Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Mongo tools silently accept a wrong database name and misreport `{collection, find}` commands as "undefined" or as permission denials

Offen
  • Stimmt etwas nicht?
#1,487 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
45/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
mongodb, sql, typescript
Bereich
databases

Rechercherichtung

Start with normalizeMqlCommand in packages/drivers/src/mongodb.ts (around lines 79-102), which only rewrites string-valued native keys, and the resolveDb lookup near lines 241 and 413. Then read MONGO_READ_COMMANDS and the write fallback in packages/opencode/src/altimate/tools/sql-classify.ts, plus the error path in sql-materialize.ts around lines 180-185. Done when the acceptance checks in the issue pass: the collection/find shape matches the canonical form, a wrong database name lists valid databases, and listCollections is classified as a read.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Problem

  1. A command containing the wrong database name silently targets an empty database and returns "0 rows and no column information", which looks like a legitimate empty result.
  2. The natural shape {"collection": "articles", "find": {...}} (or "aggregate": [...]) is not normalised. sql_materialize says MongoDB command "undefined" is not allowed; sql_execute treats it as a write and returns "The user has specified a rule which prevents you from using this specific tool call".
  3. listCollections is classified as a write; SQL text sent to a Mongo warehouse is denied as a permission problem instead of "this is MongoDB, use a JSON command".

Mechanism

  • normalizeMqlCommand only rewrites native keys whose value is a string (packages/drivers/src/mongodb.ts:79-102), so command stays undefined when find is an object.
  • resolveDb(parsed.database) accepts any name (mongodb.ts:241-243, :413); no existence check.
  • sql_materialize error: sql-materialize.ts:180-185. sql_execute path: MONGO_READ_COMMANDS lacks listCollections and estimatedDocumentCount (packages/opencode/src/altimate/tools/sql-classify.ts:197), and an unparseable shape falls into the write path (:216-220).

Evidence

Recorded analyst sessions against a 127k-document collection:

  • 7 silent empty reads (5 used the warehouse name as the database; 2 a nonexistent collection).
  • 31 sql_materialize calls reported command "undefined" in one set of sessions (16 in another, 4 in a third) and 9 sql_execute calls returned the permission text; it was the first Mongo call in all 10 sessions of one batch.
  • 9 SQL-on-Mongo permission denials.
    Most sessions recovered after one turn; the silent empty read can silently corrupt an answer.

Impact

Correctness-risk (silent empty result) plus about one wasted turn per occurrence.

Proposed fix

  • Accept {collection, find: <filter>} and {collection, aggregate: <pipeline>}.
  • Validate database and collection once per connection (listCollections / listDatabases) and return the available names on mismatch.
  • Add listCollections and estimatedDocumentCount to the read commands.
  • Return a shape error, never a permission error, for unparseable Mongo input or SQL sent to Mongo.

Acceptance check

  • {"collection":"c","find":{"a":1}} runs identically to {"command":"find","collection":"c","filter":{"a":1}} in both tools.
  • A wrong database name returns an error listing valid databases, not an empty result.
  • listCollections is classified as a read.
Vorherrschende Sprache
TypeScript
Sterne
812
Forks
123
Ø Merge
1 T. 16 Std.
Gemergte PRs (30 T.)
85

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus AltimateAI/altimate-code

Alle Issues in AltimateAI/altimate-code

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.