Skip to content

Commit 9b475ef

Browse files
mtrezzamtrezza
committed
Merge branch 'master' into ci-remove-node-15
2 parents 3b92219 + 7857020 commit 9b475ef

File tree

9 files changed

+204
-28
lines changed

9 files changed

+204
-28
lines changed

‎.github/workflows/ci.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -103,17 +103,17 @@ jobs:
103103
matrix:
104104
include:
105105
- name: MongoDB 5.0, ReplicaSet, WiredTiger
106-
MONGODB_VERSION: 5.0.2
106+
MONGODB_VERSION: 5.0.3
107107
MONGODB_TOPOLOGY: replicaset
108108
MONGODB_STORAGE_ENGINE: wiredTiger
109109
NODE_VERSION: 16.9.0
110110
- name: MongoDB 4.4, ReplicaSet, WiredTiger
111-
MONGODB_VERSION: 4.4.8
111+
MONGODB_VERSION: 4.4.9
112112
MONGODB_TOPOLOGY: replicaset
113113
MONGODB_STORAGE_ENGINE: wiredTiger
114114
NODE_VERSION: 16.9.0
115115
- name: MongoDB 4.2, ReplicaSet, WiredTiger
116-
MONGODB_VERSION: 4.2.16
116+
MONGODB_VERSION: 4.2.17
117117
MONGODB_TOPOLOGY: replicaset
118118
MONGODB_STORAGE_ENGINE: wiredTiger
119119
NODE_VERSION: 16.9.0
@@ -129,20 +129,20 @@ jobs:
129129
NODE_VERSION: 16.9.0
130130
- name: Redis Cache
131131
PARSE_SERVER_TEST_CACHE: redis
132-
MONGODB_VERSION: 4.4.8
132+
MONGODB_VERSION: 4.4.9
133133
MONGODB_TOPOLOGY: standalone
134134
MONGODB_STORAGE_ENGINE: wiredTiger
135135
NODE_VERSION: 16.9.0
136136
- name: Node 12
137-
MONGODB_VERSION: 4.4.8
137+
MONGODB_VERSION: 4.4.9
138138
MONGODB_TOPOLOGY: standalone
139139
MONGODB_STORAGE_ENGINE: wiredTiger
140140
NODE_VERSION: 12.22.6
141141
- name: Node 14
142-
MONGODB_VERSION: 4.4.8
142+
MONGODB_VERSION: 4.4.9
143143
MONGODB_TOPOLOGY: standalone
144144
MONGODB_STORAGE_ENGINE: wiredTiger
145-
NODE_VERSION: 14.17.6
145+
NODE_VERSION: 14.18.0
146146
fail-fast: false
147147
name: ${{ matrix.name }}
148148
timeout-minutes: 15

‎.github/workflows/release-manual-docker.yml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Trigger this workflow only to manually create a Docker release; this should only be used
2+
# in extraordinary circumstances, as Docker releases are normally created automatically as
3+
# part of the automated release workflow.
4+
5+
name: release-manual-docker
6+
on:
7+
workflow_dispatch:
8+
inputs:
9+
ref:
10+
default: ''
11+
description: 'Reference (tag / SHA):'
12+
env:
13+
REGISTRY: docker.io
14+
IMAGE_NAME: parseplatform/parse-server
15+
jobs:
16+
build:
17+
runs-on: ubuntu-18.04
18+
permissions:
19+
contents: read
20+
packages: write
21+
steps:
22+
- name: Determine branch name
23+
id: branch
24+
run: echo "::set-output name=branch_name::${GITHUB_REF#refs/*/}"
25+
- name: Checkout repository
26+
uses: actions/checkout@v2
27+
with:
28+
ref: ${{ github.event.inputs.ref }}
29+
- name: Set up QEMU
30+
id: qemu
31+
uses: docker/setup-qemu-action@v1
32+
- name: Set up Docker Buildx
33+
uses: docker/setup-buildx-action@v1
34+
- name: Log into Docker Hub
35+
if: github.event_name != 'pull_request'
36+
uses: docker/login-action@v1
37+
with:
38+
username: ${{ secrets.DOCKERHUB_USERNAME }}
39+
password: ${{ secrets.DOCKERHUB_TOKEN }}
40+
- name: Extract Docker metadata
41+
id: meta
42+
uses: docker/metadata-action@v3
43+
with:
44+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
45+
flavor: |
46+
latest=${{ steps.branch.outputs.branch_name == 'master' && github.event.inputs.ref == '' }}
47+
tags: |
48+
type=semver,enable=true,pattern={{version}},value=${{ github.event.inputs.ref }}
49+
type=raw,enable=${{ github.event.inputs.ref == '' }},value=latest
50+
- name: Build and push Docker image
51+
uses: docker/build-push-action@v2
52+
with:
53+
context: .
54+
platforms: linux/amd64, linux/arm/v6, linux/arm/v7, linux/arm64/v8
55+
push: ${{ github.event_name != 'pull_request' }}
56+
tags: ${{ steps.meta.outputs.tags }}
57+
labels: ${{ steps.meta.outputs.labels }}

‎CHANGELOG.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ Jump directly to a version:
44

55
| 4.x |
66
|--------------------------------------|
7-
| [**4.10.3 (latest release)**](#4103) |
7+
| [**4.10.4 (latest release)**](#4104) |
8+
| [4.10.3](#4103) |
89
| [4.10.2](#4102) |
910
| [4.10.1](#4101) |
1011
| [4.10.0](#4100) |
@@ -94,7 +95,7 @@ Jump directly to a version:
9495
___
9596

9697
## Unreleased (Master Branch)
97-
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.3...master)
98+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.4...master)
9899

99100
### Breaking Changes
100101
- Improved schema caching through database real-time hooks. Reduces DB queries, decreases Parse Query execution time and fixes a potential schema memory leak. If multiple Parse Server instances connect to the same DB (for example behind a load balancer), set the [Parse Server Option](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) `databaseOptions.enableSchemaHooks: true` to enable this feature and keep the schema in sync across all instances. Failing to do so will cause a schema change to not propagate to other instances and re-syncing will only happen when these instances restart. The options `enableSingleSchemaCache` and `schemaCacheTTL` have been removed. To use this feature with MongoDB, a replica set cluster with [change stream](https://docs.mongodb.com/manual/changeStreams/#availability) support is required. (Diamond Lewis, SebC) [#7214](https://github.com/parse-community/parse-server/issues/7214)
@@ -157,6 +158,12 @@ ___
157158
- Allow cloud string for ES modules (Daniel Blyth) [#7560](https://github.com/parse-community/parse-server/pull/7560)
158159
- docs: Introduce deprecation ID for reference in comments and online search (Manuel Trezza) [#7562](https://github.com/parse-community/parse-server/pull/7562)
159160

161+
## 4.10.4
162+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.3...4.10.4)
163+
164+
### Security Fixes
165+
- Strip out sessionToken when LiveQuery is used on Parse.User (Daniel Blyth) [GHSA-7pr3-p5fm-8r9x](https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x)
166+
160167
## 4.10.3
161168
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.2...4.10.3)
162169

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ Parse Server is continuously tested with the most recent releases of Node.js to
115115
| Version | Latest Version | End-of-Life Date | Compatibility |
116116
|------------|----------------|------------------|--------------------|
117117
| Node.js 12 | 12.22.6 | April 2022 | ✅ Fully compatible |
118-
| Node.js 14 | 14.17.6 | April 2023 | ✅ Fully compatible |
118+
| Node.js 14 | 14.18.0 | April 2023 | ✅ Fully compatible |
119119
| Node.js 16 | 16.9.0 | April 2024 | ✅ Fully compatible |
120120

121121
#### MongoDB
@@ -124,9 +124,9 @@ Parse Server is continuously tested with the most recent releases of MongoDB to
124124
| Version | Latest Version | End-of-Life Date | Compatibility |
125125
|-------------|----------------|------------------|--------------------|
126126
| MongoDB 4.0 | 4.0.27 | April 2022 | ✅ Fully compatible |
127-
| MongoDB 4.2 | 4.2.16 | TBD | ✅ Fully compatible |
128-
| MongoDB 4.4 | 4.4.8 | TBD | ✅ Fully compatible |
129-
| MongoDB 5.0 | 5.0.2 | January 2024 | ✅ Fully compatible |
127+
| MongoDB 4.2 | 4.2.17 | TBD | ✅ Fully compatible |
128+
| MongoDB 4.4 | 4.4.9 | TBD | ✅ Fully compatible |
129+
| MongoDB 5.0 | 5.0.3 | January 2024 | ✅ Fully compatible |
130130

131131
#### PostgreSQL
132132
Parse Server is continuously tested with the most recent releases of PostgreSQL and PostGIS to ensure compatibility, using [PostGIS docker images](https://registry.hub.docker.com/r/postgis/postgis/tags?page=1&ordering=last_updated). We follow the [PostgreSQL support schedule](https://www.postgresql.org/support/versioning) and [PostGIS support schedule](https://www.postgis.net/eol_policy/) and only test against versions that are officially supported and have not reached their end-of-life date. Due to the extensive PostgreSQL support duration of 5 years, Parse Server drops support if a version is older than 3.5 years and a newer version has been available for at least 2.5 years.

‎package-lock.json

Lines changed: 7 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "parse-server",
3-
"version": "4.10.3",
3+
"version": "4.10.4",
44
"description": "An express module providing a Parse-compatible API server",
55
"main": "lib/index.js",
66
"repository": {
@@ -33,7 +33,7 @@
3333
"deepcopy": "2.1.0",
3434
"express": "4.17.1",
3535
"follow-redirects": "1.14.1",
36-
"graphql": "15.5.1",
36+
"graphql": "15.5.3",
3737
"graphql-list-fields": "2.0.2",
3838
"graphql-relay": "0.8.0",
3939
"graphql-tag": "2.12.5",
@@ -113,14 +113,14 @@
113113
"test:mongodb:testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=$npm_config_dbversion} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
114114
"test:mongodb": "npm run test:mongodb:runnerstart --dbversion=$npm_config_dbversion && npm run test:mongodb:testonly --dbversion=$npm_config_dbversion",
115115
"test:mongodb:4.0.27": "npm run test:mongodb --dbversion=4.0.27",
116-
"test:mongodb:4.2.16": "npm run test:mongodb --dbversion=4.2.16",
117-
"test:mongodb:4.4.8": "npm run test:mongodb --dbversion=4.4.8",
116+
"test:mongodb:4.2.17": "npm run test:mongodb --dbversion=4.2.17",
117+
"test:mongodb:4.4.9": "npm run test:mongodb --dbversion=4.4.9",
118118
"posttest:mongodb": "mongodb-runner stop",
119-
"pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
120-
"testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
119+
"pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
120+
"testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
121121
"test": "npm run testonly",
122-
"posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
123-
"coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
122+
"posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
123+
"coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
124124
"start": "node ./bin/parse-server",
125125
"prettier": "prettier --write {src,spec}/{**/*,*}.js",
126126
"prepare": "npm run build",

‎spec/ParseLiveQuery.spec.js

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -840,6 +840,52 @@ describe('ParseLiveQuery', function () {
840840
done();
841841
});
842842

843+
it('should strip out session token in LiveQuery', async () => {
844+
await reconfigureServer({
845+
liveQuery: { classNames: ['_User'] },
846+
startLiveQueryServer: true,
847+
verbose: false,
848+
silent: true,
849+
});
850+
851+
const user = new Parse.User();
852+
user.setUsername('username');
853+
user.setPassword('password');
854+
user.set('foo', 'bar');
855+
856+
const query = new Parse.Query(Parse.User);
857+
query.equalTo('foo', 'bar');
858+
const subscription = await query.subscribe();
859+
860+
const events = ['create', 'update', 'enter', 'leave', 'delete'];
861+
const response = (obj, prev) => {
862+
expect(obj.get('sessionToken')).toBeUndefined();
863+
expect(obj.sessionToken).toBeUndefined();
864+
expect(prev && prev.sessionToken).toBeUndefined();
865+
if (prev && prev.get) {
866+
expect(prev.get('sessionToken')).toBeUndefined();
867+
}
868+
};
869+
const calls = {};
870+
for (const key of events) {
871+
calls[key] = response;
872+
spyOn(calls, key).and.callThrough();
873+
subscription.on(key, calls[key]);
874+
}
875+
await user.signUp();
876+
user.unset('foo');
877+
await user.save();
878+
user.set('foo', 'bar');
879+
await user.save();
880+
user.set('yolo', 'bar');
881+
await user.save();
882+
await user.destroy();
883+
await new Promise(resolve => process.nextTick(resolve));
884+
for (const key of events) {
885+
expect(calls[key]).toHaveBeenCalled();
886+
}
887+
});
888+
843889
afterEach(async function (done) {
844890
const client = await Parse.CoreManager.getLiveQueryController().getDefaultLiveQueryClient();
845891
client.close();

‎spec/ParseUser.spec.js

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3966,6 +3966,54 @@ describe('Parse.User testing', () => {
39663966
ok(model._isLinked('facebook'), 'User should be linked to facebook');
39673967
});
39683968
});
3969+
3970+
it('should strip out authdata in LiveQuery', async () => {
3971+
const provider = getMockFacebookProvider();
3972+
Parse.User._registerAuthenticationProvider(provider);
3973+
3974+
await reconfigureServer({
3975+
liveQuery: { classNames: ['_User'] },
3976+
startLiveQueryServer: true,
3977+
verbose: false,
3978+
silent: true,
3979+
});
3980+
3981+
const query = new Parse.Query(Parse.User);
3982+
query.doesNotExist('foo');
3983+
const subscription = await query.subscribe();
3984+
3985+
const events = ['create', 'update', 'enter', 'leave', 'delete'];
3986+
const response = (obj, prev) => {
3987+
expect(obj.get('authData')).toBeUndefined();
3988+
expect(obj.authData).toBeUndefined();
3989+
expect(prev && prev.authData).toBeUndefined();
3990+
if (prev && prev.get) {
3991+
expect(prev.get('authData')).toBeUndefined();
3992+
}
3993+
};
3994+
const calls = {};
3995+
for (const key of events) {
3996+
calls[key] = response;
3997+
spyOn(calls, key).and.callThrough();
3998+
subscription.on(key, calls[key]);
3999+
}
4000+
const user = await Parse.User._logInWith('facebook');
4001+
4002+
user.set('foo', 'bar');
4003+
await user.save();
4004+
user.unset('foo');
4005+
await user.save();
4006+
user.set('yolo', 'bar');
4007+
await user.save();
4008+
await user.destroy();
4009+
await new Promise(resolve => process.nextTick(resolve));
4010+
for (const key of events) {
4011+
expect(calls[key]).toHaveBeenCalled();
4012+
}
4013+
const client = await Parse.CoreManager.getLiveQueryController().getDefaultLiveQueryClient();
4014+
client.close();
4015+
await new Promise(resolve => process.nextTick(resolve));
4016+
});
39694017
});
39704018

39714019
describe('Security Advisory GHSA-8w3j-g983-8jh5', function () {

‎src/LiveQuery/ParseLiveQueryServer.js

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,14 @@ class ParseLiveQueryServer {
186186
deletedParseObject = res.object.toJSON();
187187
deletedParseObject.className = className;
188188
}
189+
if (
190+
(deletedParseObject.className === '_User' ||
191+
deletedParseObject.className === '_Session') &&
192+
!client.hasMasterKey
193+
) {
194+
delete deletedParseObject.sessionToken;
195+
delete deletedParseObject.authData;
196+
}
189197
client.pushDelete(requestId, deletedParseObject);
190198
} catch (error) {
191199
Client.pushError(
@@ -337,6 +345,16 @@ class ParseLiveQueryServer {
337345
originalParseObject = res.original.toJSON();
338346
originalParseObject.className = res.original.className || className;
339347
}
348+
if (
349+
(currentParseObject.className === '_User' ||
350+
currentParseObject.className === '_Session') &&
351+
!client.hasMasterKey
352+
) {
353+
delete currentParseObject.sessionToken;
354+
delete originalParseObject?.sessionToken;
355+
delete currentParseObject.authData;
356+
delete originalParseObject?.authData;
357+
}
340358
const functionName = 'push' + res.event.charAt(0).toUpperCase() + res.event.slice(1);
341359
if (client[functionName]) {
342360
client[functionName](requestId, currentParseObject, originalParseObject);

0 commit comments

Comments
 (0)