Skip to content

Enhance query filter expansion safety by adding validation for non-lambda transformers#78

Open
koenbeuk wants to merge 1 commit into
mainfrom
feat/ef-qf-swallow
Open

Enhance query filter expansion safety by adding validation for non-lambda transformers#78
koenbeuk wants to merge 1 commit into
mainfrom
feat/ef-qf-swallow

Conversation

@koenbeuk

Copy link
Copy Markdown
Collaborator

No description provided.

Copilot AI review requested due to automatic review settings July 26, 2026 01:01

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens EF Core global query filter expansion by validating that expression transformers preserve the required LambdaExpression shape, preventing silent query filter removal (which could unintentionally widen data access) when SetQueryFilter(null) is invoked.

Changes:

  • Added an explicit validation step during model finalization to ensure expanded query filters remain lambdas, throwing an InvalidOperationException otherwise.
  • Added an integration test that verifies model building fails loudly when a transformer returns a non-lambda expression for a query filter.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
tests/ExpressiveSharp.EntityFrameworkCore.IntegrationTests/Tests/Sqlite/QueryFilterExpansionSafetyTests.cs Adds a regression test proving non-lambda transformer output during query filter expansion fails model creation with a clear error.
src/ExpressiveSharp.EntityFrameworkCore/Infrastructure/Internal/ExpressiveExpandQueryFiltersConvention.cs Introduces safe query filter expansion via a helper that prevents silent filter removal by requiring LambdaExpression output.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +57 to +64
var expanded = filter.ExpandExpressives(_options);
if (expanded is not LambdaExpression lambda)
{
throw new InvalidOperationException(
$"Expanding the query filter for entity type '{entityType.DisplayName()}' produced a " +
$"{expanded.NodeType} expression instead of a lambda, which would silently remove the filter. " +
"A registered IExpressionTreeTransformer must return a LambdaExpression when given one.");
}
@codecov

codecov Bot commented Jul 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
...Internal/ExpressiveExpandQueryFiltersConvention.cs 90.00% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants