reject unsafe mongo query operators

[ar2rsawseen]

Validate user-supplied Mongo queries at the API boundary instead of stripping operators in place.

• Allow $expr; reject $where / $function / $accumulator at any depth, including nested inside $expr.
• Detection is keys-only and runs on the decoded object. Queries are never modified — a request runs exactly as submitted or returns 400.
• Adds common.parseUserQuery / common.findUnsafeMongoOperator; validation is applied at the endpoints that accept a query. Unit tests included.

Companion (lockstep): Countly/countly-enterprise-plugins#3218

[Copilot]

Pull request overview

This PR hardens Countly’s API boundary by replacing the previous in-place stripping of unsafe MongoDB operators with a validate-and-reject approach. It introduces shared helpers in api/utils/common.js and updates multiple API entrypoints/plugins to either execute a user query exactly as provided or reject it with HTTP 400, preventing silent query rewrites.

Changes:

• Added common.findUnsafeMongoOperator() and common.parseUserQuery() to detect and reject $where / $function / $accumulator (while allowing $expr).
• Updated multiple endpoints/plugins to parse/validate incoming query/filter JSON and return 400 on invalid JSON or disallowed operators (instead of stripping and continuing).
• Added unit tests covering the new helper behavior and the motivating $expr customer query.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/unit-tests/api.utils.common.js	Adds unit tests for findUnsafeMongoOperator and parseUserQuery.
api/utils/common.js	Replaces stripping logic with unsafe-operator detection + parse-and-reject helper.
api/utils/requestProcessor.js	Uses parseUserQuery at request boundary for app user operations.
api/parts/mgmt/app_users.js	Removes silent stripping before /drill/preprocess_query dispatch.
api/parts/mgmt/cms.js	Validates request-supplied CMS query via parseUserQuery and rejects on error.
api/parts/data/fetch.js	Validates filter query param via parseUserQuery and rejects on error.
api/parts/data/exports.js	Validates already-parsed export query via findUnsafeMongoOperator.
plugins/systemlogs/api/api.js	Uses parseUserQuery for systemlogs query parsing + rejection.
plugins/logger/api/api.js	Uses parseUserQuery for logs filter parsing + rejection.
plugins/crashes/api/api.js	Uses parseUserQuery for crashes query parsing + rejection.
plugins/compliance-hub/api/api.js	Validates compliance-hub query parsing paths via parseUserQuery.
plugins/dbviewer/api/api.js	Switches to reject unsafe operators via findUnsafeMongoOperator (EJSON-aware path).
plugins/remote-config/api/api.js	Validates remote-config condition payloads/strings for unsafe operators at ingress.
plugins/push/api/legacy.js	Rejects unsafe operators in legacy push audience/drill conditions.
plugins/push/api/api-message.js	Rejects unsafe operators in push message filters before DB execution.
plugins/push/api/api-tx.js	Rejects unsafe operators in tx filter override after Filter parsing.