Skip to content

Commit 8aa6963

Browse files
mtrezzamtrezza
committed
Merge remote-tracking branch 'upstream/master' into FileSecurity2
2 parents 81b0de5 + c46e8a5 commit 8aa6963

File tree

11 files changed

+348
-20
lines changed

11 files changed

+348
-20
lines changed

‎.github/ISSUE_TEMPLATE/---1-report-an-issue.md

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ assignees: ''
88
---
99

1010
### New Issue Checklist
11-
<!-- Please check the following boxes [ ] -> [x] before submitting your issue. Click the "Preview" tab for better readability. Thanks for reporting issues back to Parse Server! -->
11+
<!--
12+
Please check the following boxes [x] before submitting your issue.
13+
Click the "Preview" tab for better readability.
14+
Thanks for contributing to Parse Server!
15+
-->
1216

1317
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
1418
- [ ] I am not just asking a [question](https://github.com/parse-community/.github/blob/master/SUPPORT.md).
@@ -27,6 +31,16 @@ assignees: ''
2731
### Expected Outcome
2832
<!-- What outcome, for example query result, did you expect? -->
2933

34+
### Failing Test Case / Pull Request
35+
<!--
36+
Check one of the following boxes [x] if you added a PR and add the link.
37+
See the contribution guide for how add a test cases:
38+
https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md
39+
-->
40+
41+
- [ ] 🤩 I submitted a PR with a fix and a test case.
42+
- [ ] 🧐 I submitted a PR with a failing test case.
43+
3044
### Environment
3145
<!-- Be specific with versions, don't use "latest" or semver ranges like "~x.y.z" or "^x.y.z". -->
3246

‎.github/ISSUE_TEMPLATE/---2-feature-request.md

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,28 @@ assignees: ''
77

88
---
99

10-
**Is your feature request related to a problem? Please describe.**
11-
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
10+
### New Feature / Enhancement Checklist
11+
<!--
12+
Please check the following boxes [x] before submitting your issue.
13+
Click the "Preview" tab for better readability.
14+
Thanks for contributing to Parse Server!
15+
-->
1216

13-
**Describe the solution you'd like**
14-
A clear and concise description of what you want to happen.
17+
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
18+
- [ ] I am not just asking a [question](https://github.com/parse-community/.github/blob/master/SUPPORT.md).
19+
- [ ] I have searched through [existing issues](https://github.com/parse-community/parse-server/issues?q=is%3Aissue).
1520

16-
**Describe alternatives you've considered**
17-
A clear and concise description of any alternative solutions or features you've considered.
21+
### Current Limitation
22+
<!-- Which current limitation is the feature or enhancement addressing? -->
1823

19-
**Additional context**
20-
Add any other context or screenshots about the feature request here.
24+
### Feature / Enhancement Description
25+
<!-- What is the concept of the functionality and how should it be implemented? -->
26+
27+
### Example Use Case
28+
<!-- What is an example use case in steps (1. / 2. / 3. / etc.) that describes the functionality? -->
29+
30+
### Alternatives / Workarounds
31+
<!-- Which alternatives or workarounds exist currently? -->
32+
33+
### 3rd Party References
34+
<!-- Have you seen a similar functionality provided somewhere else? -->

‎.github/pull_request_template.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
### New Pull Request Checklist
2+
<!--
3+
Please check the following boxes [x] before submitting your issue.
4+
Click the "Preview" tab for better readability.
5+
Thanks for contributing to Parse Server!
6+
-->
7+
8+
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
9+
- [ ] I am creating this PR in reference to an [issue](https://github.com/parse-community/parse-server/issues?q=is%3Aissue).
10+
11+
### Issue Description
12+
<!-- Add a brief description of the issue this PR solves. -->
13+
14+
Related issue: FILL_THIS_OUT
15+
16+
### Approach
17+
<!-- Add a description of the approach in this PR. -->
18+
19+
### TODOs before merging
20+
<!--
21+
Add TODOs that need to be completed before merging this PR.
22+
Delete suggested TODOs that do not apply to this PR.
23+
-->
24+
25+
- [ ] Add test cases
26+
- [ ] Add entry to changelog
27+
- [ ] Add changes to documentation (guides, repository pages, in-code descriptions)
28+
- [ ] Add [security check](https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md#security-checks)
29+
- [ ] Add new Parse Error codes to Parse JS SDK <!-- no hard-coded error codes in Parse Server -->
30+
- [ ] ...

‎.github/workflows/release.yml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: release
2+
on:
3+
release:
4+
types: [published]
5+
jobs:
6+
publish-npm:
7+
runs-on: ubuntu-18.04
8+
steps:
9+
- uses: actions/checkout@v2
10+
- uses: actions/setup-node@v1
11+
with:
12+
node-version: '10.14'
13+
registry-url: https://registry.npmjs.org/
14+
- name: Cache Node.js modules
15+
uses: actions/cache@v2
16+
with:
17+
path: ~/.npm
18+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
19+
restore-keys: |
20+
${{ runner.os }}-node-
21+
- run: npm ci
22+
- run: npm publish
23+
env:
24+
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
25+
publish-docs:
26+
runs-on: ubuntu-18.04
27+
timeout-minutes: 30
28+
steps:
29+
- uses: actions/checkout@v2
30+
- name: Use Node.js
31+
uses: actions/setup-node@v1
32+
with:
33+
node-version: '10.14'
34+
- name: Cache Node.js modules
35+
uses: actions/cache@v2
36+
with:
37+
path: ~/.npm
38+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
39+
restore-keys: |
40+
${{ runner.os }}-node-
41+
- name: Get Tag
42+
uses: actions/github-script@v3
43+
id: tag
44+
with:
45+
github-token: ${{secrets.GITHUB_TOKEN}}
46+
result-encoding: string
47+
script: |
48+
const ref = process.env.GITHUB_REF
49+
if(!ref.startsWith('refs/tags/'))
50+
return ''
51+
return ref.replace(/^refs\/tags\//, '')
52+
- name: Generate Docs
53+
run: |
54+
echo $SOURCE_TAG
55+
npm ci
56+
./release_docs.sh
57+
env:
58+
SOURCE_TAG: ${{ steps.tag.outputs.result }}
59+
- name: Deploy
60+
uses: peaceiris/[email protected]
61+
with:
62+
github_token: ${{ secrets.GITHUB_TOKEN }}
63+
publish_dir: ./docs

‎CHANGELOG.md

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,30 @@
11
## Parse Server Changelog
22

33
### master
4-
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.4.0...master)
4+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.5.0...master)
5+
- IMPROVE: Optimize queries on classes with pointer permissions. [#7061](https://github.com/parse-community/parse-server/pull/7061). Thanks to [Pedro Diaz](https://github.com/pdiaz)
6+
7+
### 4.5.0
8+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.4.0...4.5.0)
9+
10+
__BREAKING CHANGES:__
11+
- FIX: Consistent casing for afterLiveQueryEvent. The afterLiveQueryEvent was introduced in 4.4.0 with inconsistent casing for the event names, which was fixed in 4.5.0. [#7023](https://github.com/parse-community/parse-server/pull/7023). Thanks to [dblythy](https://github.com/dblythy).
12+
___
13+
- FIX: Properly handle serverURL and publicServerUrl in Batch requests. [#7049](https://github.com/parse-community/parse-server/pull/7049). Thanks to [Zach Goldberg](https://github.com/ZachGoldberg).
14+
- IMPROVE: Prevent invalid column names (className and length). [#7053](https://github.com/parse-community/parse-server/pull/7053). Thanks to [Diamond Lewis](https://github.com/dplewis).
15+
- IMPROVE: GraphQL: Remove viewer from logout mutation. [#7029](https://github.com/parse-community/parse-server/pull/7029). Thanks to [Antoine Cormouls](https://github.com/Moumouls).
16+
- IMPROVE: GraphQL: Optimize on Relation. [#7044](https://github.com/parse-community/parse-server/pull/7044). Thanks to [Antoine Cormouls](https://github.com/Moumouls).
17+
- NEW: Include sessionToken in onLiveQueryEvent. [#7043](https://github.com/parse-community/parse-server/pull/7043). Thanks to [dblythy](https://github.com/dblythy).
18+
- FIX: Definitions for accountLockout and passwordPolicy. [#7040](https://github.com/parse-community/parse-server/pull/7040). Thanks to [dblythy](https://github.com/dblythy).
19+
- FIX: Fix typo in server definitions for emailVerifyTokenReuseIfValid. [#7037](https://github.com/parse-community/parse-server/pull/7037). Thanks to [dblythy](https://github.com/dblythy).
20+
- SECURITY FIX: LDAP auth stores password in plain text. See [GHSA-4w46-w44m-3jq3](https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3) for more details about the vulnerability and [da905a3](https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a) for the fix. Thanks to [Fabian Strachanski](https://github.com/fastrde).
21+
- NEW: Reuse tokens if they haven't expired. [#7017](https://github.com/parse-community/parse-server/pull/7017). Thanks to [dblythy](https://github.com/dblythy).
22+
- NEW: Add LDAPS-support to LDAP-Authcontroller. [#7014](https://github.com/parse-community/parse-server/pull/7014). Thanks to [Fabian Strachanski](https://github.com/fastrde).
23+
- FIX: (beforeSave/afterSave): Return value instead of Parse.Op for nested fields. [#7005](https://github.com/parse-community/parse-server/pull/7005). Thanks to [Diamond Lewis](https://github.com/dplewis).
24+
- FIX: (beforeSave): Skip Sanitizing Database results. [#7003](https://github.com/parse-community/parse-server/pull/7003). Thanks to [Diamond Lewis](https://github.com/dplewis).
25+
- FIX: Fix includeAll for querying a Pointer and Pointer array. [#7002](https://github.com/parse-community/parse-server/pull/7002). Thanks to [Corey Baker](https://github.com/cbaker6).
26+
- FIX: Add encryptionKey to src/options/index.js. [#6999](https://github.com/parse-community/parse-server/pull/6999). Thanks to [dblythy](https://github.com/dblythy).
27+
- IMPROVE: Update PostgresStorageAdapter.js. [#6989](https://github.com/parse-community/parse-server/pull/6989). Thanks to [Vitaly Tomilov](https://github.com/vitaly-t).
528

629
### 4.4.0
730
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.3.0...4.4.0)

‎CONTRIBUTING.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,18 @@ If you want to make changes to [Parse Server Configuration][config] add the desi
100100

101101
To view docs run `npm run docs` and check the `/out` directory.
102102

103-
### Code of Conduct
103+
## Feature Considerations
104+
### Security Checks
105+
106+
The Parse Server security checks feature warns developers about weak security settings in their Parse Server deployment.
107+
108+
A security check needs to be added for every new feature or enhancement that allows the developer to configure it in a way that weakens security mechanisms or exposes functionality which creates a weak spot for malicious attacks. If you are not sure whether your feature or enhancements requires a security check, feel free to ask.
109+
110+
For example, allowing public read and write to a class may be useful to simplify development but should be disallowed in a production environment.
111+
112+
Security checks are added in [SecurityChecks.js](https://github.com/parse-community/parse-server/blob/master/src/SecurityChecks.js).
113+
114+
## Code of Conduct
104115

105116
This project adheres to the [Contributor Covenant Code of Conduct](https://github.com/parse-community/parse-server/blob/master/CODE_OF_CONDUCT.md). By participating, you are expected to honor this code.
106117

‎package-lock.json

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "parse-server",
3-
"version": "4.4.0",
3+
"version": "4.5.0",
44
"description": "An express module providing a Parse-compatible API server",
55
"main": "lib/index.js",
66
"repository": {

‎release_docs.sh

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
#!/bin/sh -e
22
set -x
3-
if [ "${TRAVIS_REPO_SLUG}" = "" ];
3+
if [ "${GITHUB_ACTIONS}" = "" ];
44
then
5-
echo "Cannot release docs without TRAVIS_REPO_SLUG set"
5+
echo "Cannot release docs without GITHUB_ACTIONS set"
66
exit 0;
77
fi
8-
REPO="https://github.com/${TRAVIS_REPO_SLUG}"
8+
REPO="https://github.com/parse-community/parse-server"
99

1010
rm -rf docs
1111
git clone -b gh-pages --single-branch $REPO ./docs
@@ -15,9 +15,9 @@ cd ..
1515

1616
DEST="master"
1717

18-
if [ "${TRAVIS_TAG}" != "" ];
18+
if [ "${SOURCE_TAG}" != "" ];
1919
then
20-
DEST="${TRAVIS_TAG}"
20+
DEST="${SOURCE_TAG}"
2121
# change the default page to the latest
2222
echo "<meta http-equiv='refresh' content='0; url=/parse-server/api/${DEST}'>" > "docs/api/index.html"
2323
fi

‎spec/DatabaseController.spec.js

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,57 @@ describe('DatabaseController', function () {
236236
done();
237237
});
238238

239+
it('should not return a $or operation if the query involves one of the two fields also used as array/pointer permissions', done => {
240+
const clp = buildCLP(['users', 'user']);
241+
const query = { a: 'b', user: createUserPointer(USER_ID) };
242+
schemaController.testPermissionsForClassName
243+
.withArgs(CLASS_NAME, ACL_GROUP, OPERATION)
244+
.and.returnValue(false);
245+
schemaController.getClassLevelPermissions.withArgs(CLASS_NAME).and.returnValue(clp);
246+
schemaController.getExpectedType
247+
.withArgs(CLASS_NAME, 'user')
248+
.and.returnValue({ type: 'Pointer' });
249+
schemaController.getExpectedType
250+
.withArgs(CLASS_NAME, 'users')
251+
.and.returnValue({ type: 'Array' });
252+
const output = databaseController.addPointerPermissions(
253+
schemaController,
254+
CLASS_NAME,
255+
OPERATION,
256+
query,
257+
ACL_GROUP
258+
);
259+
expect(output).toEqual({ ...query, user: createUserPointer(USER_ID) });
260+
done();
261+
});
262+
263+
it('should not return a $or operation if the query involves one of the fields also used as array/pointer permissions', done => {
264+
const clp = buildCLP(['user', 'users', 'userObject']);
265+
const query = { a: 'b', user: createUserPointer(USER_ID) };
266+
schemaController.testPermissionsForClassName
267+
.withArgs(CLASS_NAME, ACL_GROUP, OPERATION)
268+
.and.returnValue(false);
269+
schemaController.getClassLevelPermissions.withArgs(CLASS_NAME).and.returnValue(clp);
270+
schemaController.getExpectedType
271+
.withArgs(CLASS_NAME, 'user')
272+
.and.returnValue({ type: 'Pointer' });
273+
schemaController.getExpectedType
274+
.withArgs(CLASS_NAME, 'users')
275+
.and.returnValue({ type: 'Array' });
276+
schemaController.getExpectedType
277+
.withArgs(CLASS_NAME, 'userObject')
278+
.and.returnValue({ type: 'Object' });
279+
const output = databaseController.addPointerPermissions(
280+
schemaController,
281+
CLASS_NAME,
282+
OPERATION,
283+
query,
284+
ACL_GROUP
285+
);
286+
expect(output).toEqual({ ...query, user: createUserPointer(USER_ID) });
287+
done();
288+
});
289+
239290
it('should throw an error if for some unexpected reason the property specified in the CLP is neither a pointer nor an array', done => {
240291
const clp = buildCLP(['user']);
241292
const query = { a: 'b' };
@@ -265,6 +316,51 @@ describe('DatabaseController', function () {
265316
done();
266317
});
267318
});
319+
320+
describe('reduceOperations', function () {
321+
const databaseController = new DatabaseController();
322+
323+
it('objectToEntriesStrings', done => {
324+
const output = databaseController.objectToEntriesStrings({ a: 1, b: 2, c: 3 });
325+
expect(output).toEqual(['"a":1', '"b":2', '"c":3']);
326+
done();
327+
});
328+
329+
it('reduceOrOperation', done => {
330+
expect(databaseController.reduceOrOperation({ a: 1 })).toEqual({ a: 1 });
331+
expect(databaseController.reduceOrOperation({ $or: [{ a: 1 }, { b: 2 }] })).toEqual({
332+
$or: [{ a: 1 }, { b: 2 }],
333+
});
334+
expect(databaseController.reduceOrOperation({ $or: [{ a: 1 }, { a: 2 }] })).toEqual({
335+
$or: [{ a: 1 }, { a: 2 }],
336+
});
337+
expect(databaseController.reduceOrOperation({ $or: [{ a: 1 }, { a: 1 }] })).toEqual({ a: 1 });
338+
expect(
339+
databaseController.reduceOrOperation({ $or: [{ a: 1, b: 2, c: 3 }, { a: 1 }] })
340+
).toEqual({ a: 1 });
341+
expect(
342+
databaseController.reduceOrOperation({ $or: [{ b: 2 }, { a: 1, b: 2, c: 3 }] })
343+
).toEqual({ b: 2 });
344+
done();
345+
});
346+
347+
it('reduceAndOperation', done => {
348+
expect(databaseController.reduceAndOperation({ a: 1 })).toEqual({ a: 1 });
349+
expect(databaseController.reduceAndOperation({ $and: [{ a: 1 }, { b: 2 }] })).toEqual({
350+
$and: [{ a: 1 }, { b: 2 }],
351+
});
352+
expect(databaseController.reduceAndOperation({ $and: [{ a: 1 }, { a: 2 }] })).toEqual({
353+
$and: [{ a: 1 }, { a: 2 }],
354+
});
355+
expect(databaseController.reduceAndOperation({ $and: [{ a: 1 }, { a: 1 }] })).toEqual({
356+
a: 1,
357+
});
358+
expect(
359+
databaseController.reduceAndOperation({ $and: [{ a: 1, b: 2, c: 3 }, { b: 2 }] })
360+
).toEqual({ a: 1, b: 2, c: 3 });
361+
done();
362+
});
363+
});
268364
});
269365

270366
function buildCLP(pointerNames) {

0 commit comments

Comments
 (0)