feat: Add security checks page #2491

dblythy · 2023-06-29T08:12:02Z

New Pull Request Checklist

I am not disclosing a vulnerability.
I am creating this PR in reference to an issue.

Issue Description

There is currently no page to display security checks

Closes: #1665

Approach

TODOs before merging

Add tests
Add changes to documentation (guides, repository pages, in-code descriptions)

parse-github-assistant · 2023-06-29T08:12:03Z

I will reformat the title to use the proper commit message syntax.

parse-github-assistant · 2023-06-29T08:12:06Z

Thanks for opening this pull request!

🎉 We are excited about your hands-on contribution!

uffizzi-cloud · 2023-06-29T08:21:17Z

Uffizzi Ephemeral Environment `deployment-29717`

⌚ Updated Jun 29, 2023, 08:19 UTC

☁️ https://app.uffizzi.com/github.com/parse-community/parse-dashboard/pull/2491

📄 View Application Logs etc.

What is Uffizzi? Learn more

mtrezza · 2023-06-29T12:11:47Z

Lovely! Do you think you could split this up into more columns?

Check	Status	Issue	Solution
Overall Status	❌
Secure master key	❌	The Parse Server master key is insecure.	Choose a longer and/or more complex key.
Security log disabled	✅

src/dashboard/Settings/Security/Security.react.js

Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>

mtrezza · 2023-06-30T00:51:22Z

I'm not sure but for this feature to be implemented we may need to introduce a config option to hide the page per app or per user. It's exposing the security status of the server and its vulnerabilities. Any dashboard user can see this info easily, is that something of concern?

dblythy · 2023-06-30T03:15:20Z

security.enableCheck is disabled by default on the server, so this is what shows:

Perhaps we should pass this to featuresRouter and hide/show this page depending on the server settings?

dblythy · 2023-06-30T03:38:11Z

Related: parse-community/parse-server#8678

mtrezza · 2023-07-03T00:18:21Z

That would mean that someone could not enable security checks if they didn't want to display possible attack vectors for all users in Parse Dashboard, right? If so, I'm not sure this would be an acceptable constraint. I think it should be possible to enable security checks on the server while hiding the results from the dashboard user.

If a dashboard user has access to the master key by inspecting the API requests anyway, it may matter less, but I still think this kind of information should not be displayed so prominently to everyone.

Signed-off-by: Daniel <daniel-blyth@live.com.au>

dblythy · 2023-07-17T06:34:55Z

dblythy · 2023-07-17T06:36:10Z

I'm not sure if it's currently possible to specify features per user (other than readonly). I think the feature has to be either on for all users, or off for all. We can add an option enableSecurityChecks: true that can only show security checks if enabled in the dashboard config.

And yes, any dashboard user can inspect any network request to read the masterKey.

mtrezza · 2023-07-17T16:27:38Z

Well, it's not that big of a deal then, but if you want to add an option to disable the security checks page in the dashboard config (for all apps or per app or per user, whatever is easiest), then I think it would be better. Otherwise I think we can merge it anyway.

Btw the new table layout looks nice! An additional luxury would be a refresh button, so developers can play around with the server settings and see the status change. Also just a suggestion, happy to merge without.

dblythy · 2023-07-18T00:54:15Z

There is a reload button in the top right, I just missed it in the screenshot

mtrezza · 2023-07-18T00:57:38Z

Nice!

mtrezza

Looks good!

# [5.2.0-alpha.28](5.2.0-alpha.27...5.2.0-alpha.28) (2023-08-27) ### Features * Add security checks page ([#2491](#2491)) ([103b9c6](103b9c6))

parseplatformorg · 2023-08-27T22:51:01Z

🎉 This change has been released in version 5.2.0-alpha.28

# [5.3.0-beta.1](5.2.0...5.3.0-beta.1) (2023-09-15) ### Bug Fixes * Adding a file when adding a new row in the data browser doesn't show filename ([#2471](#2471)) ([5bbb94e](5bbb94e)) * File extension is hidden in file field when editing object in modal dialog in data browser ([#2472](#2472)) ([8df4e4d](8df4e4d)) * Incorrect highlight maker position in class list in data browser ([#2490](#2490)) ([8c28d24](8c28d24)) * Pasting location coordinates into field of type `GeoPoint` does not work in data browser ([#2464](#2464)) ([a8ce343](a8ce343)) * Selecting a saved filter in data browser also highlights other filters with equal names ([#2466](#2466)) ([35360fe](35360fe)) * Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([#2457](#2457)) ([5acac3f](5acac3f)) ### Features * Add Cloud Function execution on Parse Object in data browser ([#2409](#2409)) ([996ce91](996ce91)) * Add parameter `selectedField` to script payload to determine which object field was selected when script was invoked ([#2483](#2483)) ([e98d653](e98d653)) * Add refresh button to Cloud Config page ([#2480](#2480)) ([be212b0](be212b0)) * Add security checks page ([#2491](#2491)) ([103b9c6](103b9c6)) * Add support for confirmation dialog before script execution in data browser ([#2481](#2481)) ([64d3913](64d3913)) * Add typing with auto-complete to select a filter field in the data browser ([#2463](#2463)) ([257f76b](257f76b)) * Reopen last opened class when navigating to data browser ([#2468](#2468)) ([3d7148e](3d7148e)) ### Reverts * fix: Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([#2457](#2457)) ([#2477](#2477)) ([2f1d84e](2f1d84e))

parseplatformorg · 2023-09-15T18:03:16Z

🎉 This change has been released in version 5.3.0-beta.1

# [5.3.0-alpha.1](5.2.0...5.3.0-alpha.1) (2023-09-20) ### Bug Fixes * Adding a file when adding a new row in the data browser doesn't show filename ([#2471](#2471)) ([5bbb94e](5bbb94e)) * File extension is hidden in file field when editing object in modal dialog in data browser ([#2472](#2472)) ([8df4e4d](8df4e4d)) * Incorrect highlight maker position in class list in data browser ([#2490](#2490)) ([8c28d24](8c28d24)) * Pasting location coordinates into field of type `GeoPoint` does not work in data browser ([#2464](#2464)) ([a8ce343](a8ce343)) * Selecting a saved filter in data browser also highlights other filters with equal names ([#2466](#2466)) ([35360fe](35360fe)) * Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([#2457](#2457)) ([5acac3f](5acac3f)) ### Features * Add Cloud Function execution on Parse Object in data browser ([#2409](#2409)) ([996ce91](996ce91)) * Add parameter `selectedField` to script payload to determine which object field was selected when script was invoked ([#2483](#2483)) ([e98d653](e98d653)) * Add refresh button to Cloud Config page ([#2480](#2480)) ([be212b0](be212b0)) * Add security checks page ([#2491](#2491)) ([103b9c6](103b9c6)) * Add support for confirmation dialog before script execution in data browser ([#2481](#2481)) ([64d3913](64d3913)) * Add typing with auto-complete to select a filter field in the data browser ([#2463](#2463)) ([257f76b](257f76b)) * Reopen last opened class when navigating to data browser ([#2468](#2468)) ([3d7148e](3d7148e)) ### Reverts * fix: Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([#2457](#2457)) ([#2477](#2477)) ([2f1d84e](2f1d84e))

parseplatformorg · 2023-09-20T13:18:54Z

🎉 This change has been released in version 5.3.0-alpha.1

# [5.3.0](5.2.0...5.3.0) (2023-11-16) ### Bug Fixes * Adding a file when adding a new row in the data browser doesn't show filename ([#2471](#2471)) ([5bbb94e](5bbb94e)) * File extension is hidden in file field when editing object in modal dialog in data browser ([#2472](#2472)) ([8df4e4d](8df4e4d)) * Incorrect highlight maker position in class list in data browser ([#2490](#2490)) ([8c28d24](8c28d24)) * Pasting location coordinates into field of type `GeoPoint` does not work in data browser ([#2464](#2464)) ([a8ce343](a8ce343)) * Selecting a saved filter in data browser also highlights other filters with equal names ([#2466](#2466)) ([35360fe](35360fe)) * Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([#2457](#2457)) ([5acac3f](5acac3f)) ### Features * Add Cloud Function execution on Parse Object in data browser ([#2409](#2409)) ([996ce91](996ce91)) * Add parameter `selectedField` to script payload to determine which object field was selected when script was invoked ([#2483](#2483)) ([e98d653](e98d653)) * Add refresh button to Cloud Config page ([#2480](#2480)) ([be212b0](be212b0)) * Add security checks page ([#2491](#2491)) ([103b9c6](103b9c6)) * Add support for confirmation dialog before script execution in data browser ([#2481](#2481)) ([64d3913](64d3913)) * Add typing with auto-complete to select a filter field in the data browser ([#2463](#2463)) ([257f76b](257f76b)) * Reopen last opened class when navigating to data browser ([#2468](#2468)) ([3d7148e](3d7148e)) ### Reverts * fix: Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([#2457](#2457)) ([#2477](#2477)) ([2f1d84e](2f1d84e))

parseplatformorg · 2023-11-16T15:29:56Z

🎉 This change has been released in version 5.3.0

* release: (34 commits) chore(release): 5.3.0 [skip ci] release chore(release): 5.3.0-beta.1 [skip ci] release chore(release): 5.2.0-alpha.28 [skip ci] feat: Add security checks page (parse-community#2491) refactor: Security upgrade semver from 7.3.7 to 7.5.2 (parse-community#2493) refactor: Add lint and prettier (parse-community#2492) chore(release): 5.2.0-alpha.27 [skip ci] fix: Adding a file when adding a new row in the data browser doesn't show filename (parse-community#2471) chore(release): 5.2.0-alpha.26 [skip ci] fix: File extension is hidden in file field when editing object in modal dialog in data browser (parse-community#2472) chore(release): 5.2.0-alpha.25 [skip ci] fix: Incorrect highlight maker position in class list in data browser (parse-community#2490) chore(release): 5.2.0-alpha.24 [skip ci] feat: Add support for confirmation dialog before script execution in data browser (parse-community#2481) chore(release): 5.2.0-alpha.23 [skip ci] feat: Add parameter `selectedField` to script payload to determine which object field was selected when script was invoked (parse-community#2483) chore(release): 5.2.0-alpha.22 [skip ci] feat: Add refresh button to Cloud Config page (parse-community#2480) ... # Conflicts: # package-lock.json # src/components/LogView/LogViewEntry.react.js # src/dashboard/Data/Jobs/Jobs.react.js # src/dashboard/Data/Jobs/JobsForm.react.js # src/lib/DateUtils.js

* feat: Add refresh indicator to Cloud Config page (parse-community#2505) * chore(release): 5.3.0-alpha.2 [skip ci] # [5.3.0-alpha.2](parse-community/parse-dashboard@5.3.0-alpha.1...5.3.0-alpha.2) (2023-10-18) ### Features * Add refresh indicator to Cloud Config page ([parse-community#2505](parse-community#2505)) ([a10d1f0](parse-community@a10d1f0)) * release * chore(release): 5.3.0 [skip ci] # [5.3.0](parse-community/parse-dashboard@5.2.0...5.3.0) (2023-11-16) ### Bug Fixes * Adding a file when adding a new row in the data browser doesn't show filename ([parse-community#2471](parse-community#2471)) ([5bbb94e](parse-community@5bbb94e)) * File extension is hidden in file field when editing object in modal dialog in data browser ([parse-community#2472](parse-community#2472)) ([8df4e4d](parse-community@8df4e4d)) * Incorrect highlight maker position in class list in data browser ([parse-community#2490](parse-community#2490)) ([8c28d24](parse-community@8c28d24)) * Pasting location coordinates into field of type `GeoPoint` does not work in data browser ([parse-community#2464](parse-community#2464)) ([a8ce343](parse-community@a8ce343)) * Selecting a saved filter in data browser also highlights other filters with equal names ([parse-community#2466](parse-community#2466)) ([35360fe](parse-community@35360fe)) * Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([parse-community#2457](parse-community#2457)) ([5acac3f](parse-community@5acac3f)) ### Features * Add Cloud Function execution on Parse Object in data browser ([parse-community#2409](parse-community#2409)) ([996ce91](parse-community@996ce91)) * Add parameter `selectedField` to script payload to determine which object field was selected when script was invoked ([parse-community#2483](parse-community#2483)) ([e98d653](parse-community@e98d653)) * Add refresh button to Cloud Config page ([parse-community#2480](parse-community#2480)) ([be212b0](parse-community@be212b0)) * Add security checks page ([parse-community#2491](parse-community#2491)) ([103b9c6](parse-community@103b9c6)) * Add support for confirmation dialog before script execution in data browser ([parse-community#2481](parse-community#2481)) ([64d3913](parse-community@64d3913)) * Add typing with auto-complete to select a filter field in the data browser ([parse-community#2463](parse-community#2463)) ([257f76b](parse-community@257f76b)) * Reopen last opened class when navigating to data browser ([parse-community#2468](parse-community#2468)) ([3d7148e](parse-community@3d7148e)) ### Reverts * fix: Vertical scrollbar in data browser is outside visible area when scrolling horizontally ([parse-community#2457](parse-community#2457)) ([parse-community#2477](parse-community#2477)) ([2f1d84e](parse-community@2f1d84e)) * release * chore(release): 5.4.0-beta.1 [skip ci] # [5.4.0-beta.1](parse-community/parse-dashboard@5.3.0...5.4.0-beta.1) (2023-11-16) ### Features * Add refresh indicator to Cloud Config page ([parse-community#2505](parse-community#2505)) ([a10d1f0](parse-community@a10d1f0)) * refactor: Security upgrade js-beautify from 1.14.6 to 1.14.10 (parse-community#2513) * chore(release): 5.4.0-alpha.1 [skip ci] # [5.4.0-alpha.1](parse-community/parse-dashboard@5.3.0...5.4.0-alpha.1) (2023-12-02) ### Features * Add refresh indicator to Cloud Config page ([parse-community#2505](parse-community#2505)) ([a10d1f0](parse-community@a10d1f0)) * feat: Execute script for selected rows (parse-community#2508) * chore(release): 5.4.0-alpha.2 [skip ci] # [5.4.0-alpha.2](parse-community/parse-dashboard@5.4.0-alpha.1...5.4.0-alpha.2) (2023-12-16) ### Features * Execute script for selected rows ([parse-community#2508](parse-community#2508)) ([5d9901e](parse-community@5d9901e)) * fix: Dashboard crashes if Parse Server Cloud Function script returns object (parse-community#2516) * chore(release): 5.4.0-alpha.3 [skip ci] # [5.4.0-alpha.3](parse-community/parse-dashboard@5.4.0-alpha.2...5.4.0-alpha.3) (2023-12-16) ### Bug Fixes * Dashboard crashes if Parse Server Cloud Function script returns object ([parse-community#2516](parse-community#2516)) ([5de08f8](parse-community@5de08f8)) * fix: Data browser redirects to wrong class when changing app (parse-community#2526) * chore(release): 5.4.0-alpha.4 [skip ci] # [5.4.0-alpha.4](parse-community/parse-dashboard@5.4.0-alpha.3...5.4.0-alpha.4) (2024-02-15) ### Bug Fixes * Data browser redirects to wrong class when changing app ([parse-community#2526](parse-community#2526)) ([7713f54](parse-community@7713f54)) * fix: Open pointer in new tab in data browser not working when mount path is not root (parse-community#2527) * chore(release): 5.4.0-alpha.5 [skip ci] # [5.4.0-alpha.5](parse-community/parse-dashboard@5.4.0-alpha.4...5.4.0-alpha.5) (2024-02-18) ### Bug Fixes * Open pointer in new tab in data browser not working when mount path is not root ([parse-community#2527](parse-community#2527)) ([2f4081f](parse-community@2f4081f)) * fix: App metrics for user and installation counts show dash (parse-community#2528) * chore(release): 5.4.0-alpha.6 [skip ci] # [5.4.0-alpha.6](parse-community/parse-dashboard@5.4.0-alpha.5...5.4.0-alpha.6) (2024-02-26) ### Bug Fixes * App metrics for user and installation counts show dash ([parse-community#2528](parse-community#2528)) ([850d7b3](parse-community@850d7b3)) * feat: Add descriptive statistics for number cells in data browser (parse-community#2529) * chore(release): 5.4.0-alpha.7 [skip ci] # [5.4.0-alpha.7](parse-community/parse-dashboard@5.4.0-alpha.6...5.4.0-alpha.7) (2024-02-26) ### Features * Add descriptive statistics for number cells in data browser ([parse-community#2529](parse-community#2529)) ([ead9ec4](parse-community@ead9ec4)) * fix: Config page fails to load (parse-community#2531) * chore(release): 5.4.0-alpha.8 [skip ci] # [5.4.0-alpha.8](parse-community/parse-dashboard@5.4.0-alpha.7...5.4.0-alpha.8) (2024-02-29) ### Bug Fixes * Config page fails to load ([parse-community#2531](parse-community#2531)) ([d721b7c](parse-community@d721b7c)) * feat: Add Node 20 support; remove Node 14, 16 support (parse-community#2532) * feat: Add Node 20 support; remove Node 14, 16 support (parse-community#2535) BREAKING CHANGE: Removes support for Node 14 and 16 * chore(release): 6.0.0-alpha.1 [skip ci] # [6.0.0-alpha.1](parse-community/parse-dashboard@5.4.0-alpha.8...6.0.0-alpha.1) (2024-03-05) ### Features * Add Node 20 support; remove Node 14, 16 support ([parse-community#2532](parse-community#2532)) ([578a339](parse-community@578a339)) * Add Node 20 support; remove Node 14, 16 support ([parse-community#2535](parse-community#2535)) ([5c90f2d](parse-community@5c90f2d)) ### BREAKING CHANGES * Removes support for Node 14 and 16 ([5c90f2d](5c90f2d)) * refactor: Security upgrade express from 4.18.1 to 4.19.2 (parse-community#2539) * ci: Fix nginx config for preview environment (parse-community#2542) * refactor: Upgrade to npm lockfile version 3 (parse-community#2543) * fix: make cursor pointer for support more icon * fix: more icon cursor pointer * fix: remove console from B4aNotification * feat: add light themed b4aEmptyState * fix: B4aObjectPicker app crash when class exists not * fix: cloudcode empty states * fix: reduce size to remove scrollbar * fix: remove extra space from REST Console top * fix: dark themed dropdown arrow * fix: error modal * feat: add logRocket --------- Co-authored-by: patelmilanun <20059797+patelmilanun@users.noreply.github.com> Co-authored-by: semantic-release-bot <semantic-release-bot@martynus.net> Co-authored-by: Manuel Trezza <5673677+mtrezza@users.noreply.github.com> Co-authored-by: Parse Platform <90459499+parseplatformorg@users.noreply.github.com> Co-authored-by: Ashish Baravaliya <49753983+AshishBarvaliya@users.noreply.github.com> Co-authored-by: Corey <coreyearleon@icloud.com>

feat: add security checks page

a60a232

parse-github-assistant bot changed the title ~~feat: add security checks page~~ feat: Add security checks page Jun 29, 2023

mtrezza requested changes Jun 29, 2023

View reviewed changes

src/dashboard/Settings/Security/Security.react.js Outdated Show resolved Hide resolved

change headline

9e04b18

Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>

mtrezza and others added 2 commits June 30, 2023 02:51

Merge branch 'alpha' into add-security-checks

a3925c1

Merge branch 'alpha' into add-security-checks

83b44bf

dblythy and others added 3 commits July 5, 2023 10:28

Merge branch 'alpha' into add-security-checks

f29fcb1

Signed-off-by: Daniel <daniel-blyth@live.com.au>

Merge branch 'alpha' into add-security-checks

eec79fc

refactor

25abe4c

add option

e33be5c

Update Security.react.js

4e5ab83

mtrezza approved these changes Aug 27, 2023

View reviewed changes

mtrezza merged commit 103b9c6 into parse-community:alpha Aug 27, 2023
10 checks passed

parseplatformorg pushed a commit that referenced this pull request Aug 27, 2023

chore(release): 5.2.0-alpha.28 [skip ci]

7ec5461

# [5.2.0-alpha.28](5.2.0-alpha.27...5.2.0-alpha.28) (2023-08-27) ### Features * Add security checks page ([#2491](#2491)) ([103b9c6](103b9c6))

parseplatformorg added the state:released-alpha Released as alpha version label Aug 27, 2023

parseplatformorg added the state:released-beta Released as beta version label Sep 15, 2023

parseplatformorg added the state:released Released as stable version label Nov 16, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add security checks page #2491

feat: Add security checks page #2491

dblythy commented Jun 29, 2023

parse-github-assistant bot commented Jun 29, 2023

parse-github-assistant bot commented Jun 29, 2023

uffizzi-cloud bot commented Jun 29, 2023

mtrezza commented Jun 29, 2023 •

edited

mtrezza commented Jun 30, 2023 •

edited

dblythy commented Jun 30, 2023

dblythy commented Jun 30, 2023

mtrezza commented Jul 3, 2023 •

edited

dblythy commented Jul 17, 2023

dblythy commented Jul 17, 2023

mtrezza commented Jul 17, 2023 •

edited

dblythy commented Jul 18, 2023

mtrezza commented Jul 18, 2023

mtrezza left a comment

parseplatformorg commented Aug 27, 2023

parseplatformorg commented Sep 15, 2023

parseplatformorg commented Sep 20, 2023

parseplatformorg commented Nov 16, 2023

feat: Add security checks page #2491

feat: Add security checks page #2491

Conversation

dblythy commented Jun 29, 2023

New Pull Request Checklist

Issue Description

Approach

TODOs before merging

parse-github-assistant bot commented Jun 29, 2023

parse-github-assistant bot commented Jun 29, 2023

Thanks for opening this pull request!

uffizzi-cloud bot commented Jun 29, 2023

Uffizzi Ephemeral Environment deployment-29717

mtrezza commented Jun 29, 2023 • edited

mtrezza commented Jun 30, 2023 • edited

dblythy commented Jun 30, 2023

dblythy commented Jun 30, 2023

mtrezza commented Jul 3, 2023 • edited

dblythy commented Jul 17, 2023

dblythy commented Jul 17, 2023

mtrezza commented Jul 17, 2023 • edited

dblythy commented Jul 18, 2023

mtrezza commented Jul 18, 2023

mtrezza left a comment

Choose a reason for hiding this comment

parseplatformorg commented Aug 27, 2023

parseplatformorg commented Sep 15, 2023

parseplatformorg commented Sep 20, 2023

parseplatformorg commented Nov 16, 2023

Uffizzi Ephemeral Environment `deployment-29717`

mtrezza commented Jun 29, 2023 •

edited

mtrezza commented Jun 30, 2023 •

edited

mtrezza commented Jul 3, 2023 •

edited

mtrezza commented Jul 17, 2023 •

edited