Skip to content

fix: Postgres query on non-existent column throws internal server error#10308

Merged
mtrezza merged 2 commits intoparse-community:alphafrom
mtrezza:fix/postgres
Mar 25, 2026
Merged

fix: Postgres query on non-existent column throws internal server error#10308
mtrezza merged 2 commits intoparse-community:alphafrom
mtrezza:fix/postgres

Conversation

@mtrezza
Copy link
Copy Markdown
Member

@mtrezza mtrezza commented Mar 24, 2026

Summary

Querying an internal field that has no corresponding column in the Postgres _User table (e.g. _tombstone) throws an internal server error instead of returning empty results like MongoDB.

This caused the flaky test rest query query internal field on Postgres. The flakiness depended on randomized test order: if the previous test triggered reconfigureServer(), the _User table was recreated (without a _tombstone column), and the query failed with PostgresMissingColumnError (42703). If the previous test used the lightweight performInitialization(), the _User table didn't exist, and the already-caught PostgresRelationDoesNotExistError (42P01) returned empty results.

The fix catches PostgresMissingColumnError in the Postgres adapter's find and count methods, aligning behavior with MongoDB and with the distinct method which already handles this case.

Issue

Fixes flaky test: https://github.com/parse-community/parse-server/actions/runs/23509218104/job/68425397105?pr=10307

Tasks

  • Add tests
  • Add changes to documentation (guides, repository pages, code comments)
  • Add security check
  • Add new Parse Error codes to Parse JS SDK

Summary by CodeRabbit

  • Bug Fixes
    • Improved query reliability to gracefully handle edge cases involving internal fields, returning appropriate empty results instead of throwing errors.

@parse-github-assistant
Copy link
Copy Markdown

parse-github-assistant bot commented Mar 24, 2026

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

  • Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
  • Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
  • Group code into logical blocks. Add a short comment before each block to explain its purpose.
  • We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
  • Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
  • Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

@parseplatformorg
Copy link
Copy Markdown
Contributor

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 24, 2026

📝 Walkthrough

Walkthrough

Added tests verifying that REST queries on the internal _tombstone field using useMasterKey: true return no results without errors. Modified PostgreSQL adapter to treat missing column errors (42703) as non-fatal in find() and count() operations, alongside existing missing table error handling.

Changes

Cohort / File(s) Summary
PostgreSQL Error Handling
src/Adapters/Storage/Postgres/PostgresStorageAdapter.js
Extended error handlers in find() and count() to suppress PostgresMissingColumnError (42703) in addition to existing PostgresRelationDoesNotExistError (42P01), returning empty results instead of rethrowing.
REST Query Tests
spec/RestQuery.spec.js
Added two test cases verifying that querying the _tombstone field on Parse.User with useMasterKey: true returns no results and does not throw, covering both .find(...).length and .count() scenarios.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main fix: handling Postgres queries on non-existent columns that previously threw internal server errors.
Description check ✅ Passed The description covers the issue, approach, and marks relevant tasks complete, but sections lack detail and task checkboxes are mostly unchecked.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/Adapters/Storage/Postgres/PostgresStorageAdapter.js`:
- Around line 1995-1998: The current catch is swallowing all
PostgresMissingColumnError (42703) alongside PostgresRelationDoesNotExistError;
restrict that fallback so only the intended virtual-field cases (e.g., queries
referencing the synthetic _tombstone column) are treated as “missing column” and
converted to an empty result — otherwise rethrow the error. Update both places
that compare error.code to PostgresRelationDoesNotExistError and
PostgresMissingColumnError to inspect the error message or the originating
SQL/column name and only suppress the 42703 when it references the virtual field
(for example contains "_tombstone"); for any other 42703, throw the error so
real schema drift surfaces. Ensure the logic is applied at both occurrences
currently checking PostgresRelationDoesNotExistError and
PostgresMissingColumnError.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9ea20beb-b269-4c1e-bd9a-6103bd5864b2

📥 Commits

Reviewing files that changed from the base of the PR and between 3f888b1 and 072a884.

📒 Files selected for processing (2)
  • spec/RestQuery.spec.js
  • src/Adapters/Storage/Postgres/PostgresStorageAdapter.js

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 24, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.53%. Comparing base (1bacddb) to head (072a884).
⚠️ Report is 41 commits behind head on alpha.

Additional details and impacted files
@@           Coverage Diff           @@
##            alpha   #10308   +/-   ##
=======================================
  Coverage   92.53%   92.53%           
=======================================
  Files         192      192           
  Lines       16502    16502           
  Branches      227      227           
=======================================
  Hits        15270    15270           
  Misses       1212     1212           
  Partials       20       20           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mtrezza mtrezza merged commit c5c4325 into parse-community:alpha Mar 25, 2026
24 checks passed
parseplatformorg pushed a commit that referenced this pull request Mar 25, 2026
# [9.7.0-alpha.5](9.7.0-alpha.4...9.7.0-alpha.5) (2026-03-25)

### Bug Fixes

* Postgres query on non-existent column throws internal server error ([#10308](#10308)) ([c5c4325](c5c4325))
@parseplatformorg
Copy link
Copy Markdown
Contributor

🎉 This change has been released in version 9.7.0-alpha.5

@parseplatformorg parseplatformorg added the state:released-alpha Released as alpha version label Mar 25, 2026
@mtrezza mtrezza deleted the fix/postgres branch March 25, 2026 18:35
parseplatformorg pushed a commit that referenced this pull request Mar 30, 2026
# [9.7.0](9.6.1...9.7.0) (2026-03-30)

### Bug Fixes

* Auth data exposed via verify password endpoint ([GHSA-wp76-gg32-8258](GHSA-wp76-gg32-8258)) ([#10323](#10323)) ([770be86](770be86))
* Batch login sub-request rate limit uses IP-based keying ([#10349](#10349)) ([63c37c4](63c37c4))
* Cloud Code trigger context vulnerable to prototype pollution ([#10352](#10352)) ([d5f5128](d5f5128))
* Cloud function validator bypass via prototype chain traversal ([GHSA-vpj2-qq7w-5qq6](GHSA-vpj2-qq7w-5qq6)) ([#10342](#10342)) ([dc59e27](dc59e27))
* Duplicate session destruction can cause unhandled promise rejection ([#10319](#10319)) ([92791c1](92791c1))
* GraphQL API endpoint ignores CORS origin restriction ([GHSA-q3p6-g7c4-829c](GHSA-q3p6-g7c4-829c)) ([#10334](#10334)) ([4dd0d3d](4dd0d3d))
* GraphQL complexity validator exponential fragment traversal DoS ([GHSA-mfj6-6p54-m98c](GHSA-mfj6-6p54-m98c)) ([#10344](#10344)) ([f759bda](f759bda))
* LiveQuery protected field leak via shared mutable state across concurrent subscribers ([GHSA-m983-v2ff-wq65](GHSA-m983-v2ff-wq65)) ([#10330](#10330)) ([776c71c](776c71c))
* LiveQuery protected-field guard bypass via array-like logical operator value ([GHSA-mmg8-87c5-jrc2](GHSA-mmg8-87c5-jrc2)) ([#10350](#10350)) ([f63fd1a](f63fd1a))
* Maintenance key blocked from querying protected fields ([#10290](#10290)) ([7c8b213](7c8b213))
* MFA single-use token bypass via concurrent authData login requests ([GHSA-w73w-g5xw-rwhf](GHSA-w73w-g5xw-rwhf)) ([#10326](#10326)) ([e7efbeb](e7efbeb))
* Missing error messages in Parse errors ([#10304](#10304)) ([f128048](f128048))
* Postgres query on non-existent column throws internal server error ([#10308](#10308)) ([c5c4325](c5c4325))
* Session field immutability bypass via falsy-value guard ([GHSA-f6j3-w9v3-cq22](GHSA-f6j3-w9v3-cq22)) ([#10347](#10347)) ([9080296](9080296))

### Features

* Add `protectedFieldsSaveResponseExempt` option to strip protected fields from save responses ([#10289](#10289)) ([4f7cb53](4f7cb53))
* Add `protectedFieldsTriggerExempt` option to exempt Cloud Code triggers from `protectedFields` ([#10288](#10288)) ([1610f98](1610f98))
* Add support for `partialFilterExpression` in MongoDB storage adapter ([#10346](#10346)) ([8dd7bf2](8dd7bf2))
* Extend storage adapter interface to optionally return `matchedCount` and `modifiedCount` from `DatabaseController.update` with `many: true` ([#10353](#10353)) ([aea7596](aea7596))
@parseplatformorg
Copy link
Copy Markdown
Contributor

🎉 This change has been released in version 9.7.0

@parseplatformorg parseplatformorg added the state:released Released as stable version label Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

state:released Released as stable version state:released-alpha Released as alpha version

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants