fix(server): reject empty filter on bulk mutations to prevent unbounded delete/update (#24746)
## Context
Security scan finding (HIGH, true positive): an empty filter object `{}`
on the multi-record mutations resulted in an unconditional DELETE /
UPDATE of every record in the object. Same root cause covers the paired
UPDATE finding.
## Problem
`destroyMany` / `deleteMany` / `updateMany` / `restoreMany` only
rejected an **undefined** filter. An empty `{}` passes that check, and
`GraphqlQueryFilterConditionParser.parse` skips filtering entirely when
the filter has no keys, so no `WHERE` clause is produced. For a role
without row-level restrictions (e.g. an admin or API key), the mutation
then runs unbounded over the whole object table.
## Fix
Guard the shared `runFilteredMutation` chokepoint in
`common-base-query-runner.service.ts`: throw a
`CommonQueryRunnerException` when the processed filter is empty. The
chokepoint runs on the already-processed filter, right before SQL, and
is the single entry point for all four many-mutations — so one guard
closes the DELETE finding, its UPDATE twin, and hardens the two siblings
(`deleteMany`, `restoreMany`) against the same latent bug.
Emptiness is extracted into a pure `isRecordFilterEmpty` util, matching
the parser's own rule (`Object.keys(filter).length === 0`).
## Tests
- Unit test on `isRecordFilterEmpty`.
- Integration spec asserting `destroyMany` / `deleteMany` / `updateMany`
with `{}` are rejected.
<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/24746?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. --> C
Charles Bochet committed
1f98653cc8d5124bcf8e9088ebe835dea9ae938c
Parent: e6ff527
Committed by GitHub <noreply@github.com>
on 8/25/2026, 11:51:00 AM