Skip to content

Commit 6f04834

Browse files
mtrezzamtrezza
committed
Merge remote-tracking branch 'upstream/master'
2 parents e680e4a + 834ae36 commit 6f04834

File tree

8 files changed

+151
-35
lines changed

8 files changed

+151
-35
lines changed

‎.github/workflows/ci.yml

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
branches:
88
- '**'
99
env:
10-
NODE_VERSION: 14.17.6
10+
NODE_VERSION: 14.18.0
1111
PARSE_SERVER_TEST_TIMEOUT: 20000
1212
jobs:
1313
check-ci:
@@ -103,43 +103,43 @@ jobs:
103103
matrix:
104104
include:
105105
- name: MongoDB 5.0, ReplicaSet, WiredTiger
106-
MONGODB_VERSION: 5.0.2
106+
MONGODB_VERSION: 5.0.3
107107
MONGODB_TOPOLOGY: replicaset
108108
MONGODB_STORAGE_ENGINE: wiredTiger
109-
NODE_VERSION: 14.17.6
109+
NODE_VERSION: 14.18.0
110110
- name: MongoDB 4.4, ReplicaSet, WiredTiger
111-
MONGODB_VERSION: 4.4.8
111+
MONGODB_VERSION: 4.4.9
112112
MONGODB_TOPOLOGY: replicaset
113113
MONGODB_STORAGE_ENGINE: wiredTiger
114-
NODE_VERSION: 14.17.6
114+
NODE_VERSION: 14.18.0
115115
- name: MongoDB 4.2, ReplicaSet, WiredTiger
116-
MONGODB_VERSION: 4.2.16
116+
MONGODB_VERSION: 4.2.17
117117
MONGODB_TOPOLOGY: replicaset
118118
MONGODB_STORAGE_ENGINE: wiredTiger
119-
NODE_VERSION: 14.17.6
119+
NODE_VERSION: 14.18.0
120120
- name: MongoDB 4.0, ReplicaSet, WiredTiger
121121
MONGODB_VERSION: 4.0.27
122122
MONGODB_TOPOLOGY: replicaset
123123
MONGODB_STORAGE_ENGINE: wiredTiger
124-
NODE_VERSION: 14.17.6
124+
NODE_VERSION: 14.18.0
125125
- name: MongoDB 4.0, Standalone, MMAPv1
126126
MONGODB_VERSION: 4.0.27
127127
MONGODB_TOPOLOGY: standalone
128128
MONGODB_STORAGE_ENGINE: mmapv1
129-
NODE_VERSION: 14.17.6
129+
NODE_VERSION: 14.18.0
130130
- name: Redis Cache
131131
PARSE_SERVER_TEST_CACHE: redis
132-
MONGODB_VERSION: 4.4.8
132+
MONGODB_VERSION: 4.4.9
133133
MONGODB_TOPOLOGY: standalone
134134
MONGODB_STORAGE_ENGINE: wiredTiger
135-
NODE_VERSION: 14.17.6
135+
NODE_VERSION: 14.18.0
136136
- name: Node 12
137-
MONGODB_VERSION: 4.4.8
137+
MONGODB_VERSION: 4.4.9
138138
MONGODB_TOPOLOGY: standalone
139139
MONGODB_STORAGE_ENGINE: wiredTiger
140140
NODE_VERSION: 12.22.6
141141
- name: Node 15
142-
MONGODB_VERSION: 4.4.8
142+
MONGODB_VERSION: 4.4.9
143143
MONGODB_TOPOLOGY: standalone
144144
MONGODB_STORAGE_ENGINE: wiredTiger
145145
NODE_VERSION: 15.14.0
@@ -184,16 +184,16 @@ jobs:
184184
include:
185185
- name: PostgreSQL 11, PostGIS 3.0
186186
POSTGRES_IMAGE: postgis/postgis:11-3.0
187-
NODE_VERSION: 14.17.6
187+
NODE_VERSION: 14.18.0
188188
- name: PostgreSQL 11, PostGIS 3.1
189189
POSTGRES_IMAGE: postgis/postgis:11-3.1
190-
NODE_VERSION: 14.17.6
190+
NODE_VERSION: 14.18.0
191191
- name: PostgreSQL 12, PostGIS 3.1
192192
POSTGRES_IMAGE: postgis/postgis:12-3.1
193-
NODE_VERSION: 14.17.6
193+
NODE_VERSION: 14.18.0
194194
- name: PostgreSQL 13, PostGIS 3.1
195195
POSTGRES_IMAGE: postgis/postgis:13-3.1
196-
NODE_VERSION: 14.17.6
196+
NODE_VERSION: 14.18.0
197197
fail-fast: false
198198
name: ${{ matrix.name }}
199199
timeout-minutes: 15

‎CHANGELOG.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ Jump directly to a version:
44

55
| 4.x |
66
|--------------------------------------|
7-
| [**4.10.3 (latest release)**](#4103) |
7+
| [**4.10.4 (latest release)**](#4104) |
8+
| [4.10.3](#4103) |
89
| [4.10.2](#4102) |
910
| [4.10.1](#4101) |
1011
| [4.10.0](#4100) |
@@ -94,7 +95,7 @@ Jump directly to a version:
9495
___
9596

9697
## Unreleased (Master Branch)
97-
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.3...master)
98+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.4...master)
9899

99100
### Breaking Changes
100101
- Improved schema caching through database real-time hooks. Reduces DB queries, decreases Parse Query execution time and fixes a potential schema memory leak. If multiple Parse Server instances connect to the same DB (for example behind a load balancer), set the [Parse Server Option](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) `databaseOptions.enableSchemaHooks: true` to enable this feature and keep the schema in sync across all instances. Failing to do so will cause a schema change to not propagate to other instances and re-syncing will only happen when these instances restart. The options `enableSingleSchemaCache` and `schemaCacheTTL` have been removed. To use this feature with MongoDB, a replica set cluster with [change stream](https://docs.mongodb.com/manual/changeStreams/#availability) support is required. (Diamond Lewis, SebC) [#7214](https://github.com/parse-community/parse-server/issues/7214)
@@ -156,6 +157,12 @@ ___
156157
- Allow cloud string for ES modules (Daniel Blyth) [#7560](https://github.com/parse-community/parse-server/pull/7560)
157158
- docs: Introduce deprecation ID for reference in comments and online search (Manuel Trezza) [#7562](https://github.com/parse-community/parse-server/pull/7562)
158159

160+
## 4.10.4
161+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.3...4.10.4)
162+
163+
### Security Fixes
164+
- Strip out sessionToken when LiveQuery is used on Parse.User (Daniel Blyth) [GHSA-7pr3-p5fm-8r9x](https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x)
165+
159166
## 4.10.3
160167
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.2...4.10.3)
161168

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ Parse Server is continuously tested with the most recent releases of Node.js to
115115
| Version | Latest Version | End-of-Life Date | Compatibility |
116116
|------------|----------------|------------------|--------------------|
117117
| Node.js 12 | 12.22.6 | April 2022 | ✅ Fully compatible |
118-
| Node.js 14 | 14.17.6 | April 2023 | ✅ Fully compatible |
118+
| Node.js 14 | 14.18.0 | April 2023 | ✅ Fully compatible |
119119
| Node.js 15 | 15.14.0 | June 2021 | ✅ Fully compatible |
120120

121121
#### MongoDB
@@ -124,9 +124,9 @@ Parse Server is continuously tested with the most recent releases of MongoDB to
124124
| Version | Latest Version | End-of-Life Date | Compatibility |
125125
|-------------|----------------|------------------|--------------------|
126126
| MongoDB 4.0 | 4.0.27 | April 2022 | ✅ Fully compatible |
127-
| MongoDB 4.2 | 4.2.16 | TBD | ✅ Fully compatible |
128-
| MongoDB 4.4 | 4.4.8 | TBD | ✅ Fully compatible |
129-
| MongoDB 5.0 | 5.0.2 | January 2024 | ✅ Fully compatible |
127+
| MongoDB 4.2 | 4.2.17 | TBD | ✅ Fully compatible |
128+
| MongoDB 4.4 | 4.4.9 | TBD | ✅ Fully compatible |
129+
| MongoDB 5.0 | 5.0.3 | January 2024 | ✅ Fully compatible |
130130

131131
#### PostgreSQL
132132
Parse Server is continuously tested with the most recent releases of PostgreSQL and PostGIS to ensure compatibility, using [PostGIS docker images](https://registry.hub.docker.com/r/postgis/postgis/tags?page=1&ordering=last_updated). We follow the [PostgreSQL support schedule](https://www.postgresql.org/support/versioning) and [PostGIS support schedule](https://www.postgis.net/eol_policy/) and only test against versions that are officially supported and have not reached their end-of-life date. Due to the extensive PostgreSQL support duration of 5 years, Parse Server drops support if a version is older than 3.5 years and a newer version has been available for at least 2.5 years.

‎package-lock.json

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "parse-server",
3-
"version": "4.10.3",
3+
"version": "4.10.4",
44
"description": "An express module providing a Parse-compatible API server",
55
"main": "lib/index.js",
66
"repository": {
@@ -33,7 +33,7 @@
3333
"deepcopy": "2.1.0",
3434
"express": "4.17.1",
3535
"follow-redirects": "1.14.1",
36-
"graphql": "15.5.2",
36+
"graphql": "15.5.3",
3737
"graphql-list-fields": "2.0.2",
3838
"graphql-relay": "0.8.0",
3939
"graphql-tag": "2.12.5",
@@ -113,14 +113,14 @@
113113
"test:mongodb:testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=$npm_config_dbversion} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
114114
"test:mongodb": "npm run test:mongodb:runnerstart --dbversion=$npm_config_dbversion && npm run test:mongodb:testonly --dbversion=$npm_config_dbversion",
115115
"test:mongodb:4.0.27": "npm run test:mongodb --dbversion=4.0.27",
116-
"test:mongodb:4.2.16": "npm run test:mongodb --dbversion=4.2.16",
117-
"test:mongodb:4.4.8": "npm run test:mongodb --dbversion=4.4.8",
116+
"test:mongodb:4.2.17": "npm run test:mongodb --dbversion=4.2.17",
117+
"test:mongodb:4.4.9": "npm run test:mongodb --dbversion=4.4.9",
118118
"posttest:mongodb": "mongodb-runner stop",
119-
"pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
120-
"testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
119+
"pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
120+
"testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
121121
"test": "npm run testonly",
122-
"posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
123-
"coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
122+
"posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
123+
"coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
124124
"start": "node ./bin/parse-server",
125125
"prettier": "prettier --write {src,spec}/{**/*,*}.js",
126126
"prepare": "npm run build",

‎spec/ParseLiveQuery.spec.js

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -840,6 +840,52 @@ describe('ParseLiveQuery', function () {
840840
done();
841841
});
842842

843+
it('should strip out session token in LiveQuery', async () => {
844+
await reconfigureServer({
845+
liveQuery: { classNames: ['_User'] },
846+
startLiveQueryServer: true,
847+
verbose: false,
848+
silent: true,
849+
});
850+
851+
const user = new Parse.User();
852+
user.setUsername('username');
853+
user.setPassword('password');
854+
user.set('foo', 'bar');
855+
856+
const query = new Parse.Query(Parse.User);
857+
query.equalTo('foo', 'bar');
858+
const subscription = await query.subscribe();
859+
860+
const events = ['create', 'update', 'enter', 'leave', 'delete'];
861+
const response = (obj, prev) => {
862+
expect(obj.get('sessionToken')).toBeUndefined();
863+
expect(obj.sessionToken).toBeUndefined();
864+
expect(prev?.sessionToken).toBeUndefined();
865+
if (prev && prev.get) {
866+
expect(prev.get('sessionToken')).toBeUndefined();
867+
}
868+
};
869+
const calls = {};
870+
for (const key of events) {
871+
calls[key] = response;
872+
spyOn(calls, key).and.callThrough();
873+
subscription.on(key, calls[key]);
874+
}
875+
await user.signUp();
876+
user.unset('foo');
877+
await user.save();
878+
user.set('foo', 'bar');
879+
await user.save();
880+
user.set('yolo', 'bar');
881+
await user.save();
882+
await user.destroy();
883+
await new Promise(resolve => process.nextTick(resolve));
884+
for (const key of events) {
885+
expect(calls[key]).toHaveBeenCalled();
886+
}
887+
});
888+
843889
afterEach(async function (done) {
844890
const client = await Parse.CoreManager.getLiveQueryController().getDefaultLiveQueryClient();
845891
client.close();

‎spec/ParseUser.spec.js

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3966,6 +3966,51 @@ describe('Parse.User testing', () => {
39663966
ok(model._isLinked('facebook'), 'User should be linked to facebook');
39673967
});
39683968
});
3969+
3970+
it('should strip out authdata in LiveQuery', async () => {
3971+
const provider = getMockFacebookProvider();
3972+
Parse.User._registerAuthenticationProvider(provider);
3973+
3974+
await reconfigureServer({
3975+
liveQuery: { classNames: ['_User'] },
3976+
startLiveQueryServer: true,
3977+
verbose: false,
3978+
silent: true,
3979+
});
3980+
3981+
const query = new Parse.Query(Parse.User);
3982+
query.doesNotExist('foo');
3983+
const subscription = await query.subscribe();
3984+
3985+
const events = ['create', 'update', 'enter', 'leave', 'delete'];
3986+
const response = (obj, prev) => {
3987+
expect(obj.get('authData')).toBeUndefined();
3988+
expect(obj.authData).toBeUndefined();
3989+
expect(prev?.authData).toBeUndefined();
3990+
if (prev && prev.get) {
3991+
expect(prev.get('authData')).toBeUndefined();
3992+
}
3993+
};
3994+
const calls = {};
3995+
for (const key of events) {
3996+
calls[key] = response;
3997+
spyOn(calls, key).and.callThrough();
3998+
subscription.on(key, calls[key]);
3999+
}
4000+
const user = await Parse.User._logInWith('facebook');
4001+
4002+
user.set('foo', 'bar');
4003+
await user.save();
4004+
user.unset('foo');
4005+
await user.save();
4006+
user.set('yolo', 'bar');
4007+
await user.save();
4008+
await user.destroy();
4009+
await new Promise(resolve => process.nextTick(resolve));
4010+
for (const key of events) {
4011+
expect(calls[key]).toHaveBeenCalled();
4012+
}
4013+
});
39694014
});
39704015

39714016
describe('Security Advisory GHSA-8w3j-g983-8jh5', function () {

‎src/LiveQuery/ParseLiveQueryServer.js

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,14 @@ class ParseLiveQueryServer {
186186
deletedParseObject = res.object.toJSON();
187187
deletedParseObject.className = className;
188188
}
189+
if (
190+
(deletedParseObject.className === '_User' ||
191+
deletedParseObject.className === '_Session') &&
192+
!client.hasMasterKey
193+
) {
194+
delete deletedParseObject.sessionToken;
195+
delete deletedParseObject.authData;
196+
}
189197
client.pushDelete(requestId, deletedParseObject);
190198
} catch (error) {
191199
Client.pushError(
@@ -337,6 +345,16 @@ class ParseLiveQueryServer {
337345
originalParseObject = res.original.toJSON();
338346
originalParseObject.className = res.original.className || className;
339347
}
348+
if (
349+
(currentParseObject.className === '_User' ||
350+
currentParseObject.className === '_Session') &&
351+
!client.hasMasterKey
352+
) {
353+
delete currentParseObject.sessionToken;
354+
delete originalParseObject?.sessionToken;
355+
delete currentParseObject.authData;
356+
delete originalParseObject?.authData;
357+
}
340358
const functionName = 'push' + res.event.charAt(0).toUpperCase() + res.event.slice(1);
341359
if (client[functionName]) {
342360
client[functionName](requestId, currentParseObject, originalParseObject);

0 commit comments

Comments
 (0)