Repository navigation
fix: Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v) - #10842
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Missing-path expansion and regression coverage src/Controllers/DatabaseController.js, spec/vulnerabilities.spec.js |
The controller keeps the current child object when a key-path segment is absent or is not an object. Specs cover update and create responses across missing paths, trigger configurations, MongoDB array indexes, and master-key requests. |
Priority:
Estimated code review effort: 3 (Moderate) | ~20 minutes
Merge Risk: 
72cb4
-
No merge-blocking issue was identified.
Caution
Pre-merge checks failed
Please resolve all errors before merging. Addressing warnings is optional.
- Ignore
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check |  |
The pull request has no description. It does not provide the required Issue, Approach, or Tasks information from the repository template. | Add a pull request description that includes the Issue, Approach, and Tasks sections. Identify the security issue, summarize the code and test changes, and mark applicable tasks as complete. |
-
Check name Status Explanation Title check The title starts with the required fix:prefix. It identifies the security advisory addressed by the changes, and the first character after the prefix is capitalized.Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Security Check The changed controller code hardens _expandResultOnKeyPathby requiring an own object property before descending into the database result. If a path is absent, it keeps the empty response child and …Engage In Review Feedback PASS: No review feedback comments were supplied for this pull request. The current review produced zero actionable findings, and no CodeRabbit review threads were returned. There was therefore no feed… Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files.
Full details: Security Check
-
Explanation
The changed controller code hardens
_expandResultOnKeyPathby requiring an own object property before descending into the database result. If a path is absent, it keeps the empty response child and does not read below the hidden path. The added GHSA-4m87-fqwv-2m8v tests cover missing parents, stored paths, master-key behavior, arrays, triggers, and SDK state cleanup. No new security-vulnerable pattern is introduced by the pull request.
Full details: Engage In Review Feedback
-
Explanation
PASS: No review feedback comments were supplied for this pull request. The current review produced zero actionable findings, and no CodeRabbit review threads were returned. There was therefore no feedback requiring engagement, implementation, or discussion.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10842 +/- ##
=======================================
Coverage 94.17% 94.17%
=======================================
Files 193 193
Lines 17378 17379 +1
Branches 246 246
=======================================
+ Hits 16366 16367 +1
Misses 991 991
Partials 21 21 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
mtrezza
changed the title
## [9.10.8-alpha.1](9.10.7...9.10.8-alpha.1) (2026-10-29) ### Bug Fixes * Dot notation operation on a missing field reveals whether the field is stored to a caller without read access ([GHSA-4m87-fqwv-2m8v](GHSA-4m87-fqwv-2m8v)) ([#10842](#10842)) ([d88efed](d88efed))
|
🎉 This change has been released in version 9.10.8-alpha.1 |
Pull Request
Issue
Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v)
Tasks