Skip to content

query validation: explicit confirm_delete_all + clear too-deep error#7697

Closed
ar2rsawseen wants to merge 1 commit into
masterfrom
fix/query-validation-review-followup
Closed

query validation: explicit confirm_delete_all + clear too-deep error#7697
ar2rsawseen wants to merge 1 commit into
masterfrom
fix/query-validation-review-followup

Conversation

@ar2rsawseen

Copy link
Copy Markdown
Member

Follow-up to #7694 / #7695 addressing review comments raised on the 24.05 backport (#7696) that also apply to master.

  • /i/app_users/delete near-total guard: require an explicit confirm_delete_all of true (or "true"). Previously any truthy value (e.g. the string "false") bypassed the guard.
  • Too-deep sentinel leak: add common.unsafeQueryError(bad) which maps the internal UNSAFE_QUERY_TOO_DEEP sentinel to a clear "Query is nested too deeply" message. parseUserQuery and all direct findUnsafeMongoOperator callers (dbviewer, exports, remote-config, push ×3) now use it, so $__nestedTooDeep is no longer surfaced to logs/clients.

No behavior change for valid queries. Cherry-pick of the same fix applied to the 24.05 backport (#7696).

…p sentinel to a clear message via common.unsafeQueryError

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings June 9, 2026 21:33

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR is a follow-up hardening pass on the “reject unsafe Mongo query operators” work, tightening the /i/app_users/delete near-total-delete guard and standardizing unsafe-query rejection messaging so internal sentinels aren’t exposed to clients/logs.

Changes:

  • Require confirm_delete_all to be explicitly true (boolean) or "true" (string) when using force and the delete query matches nearly all users.
  • Introduce common.unsafeQueryError(bad) to map the UNSAFE_QUERY_TOO_DEEP sentinel to a clear client-safe message.
  • Update several endpoints/plugins to use the centralized unsafe-query error formatter (partially complete in this diff).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
plugins/remote-config/api/api.js Switches unsafe-query rejection log to common.unsafeQueryError (response still needs alignment).
plugins/push/api/legacy.js Switches unsafe-query rejection log to common.unsafeQueryError (returned error still needs alignment).
plugins/push/api/api-tx.js Switches unsafe-query rejection log to common.unsafeQueryError (thrown error still needs alignment).
plugins/push/api/api-message.js Switches unsafe-query rejection log to common.unsafeQueryError (thrown error still needs alignment).
plugins/dbviewer/api/api.js Uses common.unsafeQueryError for both logging and client response.
api/utils/requestProcessor.js Tightens /i/app_users/delete near-total-delete guard to require explicit confirm_delete_all=true.
api/utils/common.js Adds common.unsafeQueryError and routes parseUserQuery errors through it.
api/parts/data/exports.js Uses common.unsafeQueryError for both logging and client response.

if (badOp) {
log.d("Rejected user query" + common.reqInfo(params) + ": " + "Query contains disallowed operator: " + badOp);
log.d("Rejected user query" + common.reqInfo(params) + ": " + common.unsafeQueryError(badOp));
common.returnMessage(params, 400, 'Query contains disallowed operator: ' + badOp);
if (badOp) {
log.d("Rejected user query" + common.reqInfo(params) + ": " + "Query contains disallowed operator: " + badOp);
log.d("Rejected user query" + common.reqInfo(params) + ": " + common.unsafeQueryError(badOp));
return [{error: 'Query contains disallowed operator: ' + badOp}];
if (badOp) {
log.d("Rejected user query" + common.reqInfo(params) + ": " + "Query contains disallowed operator: " + badOp);
log.d("Rejected user query" + common.reqInfo(params) + ": " + common.unsafeQueryError(badOp));
throw new ValidationError('Query contains disallowed operator: ' + badOp);
if (badOp) {
log.d("Rejected user query" + common.reqInfo(params) + ": " + "Query contains disallowed operator: " + badOp);
log.d("Rejected user query" + common.reqInfo(params) + ": " + common.unsafeQueryError(badOp));
throw new ValidationError('Query contains disallowed operator: ' + badOp);
@ar2rsawseen

Copy link
Copy Markdown
Member Author

Superseded — folding these review fixes into the already-open #7695 (same branch fix/reject-unsafe-query-operators → master) instead of a separate PR.

@ar2rsawseen ar2rsawseen closed this Jun 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants