[beiguancyc]

Issue

#10815

A query sent as POST with _method: "GET" is executed as a create and saves an empty object when the client closes the connection while an async middleware before express.json() is still pending. body-parser treats the closed socket as already finished, skips the body, and req.body stays undefined. allowMethodOverride then keeps the method as POST, and handleCreate saves req.body || {}.

Approach

Reject the request when it declares a body (Content-Length > 0 or Transfer-Encoding) but the body was not parsed. Multipart requests are excluded, because the JSON parser intentionally skips them. The request fails with Parse.Error.INVALID_JSON before it can be routed as a create.

Tasks

• Add tests

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • Requests that declare a body but lack a parsed body now return an invalid JSON error. Multipart requests and requests without a body continue to pass through normally.
  • Prevented a disconnected request with a delayed body parser from creating an aborted query record.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 38a819d6-ff5b-40b7-8e25-8711ac3fd540

📥 Commits

Reviewing files that changed from the base of the PR and between d7e3087 and 1017a93.

📒 Files selected for processing: 4

• spec/Middlewares.spec.js
• spec/ParseAPI.spec.js
• src/ParseServer.ts
• src/middlewares.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The server now checks for declared request bodies that were not parsed. Non-multipart requests with unread bodies receive an invalid JSON error. Tests cover middleware conditions and an aborted query request.

Changes: Request Body Enforcement

Layer / File(s)	Summary
Detect and reject unread request bodies src/middlewares.js, src/ParseServer.ts, spec/Middlewares.spec.js, spec/ParseAPI.spec.js	The middleware checks for Transfer-Encoding or a positive Content-Length when req.body is undefined, except for multipart requests. The server installs it after JSON parsing and before method-override handling. Tests cover body conditions and verify that an aborted query creates no objects.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: mtrezza

Merge Risk: ⚪ Minimal · up to 1017a

The change is ready to merge after normal checks; no blocking issue was established.

Pre-merge checks: 6 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 6 passed

Check name	Status	Explanation
Title check		The title begins with the required fix: prefix, uses a capitalized first word, and accurately describes the primary change.
Description check		The description includes the issue, approach, and completed test task. It omits the template's general security and license boilerplate, but the core change information is complete.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		No security vulnerability is introduced by the changed code. The PR adds enforceParsedBody after express.json() and before method override, so requests with a declared non-multipart body and undef…
Engage In Review Feedback		The current review produced zero actionable findings, and no posted CodeRabbit review threads were returned. Therefore, no review feedback required engagement, implementation, or discussion.

Full details: Security Check

Explanation

No security vulnerability is introduced by the changed code. The PR adds enforceParsedBody after express.json() and before method override, so requests with a declared non-multipart body and undefined req.body receive Parse.Error.INVALID_JSON instead of reaching create routing. The error message is static, and the change adds no dependency, dynamic-code, filesystem, authentication, or input-merging behavior. Multipart handling remains an intentional existing exception and is parsed later for Cloud Functions or handled by the file router.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}