fix: Postgres query on non-existent column throws internal server error#10308
fix: Postgres query on non-existent column throws internal server error#10308mtrezza merged 2 commits intoparse-community:alphafrom
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
📝 WalkthroughWalkthroughAdded tests verifying that REST queries on the internal Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/Adapters/Storage/Postgres/PostgresStorageAdapter.js`:
- Around line 1995-1998: The current catch is swallowing all
PostgresMissingColumnError (42703) alongside PostgresRelationDoesNotExistError;
restrict that fallback so only the intended virtual-field cases (e.g., queries
referencing the synthetic _tombstone column) are treated as “missing column” and
converted to an empty result — otherwise rethrow the error. Update both places
that compare error.code to PostgresRelationDoesNotExistError and
PostgresMissingColumnError to inspect the error message or the originating
SQL/column name and only suppress the 42703 when it references the virtual field
(for example contains "_tombstone"); for any other 42703, throw the error so
real schema drift surfaces. Ensure the logic is applied at both occurrences
currently checking PostgresRelationDoesNotExistError and
PostgresMissingColumnError.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9ea20beb-b269-4c1e-bd9a-6103bd5864b2
📒 Files selected for processing (2)
spec/RestQuery.spec.jssrc/Adapters/Storage/Postgres/PostgresStorageAdapter.js
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10308 +/- ##
=======================================
Coverage 92.53% 92.53%
=======================================
Files 192 192
Lines 16502 16502
Branches 227 227
=======================================
Hits 15270 15270
Misses 1212 1212
Partials 20 20 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
# [9.7.0-alpha.5](9.7.0-alpha.4...9.7.0-alpha.5) (2026-03-25) ### Bug Fixes * Postgres query on non-existent column throws internal server error ([#10308](#10308)) ([c5c4325](c5c4325))
|
🎉 This change has been released in version 9.7.0-alpha.5 |
# [9.7.0](9.6.1...9.7.0) (2026-03-30) ### Bug Fixes * Auth data exposed via verify password endpoint ([GHSA-wp76-gg32-8258](GHSA-wp76-gg32-8258)) ([#10323](#10323)) ([770be86](770be86)) * Batch login sub-request rate limit uses IP-based keying ([#10349](#10349)) ([63c37c4](63c37c4)) * Cloud Code trigger context vulnerable to prototype pollution ([#10352](#10352)) ([d5f5128](d5f5128)) * Cloud function validator bypass via prototype chain traversal ([GHSA-vpj2-qq7w-5qq6](GHSA-vpj2-qq7w-5qq6)) ([#10342](#10342)) ([dc59e27](dc59e27)) * Duplicate session destruction can cause unhandled promise rejection ([#10319](#10319)) ([92791c1](92791c1)) * GraphQL API endpoint ignores CORS origin restriction ([GHSA-q3p6-g7c4-829c](GHSA-q3p6-g7c4-829c)) ([#10334](#10334)) ([4dd0d3d](4dd0d3d)) * GraphQL complexity validator exponential fragment traversal DoS ([GHSA-mfj6-6p54-m98c](GHSA-mfj6-6p54-m98c)) ([#10344](#10344)) ([f759bda](f759bda)) * LiveQuery protected field leak via shared mutable state across concurrent subscribers ([GHSA-m983-v2ff-wq65](GHSA-m983-v2ff-wq65)) ([#10330](#10330)) ([776c71c](776c71c)) * LiveQuery protected-field guard bypass via array-like logical operator value ([GHSA-mmg8-87c5-jrc2](GHSA-mmg8-87c5-jrc2)) ([#10350](#10350)) ([f63fd1a](f63fd1a)) * Maintenance key blocked from querying protected fields ([#10290](#10290)) ([7c8b213](7c8b213)) * MFA single-use token bypass via concurrent authData login requests ([GHSA-w73w-g5xw-rwhf](GHSA-w73w-g5xw-rwhf)) ([#10326](#10326)) ([e7efbeb](e7efbeb)) * Missing error messages in Parse errors ([#10304](#10304)) ([f128048](f128048)) * Postgres query on non-existent column throws internal server error ([#10308](#10308)) ([c5c4325](c5c4325)) * Session field immutability bypass via falsy-value guard ([GHSA-f6j3-w9v3-cq22](GHSA-f6j3-w9v3-cq22)) ([#10347](#10347)) ([9080296](9080296)) ### Features * Add `protectedFieldsSaveResponseExempt` option to strip protected fields from save responses ([#10289](#10289)) ([4f7cb53](4f7cb53)) * Add `protectedFieldsTriggerExempt` option to exempt Cloud Code triggers from `protectedFields` ([#10288](#10288)) ([1610f98](1610f98)) * Add support for `partialFilterExpression` in MongoDB storage adapter ([#10346](#10346)) ([8dd7bf2](8dd7bf2)) * Extend storage adapter interface to optionally return `matchedCount` and `modifiedCount` from `DatabaseController.update` with `many: true` ([#10353](#10353)) ([aea7596](aea7596))
|
🎉 This change has been released in version 9.7.0 |
Summary
Querying an internal field that has no corresponding column in the Postgres
_Usertable (e.g._tombstone) throws an internal server error instead of returning empty results like MongoDB.This caused the flaky test
rest query query internal fieldon Postgres. The flakiness depended on randomized test order: if the previous test triggeredreconfigureServer(), the_Usertable was recreated (without a_tombstonecolumn), and the query failed withPostgresMissingColumnError(42703). If the previous test used the lightweightperformInitialization(), the_Usertable didn't exist, and the already-caughtPostgresRelationDoesNotExistError(42P01) returned empty results.The fix catches
PostgresMissingColumnErrorin the Postgres adapter'sfindandcountmethods, aligning behavior with MongoDB and with thedistinctmethod which already handles this case.Issue
Fixes flaky test: https://github.com/parse-community/parse-server/actions/runs/23509218104/job/68425397105?pr=10307
Tasks
Summary by CodeRabbit