[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Option requestKeywordDenylist is documented to apply to database read and write requests, but it is only enforced on write requests. The query parameters keys, include and excludeKeys are not checked against it, so a query can contain a field path with a prohibited keyword. Depending on the field path, such a query is either accepted or fails with an internal server error.

Approach

Before a query runs, every field name in keys, include and excludeKeys is checked against the key entries of requestKeywordDenylist. A match is rejected with Parse.Error.INVALID_KEY_NAME, the same error that write requests return. Value and key-value entries of the denylist do not apply, since a field name has no value.

Tasks

• Add tests

Summary by CodeRabbit

• Bug Fixes
  • REST queries now reject prohibited field names in keys, include, and excludeKeys with an error, helping prevent unsafe field names from being processed.
  • Custom denylist rules are also enforced for field names, while matching values are not treated as prohibited fields.
  • Queries using permitted field names continue to return data.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 5589ff88-6712-486f-8fb0-af43e7cdcf09

📥 Commits

Reviewing files that changed from the base of the PR and between 4b8a085 and 59f8351.

📒 Files selected for processing: 2

• spec/RestQuery.spec.js
• src/RestQuery.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

RestQuery now checks string-valued keys, excludeKeys, and include options for prohibited field names. Tests cover REST requests, SDK queries, trigger queries, and custom denylist behavior.

Changes: REST field-name validation

Layer / File(s)	Summary
Validate field-list options src/RestQuery.js	RestQuery checks string values for keys, excludeKeys, and include against prohibited field names. It maps check failures to Parse.Error.INVALID_KEY_NAME.
Cover REST and SDK query paths spec/RestQuery.spec.js	Tests cover prohibited names in REST find and get requests, SDK queries, and beforeFind queries. They also verify custom denylist behavior and allowed field names.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: dblythy

Merge Risk: ⚪ Minimal · up to 59f83

The field-name validation change has no identified merge-blocking issue; run the normal test suite before merging.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title starts with the allowed prefix "fix:" and uses a capitalized first word, "Option". It accurately describes the change to denylist enforcement for query parameters.
Description check		The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the defect, implementation, expected error behavior, and test coverage. The completed test task is …
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		No new security vulnerability is introduced. The changed constructor checks every component of string keys, include, and excludeKeys paths against the configured denylist before query processing…
Engage In Review Feedback		No review feedback comments require engagement. The supplied review data reports no CodeRabbit review threads and zero actionable findings in the current review.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.03%. Comparing base (256a253) to head (59f8351).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10793   +/-   ##
=======================================
  Coverage   94.03%   94.03%           
=======================================
  Files         193      193           
  Lines       17239    17248    +9     
  Branches      259      259           
=======================================
+ Hits        16210    16219    +9     
  Misses       1007     1007           
  Partials       22       22           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 9.10.5-alpha.11

[parseplatformorg]

🎉 This change has been released in version 9.10.5