Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Mongo tools silently accept a wrong database name and misreport `{collection, find}` commands as "undefined" or as permission denials

Ouverte
  • Quelque chose ne va pas ?
#1,487 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
45/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
mongodb, sql, typescript
Domaine
databases

Piste de recherche

Start with normalizeMqlCommand in packages/drivers/src/mongodb.ts (around lines 79-102), which only rewrites string-valued native keys, and the resolveDb lookup near lines 241 and 413. Then read MONGO_READ_COMMANDS and the write fallback in packages/opencode/src/altimate/tools/sql-classify.ts, plus the error path in sql-materialize.ts around lines 180-185. Done when the acceptance checks in the issue pass: the collection/find shape matches the canonical form, a wrong database name lists valid databases, and listCollections is classified as a read.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Problem

  1. A command containing the wrong database name silently targets an empty database and returns "0 rows and no column information", which looks like a legitimate empty result.
  2. The natural shape {"collection": "articles", "find": {...}} (or "aggregate": [...]) is not normalised. sql_materialize says MongoDB command "undefined" is not allowed; sql_execute treats it as a write and returns "The user has specified a rule which prevents you from using this specific tool call".
  3. listCollections is classified as a write; SQL text sent to a Mongo warehouse is denied as a permission problem instead of "this is MongoDB, use a JSON command".

Mechanism

  • normalizeMqlCommand only rewrites native keys whose value is a string (packages/drivers/src/mongodb.ts:79-102), so command stays undefined when find is an object.
  • resolveDb(parsed.database) accepts any name (mongodb.ts:241-243, :413); no existence check.
  • sql_materialize error: sql-materialize.ts:180-185. sql_execute path: MONGO_READ_COMMANDS lacks listCollections and estimatedDocumentCount (packages/opencode/src/altimate/tools/sql-classify.ts:197), and an unparseable shape falls into the write path (:216-220).

Evidence

Recorded analyst sessions against a 127k-document collection:

  • 7 silent empty reads (5 used the warehouse name as the database; 2 a nonexistent collection).
  • 31 sql_materialize calls reported command "undefined" in one set of sessions (16 in another, 4 in a third) and 9 sql_execute calls returned the permission text; it was the first Mongo call in all 10 sessions of one batch.
  • 9 SQL-on-Mongo permission denials.
    Most sessions recovered after one turn; the silent empty read can silently corrupt an answer.

Impact

Correctness-risk (silent empty result) plus about one wasted turn per occurrence.

Proposed fix

  • Accept {collection, find: <filter>} and {collection, aggregate: <pipeline>}.
  • Validate database and collection once per connection (listCollections / listDatabases) and return the available names on mismatch.
  • Add listCollections and estimatedDocumentCount to the read commands.
  • Return a shape error, never a permission error, for unparseable Mongo input or SQL sent to Mongo.

Acceptance check

  • {"collection":"c","find":{"a":1}} runs identically to {"command":"find","collection":"c","filter":{"a":1}} in both tools.
  • A wrong database name returns an error listing valid databases, not an empty result.
  • listCollections is classified as a read.
Langage dominant
TypeScript
Étoiles
812
Forks
123
Merge moyen
1 j 16 h
PR mergées (30 j)
83

Préparer son environnement

Ouvrir dans Codespaces

Lance le conteneur de développement du projet dans votre navigateur, avec votre propre compte GitHub.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de AltimateAI/altimate-code

Toutes les issues de AltimateAI/altimate-code

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.