arangodb
diff --git a/‎CHANGELOG
Lines changed: 5 additions & 0 deletions b/‎CHANGELOG
Lines changed: 5 additions & 0 deletions
diff --git a/‎arangod/Aql/Ast.cpp
Lines changed: 17 additions & 0 deletions b/‎arangod/Aql/Ast.cpp
Lines changed: 17 additions & 0 deletions
diff --git a/‎arangod/Aql/Ast.h
Lines changed: 3 additions & 0 deletions b/‎arangod/Aql/Ast.h
Lines changed: 3 additions & 0 deletions
diff --git a/‎arangod/Aql/AstNode.h
Lines changed: 1 addition & 0 deletions b/‎arangod/Aql/AstNode.h
Lines changed: 1 addition & 0 deletions
@@ -1,6 +1,11 @@
 v3.4.9 (XXX-XX-XX)
 -------------------
 
+* Disallow the usage of subqueries inside AQL traversal PRUNE conditions.
+  Using subqueries inside PRUNE conditions causes undefined behavior,
+  so such queries will now be aborted early on with a parse error 
+  instead of running into undefined behavior.
+
 * Fixed search not working in document view while in code mode.
 
 * Fixed issue #10090: fix repeatable seek to the same document in
 
@@ -743,6 +743,23 @@ AstNode* Ast::createNodeReference(Variable const* variable) {
   return node;
 }
 
+/// @brief create an AST subquery reference node
+AstNode* Ast::createNodeSubqueryReference(std::string const& variableName) {
+  AstNode* node = createNode(NODE_TYPE_REFERENCE);
+  node->setFlag(AstNodeFlagType::FLAG_SUBQUERY_REFERENCE);
+
+  auto variable = _scopes.getVariable(variableName);
+
+  if (variable == nullptr) {
+    THROW_ARANGO_EXCEPTION_MESSAGE(TRI_ERROR_INTERNAL,
+                                   "variable not found in reference AstNode");
+  }
+
+  node->setData(variable);
+
+  return node;
+}
+
 /// @brief create an AST variable access
 AstNode* Ast::createNodeAccess(Variable const* variable,
                                std::vector<basics::AttributeName> const& field) {
 
@@ -246,6 +246,9 @@ class Ast {
   /// @brief create an AST reference node
   AstNode* createNodeReference(Variable const* variable);
 
+  /// @brief create an AST subquery reference node
+  AstNode* createNodeSubqueryReference(std::string const& variableName);
+
   /// @brief create an AST parameter node for a value literal
   AstNode* createNodeParameter(char const* name, size_t length);
 
 
@@ -71,6 +71,7 @@ enum AstNodeFlagType : AstNodeFlagsType {
   FLAG_KEEP_VARIABLENAME = 0x0010000,  // node is a reference to a variable name, not the variable value (used in KEEP nodes)
   FLAG_BIND_PARAMETER = 0x0020000,     // node was created from a bind parameter
   FLAG_FINALIZED = 0x0040000,  // node has been finalized and should not be modified; only set and checked in maintainer mode
+  FLAG_SUBQUERY_REFERENCE = 0x0080000,  // node references a subquery
 };
 
 /// @brief enumeration of AST node value types