Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

/installations and /audiences reject a find sent as POST + _method=GET with "Invalid key name: 0"

Aperta Adatta ai principianti
  • Qualcosa non va?
#10,626 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
Mezza giornata
Idoneità per principianti
65/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
javascript, nodejs
Ambito
api, backend

Direzione di ricerca

Inizia confrontando src/Routers/InstallationsRouter.js e src/Routers/AudiencesRouter.js con ClassesRouter.handleFind, concentrandoti su come viene gestita una stringa il cui valore proviene dal corpo della richiesta. Usa il reproducer curl method-override su entrambe le route e conferma che le richieste restituiscano risultati della query invece di Invalid key name: 0.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

New Issue Checklist
Issue Description

InstallationsRouter.handleFind and AudiencesRouter.handleFind override ClassesRouter.handleFind but drop its string-where decoding step, so a query sent with the documented POST + _method=GET override fails on /installations and /audiences while the identical query succeeds on /classes/_Installation.

ClassesRouter.handleFind decodes a where that arrives in the request body as a JSON string:

if (typeof body.where === 'string') {
  try {
    body.where = JSON.parse(body.where);
  } catch {
    throw new Parse.Error(Parse.Error.INVALID_JSON, 'where parameter is not valid JSON');
  }
}

The two subclasses copy the body/options lines but not that block, so they only handle a where that arrives in the query string (decoded by ClassesRouter.JSONFromQuery). When the client uses the method override with an application/x-www-form-urlencoded body, body.where stays a string and is passed straight to rest.find. DatabaseController.validateQuery then runs Object.keys() over the string, walking it character by character, and the first index fails the key-name regex:

{"code":105,"error":"Invalid key name: 0"}

This is the same failure mode as the AggregateRouter pipeline handling that produced Invalid aggregate stage '0'.

The trigger is query size, not query shape. SDKs switch from GET to POST + _method=GET once the URL exceeds ~2 KB, so this only appears when an app queries /installations with a large enough constraint, for example an installationId $in list of roughly 41 or more ids. The same code path works for /users, /roles and /sessions, whose routers inherit ClassesRouter.handleFind unchanged.

Steps to reproduce

Any query long enough for the SDK to use the method override reproduces this. A minimal equivalent with curl:

# 1. POST + _method=GET against /installations -> error 105
curl -s -X POST \
  -H 'X-Parse-Application-Id: myAppId' \
  -H 'X-Parse-Master-Key: myMasterKey' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode '_method=GET' \
  --data-urlencode 'where={"installationId":{"$in":["af593bd0-cede-4b27-b0d0-1b48a025dc03"]}}' \
  --data-urlencode 'limit=100' \
  http://localhost:1337/parse/installations

# 2. Identical request against /classes/_Installation -> succeeds
curl -s -X POST \
  -H 'X-Parse-Application-Id: myAppId' \
  -H 'X-Parse-Master-Key: myMasterKey' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode '_method=GET' \
  --data-urlencode 'where={"installationId":{"$in":["af593bd0-cede-4b27-b0d0-1b48a025dc03"]}}' \
  --data-urlencode 'limit=100' \
  http://localhost:1337/parse/classes/_Installation

# 3. Same where as a GET query string against /installations -> succeeds
curl -s -G \
  -H 'X-Parse-Application-Id: myAppId' \
  -H 'X-Parse-Master-Key: myMasterKey' \
  --data-urlencode 'where={"installationId":{"$in":["af593bd0-cede-4b27-b0d0-1b48a025dc03"]}}' \
  http://localhost:1337/parse/installations

/audiences fails the same way.

Actual Outcome
1. {"code":105,"error":"Invalid key name: 0"}
2. {"results":[]}
3. {"results":[]}
Expected Outcome

All three return the query results. The method override is supported transport for a find, so /installations and /audiences should decode a string where from the body exactly as /classes/:className does.

Environment

Server

  • Parse Server version: 9.10.0 (also present on alpha at 9.10.1-alpha.6; src/Routers/InstallationsRouter.js and src/Routers/AudiencesRouter.js are unchanged there)
  • Operating system: macOS 15.5 (Docker, node:22 image)
  • Local or remote host: local

Database

  • System (MongoDB or Postgres): MongoDB
  • Database version: 7.0.31
  • Local or remote host: local

Client

  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): reproduced with curl; originally hit from the Ruby SDK
  • SDK version: parse-stack-next 5.7.0
Logs
error: Invalid key name: 0 {"code":105,"stack":"Error: Invalid key name: 0
    at .../parse-server/lib/Controllers/DatabaseController.js:208:13
    at Array.forEach (<anonymous>)
    at validateQuery (.../parse-server/lib/Controllers/DatabaseController.js:190:22)
    at .../parse-server/lib/Controllers/DatabaseController.js:1238:11
    at async _UnsafeRestQuery.runFind (.../parse-server/lib/RestQuery.js:785:19)"}
{"method":"POST","objectId":null,"body":{"keys":"installationId,appBuildNumber,appVersion","limit":"100","skip":"0","where":"{\"installationId\":{\"$in\":[\"af593bd0-cede-4b27-b0d0-1b48a025dc03\", ...]}}"},"installationId":null,"statusCode":400}

The logged body.where is still a string at the point the error is raised, which is the tell: ClassesRouter.handleFind mutates req.body.where into an object in place, so a request that went through the classes route would show a decoded object here.

I have a fix and can open a PR against alpha.

Lingua principale
JavaScript
Stelle
21.4k
Fork
4.8k
Merge medio
2g 10h
PR unite (30g)
38

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di parse-community/parse-server

Tutte le issue di parse-community/parse-server

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.