fix: Use $regex key presence check instead of truthiness to handle empty-string patterns

Author: mtrezza

spec/RequestComplexity.spec.js

@@ -657,6 +657,17 @@ describe('request complexity', () => {
       ).toBeResolved();
     });
 
+    it('should reject empty-string $regex when allowRegex is false', async () => {
+      const where = { username: { $regex: '' } };
+      await expectAsync(
+        rest.find(config, auth.nobody(config), '_User', where)
+      ).toBeRejectedWith(
+        jasmine.objectContaining({
+          message: '$regex operator is not allowed',
+        })
+      );
+    });
+
     it('should allow $regex with maintenance key when allowRegex is false', async () => {
       const where = { username: { $regex: 'test' } };
       await expectAsync(

src/Controllers/DatabaseController.js

@@ -159,7 +159,7 @@ const validateQuery = (
   }
 
   Object.keys(query).forEach(key => {
-    if (query && query[key] && query[key].$regex) {
+    if (query && query[key] && query[key].$regex !== undefined) {
       if (!isMaster && rc && rc.allowRegex === false) {
         throw new Parse.Error(Parse.Error.INVALID_QUERY, '$regex operator is not allowed');
       }