fix

Author: mtrezza

spec/ProtectedFields.spec.js

@@ -1821,5 +1821,13 @@ describe('ProtectedFields', function () {
         })
       );
     });
+
+    it('should handle malformed $or with null element', async function () {
+      const query = new Parse.Query(Parse.User);
+      query.withJSON({ where: { $or: [null, { username: 'test' }] } });
+      // Should not throw TypeError from denyProtectedFields;
+      // may fail downstream in validateQuery (pre-existing issue)
+      await expectAsync(query.find()).toBeRejected();
+    });
   });
 });

src/RestQuery.js

@@ -848,6 +848,9 @@ _UnsafeRestQuery.prototype.denyProtectedFields = async function () {
       this.findOptions
     ) || [];
   const checkWhere = (where) => {
+    if (typeof where !== 'object' || where === null) {
+      return;
+    }
     for (const key of protectedFields) {
       if (key in where) {
         throw createSanitizedError(