fix: Invalid JSON in whereMatchesQuery due to extra quotes around limiters

[Copilot]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.
• Link this pull request to an issue.

Issue

Closes: #932

Approach

The _buildQueryRelational method generated invalid JSON when building relational queries. The string interpolation ',"$lim"' incorrectly added literal double-quote characters around the already-formatted JSON in $lim, producing output like ,""include":avatar" instead of ,"include":avatar.

Fix:

• Changed ',"$lim"' to ',$lim' to remove extraneous quotes
• Changed condition from limiters.isNotEmpty to lim.isNotEmpty to check the computed string directly

Before (invalid JSON):

{"where":{...},"className":"DeliveryArea",}

After (valid JSON):

{"where":{...},"className":"DeliveryArea"}

Additional fixes:

• Removed unused includeObject parameter from _init method in parse_live_list.dart to fix Dart beta analyzer warning
• Added regression test to verify limiters do not have extra quotes (checks for absence of ""include" pattern)

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, code comments)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Querying Relationships Generates Invalid JSON</issue_title>
<issue_description>### New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server and the Parse Flutter SDK.

^ note I'm using the latest parse server version available on back4app and the latest SDK available for flutter

Issue Description

Steps to reproduce

1. Create two classes with a n:n relationship
2. Create a query for one of those classes
3. Create a query for the other class with a "whereMatchesIn" clause
4. Run the query

This is the code from my app:

var deliveryAreasQuery = QueryBuilder(ParseObject('DeliveryArea'))
      ..whereArrayContainsAll('postalCodes', [postalCode]);

    var query = QueryBuilder(ParseObject('Farmer'))
      ..whereMatchesQuery('deliveryAreas', deliveryAreasQuery)
      ..whereEqualTo('isActive', true)
      ..includeObject(['pickupAddress', 'invoiceAddress']);

Note that the other constraints don't do anything to the reproduction. The whereMatchesQuery made the issue appear.

Actual Outcome

Internal Server Error

Upon further investigation, I found that this request URL was generated by the library:

https://parseapi.back4app.com/classes/Farmer?where=%7B%22deliveryAreas%22:%7B%22$inQuery%22:%7B%22where%22:%7B%22postalCodes%22:%7B%20%22$all%22:%5B21075%5D%7D%7D,%22className%22:%22DeliveryArea%22,%7D%7D,%22isActive%22:%20true,%22pickupCoordinates%22:%7B%22$nearSphere%22:%7B%22__type%22:%22GeoPoint%22,%22latitude%22:53.45994049999999,%22longitude%22:9.9288308%7D%7D%7D&include=pickupAddress,invoiceAddress

The decoded JSON part of the query is:

{
  "deliveryAreas": {
    "$inQuery": {
      "where": {
        "postalCodes": {
          "$all": [
            21075
          ]
        }
      },
      "className": "DeliveryArea",
      
    }
  },
  "isActive": true,
  "pickupCoordinates": {
    "$nearSphere": {
      "__type": "GeoPoint",
      "latitude": 53.45994049999999,
      "longitude": 9.9288308
    }
  }
}

NOTE THE TRAILING COMMA AFTER THE className! This is not valid json!

Expected Outcome

Send valid JSON, get the data :)

That's what the previous version did before the upgrade.

Environment

Parse Flutter SDK

• SDK version: parse_server_sdk_flutter: ^5.1.0
• Flutter version: 3.10.2
• Dart version: 3.0.2
• Operating system version: linux/ubuntu

Server

• Parse Server version: tested on 5.2.3, 4.10.4, and 4.5.0

Logs

2023-06-03T20:51:01.484Z - 
Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
    at ServerResponse.setHeader (_http_outgoing.js:558:11)
    at ServerResponse.header (/usr/src/app/node_modules/express/lib/response.js:771:10)
    at ServerResponse.send (/usr/src/app/node_modules/express/lib/response.js:170:12)
    at ServerResponse.json (/usr/src/app/node_modules/express/lib/response.js:267:15)
    at /usr/src/app/src/back/app.js:287:9
    at Layer.handle_error (/usr/src/app/node_modules/express/lib/router/layer.js:71:5)
    at trim_prefix (/usr/src/app/node_modules/express/lib/router/index.js:315:13)
    at /usr/src/app/node_modules/express/lib/router/index.js:284:7
    at Function.process_params (/usr/src/app/node_modules/express/lib/router/index.js:335:12)
    at next (/usr/src/app/node_modules/express/lib/router/index.js:275:10)
    at Layer.handle_error (/usr/src/app/node_modules/express/lib/router/layer.js:67:12)
    at trim_prefix (/usr/src/app/node_modules/express/lib/router/index.js:315:13)
    at /usr/src/app/node_modules/express/lib/router/index.js:284:7
    at Function.process_params (/usr/src/app/node_modules/express/lib/router/index.js:335:12)
    at next (/usr/src/app/node_modules/express/lib/router/index.js:275:10)
    at Immediate.<anonymous> (/usr/src/app/node_modules/express/lib/application.js:233:9)
    at Immediate._onImmediate (/usr/src/app/node_modules/express/lib/router/index.js:635:15)
    at processImmediate (internal/timers.js:463:21)

</details>

- Fixes parse-community/Parse-SDK-Flutter#932

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[parse-github-assistant]

🚀 Thanks for opening this pull request!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.26%. Comparing base (027855d) to head (04bcca4).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1100      +/-   ##
==========================================
+ Coverage   44.01%   44.26%   +0.24%     
==========================================
  Files          61       61              
  Lines        3637     3637              
==========================================
+ Hits         1601     1610       +9     
+ Misses       2036     2027       -9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mtrezza]

@copilot Fix this error in the "Dart beta" CI job:

2025-12-05T02:27:08.3183362Z ##[group]Run dart analyze packages/dart --fatal-infos
2025-12-05T02:27:08.3183819Z �[36;1mdart analyze packages/dart --fatal-infos�[0m
2025-12-05T02:27:08.3216149Z shell: /usr/bin/bash -e {0}
2025-12-05T02:27:08.3216381Z env:
2025-12-05T02:27:08.3216631Z DART_HOME: /opt/hostedtoolcache/dart/3.11.0-200.1.beta/x64
2025-12-05T02:27:08.3216958Z PUB_CACHE: /home/runner/.pub-cache
2025-12-05T02:27:08.3217194Z ##[endgroup]
2025-12-05T02:27:08.3422795Z Analyzing dart...
2025-12-05T02:27:12.5629616Z
2025-12-05T02:27:12.5630611Z warning - lib/src/utils/parse_live_list.dart:592:19 - A value for optional parameter 'includeObject' isn't ever given. Try removing the unused parameter. - unused_element_parameter
2025-12-05T02:27:12.5631255Z
2025-12-05T02:27:12.5631330Z 1 issue found.

[Copilot]

@copilot Fix this error in the "Dart beta" CI job:

2025-12-05T02:27:08.3183362Z ##[group]Run dart analyze packages/dart --fatal-infos...

Fixed in e3dbcb6. Removed the unused includeObject parameter from the _init method in parse_live_list.dart - the parameter was being passed but never used inside the method since includeObject is already handled in the constructor before _init is called.

[kirkmorrow]

@mtrezza This looks good but I'd recommend an additional test that checks for limiters with extra quotes to catch accidental code regression.

[mtrezza]

@copilot add an additional test that checks for limiters with extra quotes to catch accidental code regression.

[Copilot]

@copilot add an additional test that checks for limiters with extra quotes to catch accidental code regression.

Added in 60a7ff0. The new test whereMatchesQuery with limiters should not have extra quotes specifically checks that the URL does not contain the %22%22include pattern (double quotes before limiter keys) which was caused by the bug, and verifies the correct pattern %22InnerClass%22,%22include%22 exists instead.

[mtrezza]

@kirkmorrow how about the added test? and you mind me adding you to the Parse Flutter SDK team? So you can be tagged for a review for example.

[kirkmorrow]

@kirkmorrow how about the added test? and you mind me adding you to the Parse Flutter SDK team? So you can be tagged for a review for example.

You may add me

[kirkmorrow]

@mtrezza I'm ready to approve this. Do you want to make me a member first?

[parseplatformorg]

🎉 This change has been released in version dart-v9.4.8