Cherry-pick: enforce property restrictions and query limits for $apply and $compute (#1594) - #1596
Merged
Merged
Conversation
Member
Author
|
/AzurePipelines run |
|
No pipelines are associated with this pull request. |
WanjohiSammy
changed the title
Member
Author
|
/AzurePipelines run |
|
No pipelines are associated with this pull request. |
xuzhg
previously approved these changes
Jul 22, 2026
…ompute (#1594) * fix(query): enforce property restrictions for $apply and $compute $apply and top-level $compute had no content validator, so properties a service marks as not filterable ([NotFilterable]/[NonFilterable]) or configures as not selectable were enforced for $filter and $select but silently accepted when referenced through $apply=filter/groupby/aggregate/compute(...) or $compute=.... This adds an ApplyQueryValidator and gives ComputeQueryValidator real content so the same per-property restrictions are applied consistently across these options. - Add IApplyQueryValidator and ApplyQueryValidator: route $apply=filter(...) through the existing FilterQueryValidator and walk groupby/aggregate/compute referenced properties. - Add internal QueryNodeRestrictionValidator, a shared node walker that rejects not-filterable/not-selectable properties via EdmHelpers.IsNotFilterable/IsNotSelectable. The walker covers nested paths, function calls, any()/all() lambda bodies, single/collection navigations, complex properties, entity-set aggregates (AggregatedCollectionPropertyNode) and treats the virtual $count node (aggregate($count as ...)) as a no-op. - Add ApplyQueryOption.Validator and Validate(...); wire into ODataQueryValidator and register in DI. - Give ComputeQueryValidator real content for top-level $compute. - Update public API baselines; add unit and E2E tests. The change is a no-op unless a property is explicitly restricted; a restricted property referenced via $apply/$compute now returns 400, matching $filter and $select. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Adding a concise doc-comment noting the accepted path-context limitation * fix(query): enforce property restrictions for $apply and $compute Also enforce AllowedFunctions/operators and MaxNodeCount inside groupby/aggregate/compute. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f408404f-6bba-448b-8b75-5fea8aae8672 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit 9c1d552)
WanjohiSammy
force-pushed
the
fix/dev10-apply-compute-restrictions
branch
from
July 22, 2026 19:19
7b960e6 to
1c37737
Compare
xuzhg
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
cherry picked from commit 9c1d552d6618d705ef486276a4cb2331fdc9c07d