fix: Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error by mtrezza · Pull Request #10775 · parse-community/parse-server

mtrezza · 2026-10-10T12:43:18Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.

Issue

Approach

Malformed logical operators and $options without $regex are now rejected with INVALID_QUERY (102) and a descriptive message before any code walks the query. The response is the same for every auth level and on both databases.

New validateQueryFormat runs as the first step of RestQuery.buildRestWhere, so it also covers count, subqueries, includes and where clauses set by beforeFind triggers. $or, $and and $nor must be non-empty arrays of objects, and $options must be used with $regex.
validateQuery now also rejects falsy and empty $or/$and values for queries passed to the database controller directly.
The protected-fields guard in RestQuery keeps its condition, but no longer replaces its error with "Permission denied".
Existing messages are kept. New messages: Bad $or format - use an array of at least 1 value., Bad $or format - use an array of objects. (the same for $and and $nor), and $options requires $regex.

Notes:

An empty array element ($or: [[], {...}]) is still accepted, because the PHP SDK sends [] for a query without constraints.
Primitive elements such as $or: [1] used to be ignored on MongoDB, which returned all objects; they are now rejected.
Postgres still fails for the valid $or: [{}] and drops {} elements inside $or/$nor. That is a separate adapter bug, so the tests for those shapes run on MongoDB only.

Tasks

Add tests

Summary by CodeRabbit

Bug Fixes
- Invalid queries using $and, $or, or $nor now receive an INVALID_QUERY error with a format-specific message.
- Queries that use $options without $regex are now rejected as invalid.
- Malformed queries are checked consistently across query requests, including those involving protected fields, subqueries, and trigger-modified queries.
- Valid logical-operator queries and $regex queries with $options continue to be accepted.

…e internal server error

parse-github-assistant · 2026-10-10T12:43:21Z

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
Group code into logical blocks. Add a short comment before each block to explain its purpose.
We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

coderabbitai · 2026-10-10T12:43:40Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: d3bdacd1-59c0-4fe3-93f1-cd74f8fd782e

📥 Commits

Reviewing files that changed from the base of the PR and between 4aafa9f and d9f952e.

📒 Files selected for processing (7)

spec/CloudCode.spec.js
spec/DatabaseController.spec.js
spec/ParseQuery.spec.js
spec/ProtectedFields.spec.js
spec/RestQuery.spec.js
src/Controllers/DatabaseController.js
src/RestQuery.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The controller now validates logical-operator formats and $options usage. REST query processing runs format validation before its existing processing. New tests cover these rules through controller, REST API, protected-field, and trigger query paths.

Changes

Query Format Validation

Layer / File(s)	Summary
Controller query validation `src/Controllers/DatabaseController.js`, `spec/DatabaseController.spec.js`	The controller recursively checks logical-operator formats and rejects `$options` without `$regex`. The shared validation requires non-empty arrays for `$or`, `$and`, and `$nor`. Tests cover rejected and accepted query shapes.
REST query validation `src/RestQuery.js`, `spec/ProtectedFields.spec.js`, `spec/RestQuery.spec.js`, `spec/CloudCode.spec.js`	REST query processing invokes the controller’s format validator and uses its logical-operator error helper. Tests cover protected-field validation, trigger queries, and rejection before database lookup.
REST API validation coverage `spec/ParseQuery.spec.js`	Tests cover malformed and accepted query formats across nested queries, count queries, authentication modes, pointer permissions, and sessions.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant RestQuery
  participant DatabaseController
  Client->>RestQuery: Submit query with restWhere
  RestQuery->>DatabaseController: validateQueryFormat(restWhere)
  DatabaseController-->>RestQuery: Return INVALID_QUERY for malformed format
  RestQuery-->>Client: Reject query with INVALID_QUERY

Suggested reviewers: dblythy

Merge Risk: ⚪ Minimal · up to d9f95

The changed validation has no established conflict with the inspected query workflows. The PR is mergeable after normal checks.

Pre-merge checks | 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check		The title starts with the required `fix:` prefix, uses a capitalized first letter after the prefix, and accurately describes the malformed query operator fix.
Description check		The description includes all required sections: Pull Request, Issue, Approach, and Tasks. It explains the issue, implementation, tests, error behavior, compatibility notes, and known Postgres limitati…
Linked Issues check		The changes satisfy the coding requirements in `#10762`. `validateQueryFormat` rejects empty or non-array `$or`, `$and`, and `$nor` values, rejects non-object elements, and rejects `$options` without `$…
Out of Scope Changes check		The source changes and tests are directly connected to `#10762`. The exported validation helpers support the new validation and its tests. The added coverage for triggers, subqueries, counts, authentica…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 7…
Security Check		No security vulnerability is introduced by the changed code. The pull request adds pre-processing validation for `$or`, `$and`, `$nor`, and `$options`, and rejects malformed input with `INVALID_QUERY`…
Engage In Review Feedback		No review feedback comments were returned, and the current review produced zero actionable findings. Therefore, there is no feedback that the contributor could have ignored or resolved without prior e…

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ast-grep (0.45.3)

spec/ParseQuery.spec.js

ast-grep timed out on this file

spec/ProtectedFields.spec.js

ast-grep timed out on this file

🔧 Biome (2.5.14)

src/Controllers/DatabaseController.js

File contains syntax errors that prevent linting: Line 1070: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 19: 'import type' are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 20: 'import type' are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 113: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 113: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 122: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 122: return type annotation are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 161: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the

... [truncated 21163 characters] ...

ions are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 2174: return type annotation are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.; Line 2204: return types can only be used in TypeScript files; Line 2205: return types can only be used in TypeScript files; Line 2206: return types can only be used in TypeScript files; Line 2206: expected a semicolon to end the class property, but found none; Line 2206: Expected an identifier, a string literal, a number literal, a private field name, or a computed name but instead found '; Line 2207: return types can only be used in TypeScript files; Line 1053: Type annotations are a TypeScript only feature. Convert your file to a TypeScript file or remove the syntax.

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-10-10T12:50:26Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.01%. Comparing base (bee4082) to head (d9f952e).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha   #10775      +/-   ##
==========================================
+ Coverage   93.99%   94.01%   +0.01%     
==========================================
  Files         193      193              
  Lines       17126    17149      +23     
  Branches      259      259              
==========================================
+ Hits        16098    16123      +25     
+ Misses       1006     1004       -2     
  Partials       22       22

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

## [9.10.5-alpha.3](9.10.5-alpha.2...9.10.5-alpha.3) (2026-10-10) ### Bug Fixes * Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error ([#10775](#10775)) ([c56ccdf](c56ccdf))

parseplatformorg · 2026-10-10T14:38:48Z

🎉 This change has been released in version 9.10.5-alpha.3

fix: Malformed query operators $or, $and, $nor, $options caus…

d9f952e

…e internal server error

coderabbitai Bot approved these changes Oct 10, 2026

View reviewed changes

mtrezza merged commit c56ccdf into parse-community:alpha Oct 10, 2026
25 checks passed

parseplatformorg added the state:released-alpha Released as alpha version label Oct 10, 2026

mtrezza deleted the fix/malformed-query-operators branch October 10, 2026 15:33

Navigation Menu

Repository navigation

fix: Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error - #10775

fix: Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error#10775
mtrezza merged 1 commit into
parse-community:alphafrom
mtrezza:fix/malformed-query-operators

mtrezza commented Oct 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

parse-github-assistant Bot commented Oct 10, 2026

Uh oh!

coderabbitai Bot commented Oct 10, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codecov Bot commented Oct 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

parseplatformorg commented Oct 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mtrezza commented Oct 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Issue

Approach

Tasks

Summary by CodeRabbit

Uh oh!

parse-github-assistant Bot commented Oct 10, 2026

Uh oh!

coderabbitai Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codecov Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

parseplatformorg commented Oct 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mtrezza commented Oct 10, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 10, 2026 •

edited

Loading

codecov Bot commented Oct 10, 2026 •

edited

Loading