Flexible StandardQueryParser throws ClassCastException on a range over the field *, such as *>a or *:[a TO *]

The flexible StandardQueryParser declares QueryNodeException as the failure of parse(). Its grammar writes the open side of a range as a bound with the text * (f>a is f:{a TO *]). On the field * that bound is *:*, and MatchAllDocsQueryNodeProcessor, which turns the query *:* into match-all, rewrites every field node *:* without checking whether it is a range bound. OpenRangeQueryNodeProcessor runs next and reads the bound through an unchecked generic cast, so parse("*>a", "f") throws java.lang.ClassCastException: MatchAllDocsQueryNode cannot be cast to FieldValuePairQueryNode.

Every range on the field * with a * bound fails: the </> shorthand, the bracket forms such as *:[a TO *] and *:[* TO *], ranges inside Boolean queries, escaped forms, and [a TO *] with the default field *. Ranges on * without a * bound, ranges on other fields and the query *:* work, and the classic QueryParser returns a TermRangeQuery on the field * for the bracket forms. The bracket forms have failed since 2.9.0 (2009), *>a since cffd01664bc9 (2011), first released in 4.0.0-ALPHA (2012). The failure happens while parsing, so nothing is searched and no result is wrong: a query string is refused with an undeclared exception type. A one-line guard, the one two sibling processors already use, fixes it and is validated with the whole queryparser test suite and check.

1. Grammar. A field name is any term, so * is legal (StandardSyntaxParser.jj:339-344). For > and >= the grammar builds the open upper bound as new FieldQueryNode(field, "*", ...) (.jj:767, :773); for < and <= the lower bound (.jj:754, :760). The bracket form builds one FieldQueryNode per bound (.jj:870-873), so [a TO *] has a bound with the text * too. On the field *, that bound has field * and text *.
2. Order. MatchAllDocsQueryNodeProcessor runs right before OpenRangeQueryNodeProcessor (StandardQueryNodeProcessorPipeline.java:52-53).
3. The rewrite. if (node instanceof FieldQueryNode fqn) { if (fqn.getField().toString().equals("*") && fqn.getText().toString().equals("*")) { return new MatchAllDocsQueryNode(); } } (MatchAllDocsQueryNodeProcessor.java:44-47). It does not look at the parent, so the bound becomes a match-all node, and QueryNodeProcessorImpl writes it back into the range node (QueryNodeProcessorImpl.java:111-123). The class javadoc is narrower: it "converts every WildcardQueryNode that is "*:*"" (:28-30).
4. The cast. OpenRangeQueryNodeProcessor reads FieldQueryNode lowerNode = rangeNode.getLowerBound(); FieldQueryNode upperNode = rangeNode.getUpperBound(); (OpenRangeQueryNodeProcessor.java:39-40). The getter is return (T) getChildren().get(1); with T extends FieldValuePairQueryNode<?> (AbstractRangeQueryNode.java:33, :96-99); its erased checkcast to FieldValuePairQueryNode throws, because a MatchAllDocsQueryNode is not one.
5. Not converted. QueryParserHelper.parse runs the parser, the processors and the builder with no catch (QueryParserHelper.java:213-223). The grammar's own parse rethrows a ParseException (already a QueryNodeParseException) and wraps an Error into one (.jj:99-113), but this exception comes later, from the processor phase.

Two documents: doc 0 has the field * = b, doc 1 has the field f = b; default field f.

The study's 14 trigger strings, re-run on 645d4fe14a20, all throw: *>a, *<a, *>=a, *<=a, *:[a TO *], *:[* TO a], *:{a TO *}, *:[* TO *], x AND *>a, *>"a b", *>5, \*>a, *:[a TO \*] and *>a*. The escaped forms fail because toString() of an escaped \* is *.

• Who is hit. Applications that pass query text to the flexible StandardQueryParser: default pipeline, no index and no configuration needed. Run with no analyzer and with StandardAnalyzer; the analyzer processor runs only after the one that throws.
• What goes wrong. Code that catches QueryNodeException to answer "invalid query" gets an unexpected ClassCastException instead. What happens next depends on the application; one that catches nothing else answers that request with a generic server error.
• When. A user who writes * to mean "any field" (the parser maps *:* to match-all) and adds a range, such as *:[a TO *] or *>5, hits it. So does any open range typed without a field, such as [a TO *], in an application whose default field is *.
• Limits. Deterministic and immediate. The failure happens while parsing, before any search or index access: no wrong results, no hang, no resource growth. The likelihood is rated rare, and the recorded searches found no matching public report, 17 years after 2.9.0.

The test sits in the flexible parser's test package, as Lucene's own parser tests do, but uses no package-private member. Nothing in it is randomized; 5 random-seed iterations fail 5 of 5 with the same message.

As the regression test it needs one lint change: ecjLintTest rejects the unused catch parameter e ("The value of the exception parameter e is not used"), so the in-tree copy uses catch (@SuppressWarnings("unused") QueryNodeException e), as QueryParserBase.java:803-805 does. With that change it fails on stock, passes with the recommended fix and passes :lucene:queryparser:check -x test.

The other shapes of the same root cause (*:[a TO *], *:[* TO *], [a TO *] with the default field *) are covered by the table above, not by the test.

TestStarFieldOpenRange > testOpenRangeOnStarField FAILED
    java.lang.AssertionError: expected a Query or QueryNodeException, but parse threw java.lang.ClassCastException: class org.apache.lucene.queryparser.flexible.core.nodes.MatchAllDocsQueryNode cannot be cast to class org.apache.lucene.queryparser.flexible.core.nodes.FieldValuePairQueryNode (org.apache.lucene.queryparser.flexible.core.nodes.MatchAllDocsQueryNode and org.apache.lucene.queryparser.flexible.core.nodes.FieldValuePairQueryNode are in unnamed module of loader 'app')
        at __randomizedtesting.SeedInfo.seed([DEADBEEF:3A3036066A125B29]:0)
        at org.apache.lucene.queryparser.flexible.standard.TestStarFieldOpenRange.testOpenRangeOnStarField(TestStarFieldOpenRange.java:30)

        Caused by:
        java.lang.ClassCastException: class org.apache.lucene.queryparser.flexible.core.nodes.MatchAllDocsQueryNode cannot be cast to class org.apache.lucene.queryparser.flexible.core.nodes.FieldValuePairQueryNode (...)
            at org.apache.lucene.queryparser.flexible.standard.nodes.AbstractRangeQueryNode.getUpperBound(AbstractRangeQueryNode.java:98)
            at org.apache.lucene.queryparser.flexible.standard.processors.OpenRangeQueryNodeProcessor.postProcessNode(OpenRangeQueryNodeProcessor.java:40)
            at org.apache.lucene.queryparser.flexible.core.processors.QueryNodeProcessorImpl.processIteration(QueryNodeProcessorImpl.java:89)
            at org.apache.lucene.queryparser.flexible.core.processors.QueryNodeProcessorImpl.process(QueryNodeProcessorImpl.java:81)
            at org.apache.lucene.queryparser.flexible.core.processors.QueryNodeProcessorPipeline.process(QueryNodeProcessorPipeline.java:78)
            at org.apache.lucene.queryparser.flexible.core.QueryParserHelper.parse(QueryParserHelper.java:219)
            at org.apache.lucene.queryparser.flexible.standard.StandardQueryParser.parse(StandardQueryParser.java:279)
            at org.apache.lucene.queryparser.flexible.standard.TestStarFieldOpenRange.testOpenRangeOnStarField(TestStarFieldOpenRange.java:26)
:lucene:queryparser:test (FAILURE): 1 test, 1  failure

• The declared failure is QueryNodeException: StandardQueryParser#parse (:274) and QueryParserHelper#parse (:211), "if something wrong happens along the three phases". No javadoc or MIGRATE entry mentions ClassCastException for the parser, none of the five ClassCastException entries in CHANGES is about a query parser, and nothing reserves * as a field name for ranges.
• * is an ordinary field elsewhere. *:b gives TermQuery *:b and *:[a TO c] a TermRangeQuery, 1 hit each. The class javadoc says the syntax is borrowed from the classic parser (StandardQueryParser.java:63-65), which builds working range queries for *:[a TO *], *:[* TO z] and *:[* TO *], and whose testStarParsing asserts that *:foo is a TermQuery on the field * (TestQueryParser.java:275-278).
• The processor does more than its javadoc says: "converts every WildcardQueryNode that is "*:*"" (MatchAllDocsQueryNodeProcessor.java:28-30), while the code matches any FieldQueryNode (:44). Range bounds are never wildcard nodes: WildcardQueryNodeProcessor skips them (:96-103).
• Sibling guards. WildcardQueryNodeProcessor: "do not process wildcards for TermRangeQueryNode children ... to reproduce the old parser behavior" (:96-98). AnalyzerQueryNodeProcessor: !(node.getParent() instanceof RangeQueryNode) (:110). PointQueryNodeProcessor: "FieldQueryNodes children of a RangeQueryNode are ignored" (:46, guard :63).
• The node's own type. TermRangeQueryNode extends AbstractRangeQueryNode<FieldQueryNode>, "a range query composed by FieldQueryNode bounds" (TermRangeQueryNode.java:21-28).
• History. The 2009 framework commit 343992fcbb4 matched only WildcardQueryNode; 16 days later 565a6d22b5f (LUCENE-1792, about rewrite methods for multi-term queries) widened the test to FieldQueryNode without updating the javadoc, and its 25-comment discussion (#2867) never mentions match-all. Its parent commit passes the probe; the commit fails; the commit with only that hunk reverted passes.
• Precedent. #5175 (LUCENE-4103), "AnalyzerQueryNodeProcessor throws a class cast exception with the RegexpQueryNode", was fixed in 2012 with a one-line node-type guard (5fb2e4a751e).

The strongest case for "intended" (the cross-model reviewer's, which it rated weak itself): * in the field position may be a match-all sentinel, so a range over "all fields" is meaningless input, and @throws QueryNodeException does not promise that no unchecked exception escapes.

Why it fails: the parser treats * as a field name everywhere else (*:b, *:[a TO c]), and so do the classic parser and its tests; the documented match-all special case is the whole query *:* (CHANGES, LUCENE-723; TestQPHelper.testMatchAllDocs), which the fix keeps; even for invalid input the answer would be a QueryNodeException, not a ClassCastException from an erased generic cast; and the sibling guards and the 2012 precedent show upstream treats this kind of defect as a bug. Verdict: not intended, a defect.

The recommended fix is the study verifier's; it touches one file and needs no grammar regeneration. The open choice for maintainers is what a range on the field * should give: a range on a field literally named * (the recommended fix, as in the classic parser) or a QueryNodeException (the third option). The repro test accepts either.

In MatchAllDocsQueryNodeProcessor.postProcessNode (:44), the same guard AnalyzerQueryNodeProcessor (:110) and PointQueryNodeProcessor (:63) use. A bound * on the field * stays a field node, so OpenRangeQueryNodeProcessor makes it an open side as for any other field: *>a gives TermRangeQuery *:{a TO *], the bracket forms give the classic parser's range and hit count, and *:* stays MatchAllDocsQuery (2 hits of 2).

+import org.apache.lucene.queryparser.flexible.core.nodes.RangeQueryNode;
 ...
-    if (node instanceof FieldQueryNode fqn) {
+    if (node instanceof FieldQueryNode fqn && !(node.getParent() instanceof RangeQueryNode)) {
       if (fqn.getField().toString().equals("*") && fqn.getText().toString().equals("*")) {
         return new MatchAllDocsQueryNode();

Trade-offs

• Ranges on the field * now parse as ranges on a field literally named *, as in the classic parser. They failed before, so no working behaviour is lost; a user who meant "any field" gets a range on *, which usually matches nothing.
• Optional and cosmetic: make the class javadoc say what the code does (every FieldQueryNode *:* except range bounds). Not part of the validated diff.
• A CHANGES entry under Bug Fixes would fit.

What the checks validated

Scratch worktree of 645d4fe14a20, gradle, seed DEADBEEF: the repro fails on stock and passes with the fix, with assertions on and off; the whole :lucene:queryparser:test, 534 tests, 1 skipped, 0 failures; with the lint-clean regression test, :lucene:queryparser:check -x test passes. With the patched classes placed ahead of the release jars on the classpath, a probe of 17 trigger calls (and 10 controls) gives 0 undeclared exceptions, and 13 upstream flexible-parser test classes (154 tests) are unchanged.

Range bounds are never wildcard nodes (WildcardQueryNodeProcessor.java:96-103 skips them), so this keeps them out too.

-    if (node instanceof FieldQueryNode fqn) {
+    if (node instanceof WildcardQueryNode fqn) {

Trade-offs

It changes more than the bug: by reading the code, an escaped *:\* or a quoted *:"*" is a plain or quoted field node that the current test turns into match-all, and would not be after this change. It needs its own tests and a decision on those inputs.

What the checks validated

Not run.

Check the bound types in OpenRangeQueryNodeProcessor (or in the AbstractRangeQueryNode getters) and throw a QueryNodeException when a bound is not a field node.

Trade-offs

Gives the declared exception, but rejects input the classic parser accepts, and leaves the broken range node for later processors and for custom pipelines that reorder them.

What the checks validated

Not run.

Catch RuntimeException around the three phases (QueryParserHelper.java:213-223) and rethrow it as a QueryNodeException.

Trade-offs

Hides this and other separate defects of the same parser behind one generic message, changes behaviour for every caller, and leaves the broken tree in place.

What the checks validated

Not run.

Method: non-formal baseline of the study (fuzzing).

• The fuzzer, QueryParserFuzzer, fed generated strings to the classic, flexible and simple query parsers. Its oracle: each parser may only throw its documented exception, and a parsed query must survive toString, equals, count and rewrite. It ran for 1.5 + 7 + 20 minutes, about 470,000 executions, and produced five query-parser findings; this is one of them.
• An independent AI verifier (same model family) wrote its own 6-test JUnit class and a version probe: 14 trigger strings failed on main 7cecf79523, and 6 of them on 8.11.4, 9.12.3 and 10.1.0, while the controls parsed; removing MatchAllDocsQueryNodeProcessor from the pipeline removed every exception, and a range-aware replacement made all 14 parse while keeping *:* as match-all.
• Later checks cut the repro to one test (2026-10-29 noise audit), re-ran it on 645d4fe14a20 and on releases, dated the bug to 2009 by building commits and running all 150 releases, and validated the fix with gradle.