Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Mongo tools silently accept a wrong database name and misreport `{collection, find}` commands as "undefined" or as permission denials

オープン
  • 何か問題がありますか？
#1,487 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
45/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
mongodb, sql, typescript
領域
databases

調査の方向性

Start with normalizeMqlCommand in packages/drivers/src/mongodb.ts (around lines 79-102), which only rewrites string-valued native keys, and the resolveDb lookup near lines 241 and 413. Then read MONGO_READ_COMMANDS and the write fallback in packages/opencode/src/altimate/tools/sql-classify.ts, plus the error path in sql-materialize.ts around lines 180-185. Done when the acceptance checks in the issue pass: the collection/find shape matches the canonical form, a wrong database name lists valid databases, and listCollections is classified as a read.

索引モデルが issue の本文から書いたものです。

説明

Problem

  1. A command containing the wrong database name silently targets an empty database and returns "0 rows and no column information", which looks like a legitimate empty result.
  2. The natural shape {"collection": "articles", "find": {...}} (or "aggregate": [...]) is not normalised. sql_materialize says MongoDB command "undefined" is not allowed; sql_execute treats it as a write and returns "The user has specified a rule which prevents you from using this specific tool call".
  3. listCollections is classified as a write; SQL text sent to a Mongo warehouse is denied as a permission problem instead of "this is MongoDB, use a JSON command".

Mechanism

  • normalizeMqlCommand only rewrites native keys whose value is a string (packages/drivers/src/mongodb.ts:79-102), so command stays undefined when find is an object.
  • resolveDb(parsed.database) accepts any name (mongodb.ts:241-243, :413); no existence check.
  • sql_materialize error: sql-materialize.ts:180-185. sql_execute path: MONGO_READ_COMMANDS lacks listCollections and estimatedDocumentCount (packages/opencode/src/altimate/tools/sql-classify.ts:197), and an unparseable shape falls into the write path (:216-220).

Evidence

Recorded analyst sessions against a 127k-document collection:

  • 7 silent empty reads (5 used the warehouse name as the database; 2 a nonexistent collection).
  • 31 sql_materialize calls reported command "undefined" in one set of sessions (16 in another, 4 in a third) and 9 sql_execute calls returned the permission text; it was the first Mongo call in all 10 sessions of one batch.
  • 9 SQL-on-Mongo permission denials.
    Most sessions recovered after one turn; the silent empty read can silently corrupt an answer.

Impact

Correctness-risk (silent empty result) plus about one wasted turn per occurrence.

Proposed fix

  • Accept {collection, find: <filter>} and {collection, aggregate: <pipeline>}.
  • Validate database and collection once per connection (listCollections / listDatabases) and return the available names on mismatch.
  • Add listCollections and estimatedDocumentCount to the read commands.
  • Return a shape error, never a permission error, for unparseable Mongo input or SQL sent to Mongo.

Acceptance check

  • {"collection":"c","find":{"a":1}} runs identically to {"command":"find","collection":"c","filter":{"a":1}} in both tools.
  • A wrong database name returns an error listing valid databases, not an empty result.
  • listCollections is classified as a read.
主要言語
TypeScript
スター
810
フォーク
121
平均マージ
1日 10時間
マージ済み PR（30日）
89

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

AltimateAI/altimate-code のほかの issue

AltimateAI/altimate-code の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。