requests>, "content": [{"type": "text", "text": "Additional client input is required before this tool can finish."}]}}`。客户端携带 `params.inputResponses` 重试同一请求。

courses/mcp-server-in-python/solution/mcp_server.py

@@ -108,6 +108,15 @@ def handle_request(self, request: Any) -> dict[str, Any]:
                 }
 
             tool_name = params["name"]
+            if not isinstance(tool_name, str):
+                return {
+                    "jsonrpc": "2.0",
+                    "id": req_id,
+                    "error": {
+                        "code": -32602,
+                        "message": "Invalid params: tool name must be a string",
+                    },
+                }
             if tool_name not in self.tools:
                 return {
                     "jsonrpc": "2.0",

courses/mcp-server-in-python/tests/test_mcp_server.py

@@ -55,6 +55,20 @@ def test_tools_list_returns_schemas(self) -> None:
         names = {t["name"] for t in tools}
         self.assertEqual(names, {"calculate_sum", "risky_operation"})
 
+    def test_tools_call_rejects_non_string_tool_name(self) -> None:
+        for invalid_name in ([], {}, None, True, False, 1, 1.5):
+            with self.subTest(invalid_name=invalid_name):
+                resp = self.server.handle_request({
+                    "jsonrpc": "2.0",
+                    "id": 99,
+                    "method": "tools/call",
+                    "params": {"name": invalid_name, "arguments": {}},
+                })
+                self.assertEqual(resp["jsonrpc"], "2.0")
+                self.assertEqual(resp["id"], 99)
+                self.assertEqual(resp["error"]["code"], -32602)
+                self.assertIn("tool name must be a string", resp["error"]["message"])
+
     def test_tools_call_success(self) -> None:
         resp = self.server.handle_request({
             "jsonrpc": "2.0",

examples/async-fetcher/TASK.md

@@ -4,6 +4,7 @@ Change only `starter/fetcher.py`.
 
 - Implement `async_batch_fetch(items: list[dict], fetch_fn: Callable[[dict], Awaitable[dict]], max_concurrency: int = 3, max_retries: int = 3) -> list[dict]`.
 - Concurrency bounding:
+  - `max_concurrency` must be a positive integer; reject zero, negative values, booleans, and non-integers with `ValueError` before starting any tasks, even for empty input.
   - At most `max_concurrency` calls to `fetch_fn` may be executing concurrently at any moment.
 - Retry & Backoff contract:
   - `fetch_fn` returns `{"status_code": int, "data": ...}` or raises an exception.

examples/async-fetcher/TASK_cn.md

@@ -4,6 +4,7 @@
 
 - 实现 `async_batch_fetch(items: list[dict], fetch_fn: Callable[[dict], Awaitable[dict]], max_concurrency: int = 3, max_retries: int = 3) -> list[dict]`。
 - 并发控制要求：
+  - `max_concurrency` 必须是正整数；零、负数、布尔值及非整数必须在启动任何任务之前抛出 `ValueError`，即使输入为空也不例外。
   - 任何时刻并发执行 `fetch_fn` 的协程数量不得超过 `max_concurrency`。
 - 重试与退避策略：
   - `fetch_fn` 返回 `{"status_code": int, "data": ...}` 或抛出异常。

examples/async-fetcher/solution/fetcher.py

@@ -74,6 +74,8 @@ async def async_batch_fetch(
     max_concurrency: int = 3,
     max_retries: int = 3,
 ) -> list[dict[str, Any]]:
+    if isinstance(max_concurrency, bool) or not isinstance(max_concurrency, int) or max_concurrency < 1:
+        raise ValueError("max_concurrency must be a positive integer")
     semaphore = asyncio.Semaphore(max_concurrency)
     async with asyncio.TaskGroup() as group:
         tasks = [

examples/async-fetcher/tests/test_fetcher.py

@@ -7,6 +7,33 @@
 
 
 class TestAsyncBatchFetcher(unittest.TestCase):
+    def test_rejects_invalid_concurrency(self) -> None:
+        async def mock_fetch(item: dict) -> dict:
+            return {"status_code": 200, "data": item}
+
+        async def run_invalid(value: object) -> None:
+            # Bound the regression test itself: Semaphore(0) used to hang.
+            await asyncio.wait_for(
+                async_batch_fetch([{"id": 1}], mock_fetch, max_concurrency=value),
+                timeout=1,
+            )
+
+        for invalid in (0, -1, True, False, 1.5, "2", None, float("nan"), float("inf")):
+            with self.subTest(max_concurrency=invalid):
+                with self.assertRaisesRegex(ValueError, "max_concurrency must be a positive integer"):
+                    asyncio.run(run_invalid(invalid))
+                with self.assertRaisesRegex(ValueError, "max_concurrency must be a positive integer"):
+                    asyncio.run(async_batch_fetch([], mock_fetch, max_concurrency=invalid))
+
+    def test_single_concurrency_and_empty_input(self) -> None:
+        async def mock_fetch(item: dict) -> dict:
+            return {"status_code": 200, "data": item["id"]}
+
+        self.assertEqual(asyncio.run(async_batch_fetch([], mock_fetch, max_concurrency=1)), [])
+        results = asyncio.run(async_batch_fetch([{"id": 1}], mock_fetch, max_concurrency=1))
+        self.assertTrue(results[0]["success"])
+        self.assertEqual(results[0]["data"], 1)
+
     def test_bounded_concurrency(self) -> None:
         active_concurrency = 0
         peak_concurrency = 0

examples/mcp-server/TASK.md

@@ -15,6 +15,7 @@ Change only `starter/mcp_server.py`.
 - Supported methods:
   - `"tools/list"`: returns `{"result": {"tools": [{"name": ..., "description": ..., "inputSchema": ...}, ...]}}`.
   - `"tools/call"`: accepts `params: {"name": ..., "arguments": ..., "inputResponses": {...}?}` and calls the handler as `handler(arguments, inputResponses)`.
+    - If the tool name is missing or is not a string (including lists, objects, booleans, numbers, and null), return JSON-RPC error `-32602` (Invalid params), preserving the request ID.
     - If tool not registered: returns `{"result": {"isError": True, "content": [{"type": "text", "text": "Tool not found"}]}}`.
     - If required argument missing: returns `{"result": {"isError": True, "content": [{"type": "text", "text": "Missing required argument: <arg>"}]}}`.
     - If the handler raises `InputRequired(requests)`: returns `{"result": {"resultType": "input_required", "requests": <requests>, "content": [{"type": "text", "text": "Additional client input is required before this tool can finish."}]}}`. The client retries the same call with answers in `params.inputResponses`.