fix: Prototype Pollution vulnerability in SingleInstanceStateController (GHSA-9g8m-v378-pcg3)

[Moumouls]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.
• Link this pull request to an issue.

Issue

Closes: GHSA-9g8m-v378-pcg3

Approach

Use Object create null

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, code comments)

Summary by CodeRabbit

• New Features
  • Added an API to remove per-object state and return the removed data when available.
• Bug Fixes
  • Improved safety by using prototype-free maps for state storage, preventing prototype pollution from special class names or IDs.
  • Increased robustness across initialization, server data handling, and pending operations.
• Tests
  • Added comprehensive tests covering prototype pollution scenarios to ensure no leakage and preserve normal behavior.

[parse-github-assistant]

🚀 Thanks for opening this pull request!

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

Refactors SingleInstanceStateController to use prototype-free maps via Object.create(null) for all state containers, updates related logic and imports, and adds a new exported removeState function. Adds tests guarding against prototype pollution with dangerous className/id inputs. Adjusts type declaration imports without API signature changes.

Changes

Cohort / File(s)	Summary
State controller: proto-free maps and API addition src/SingleInstanceStateController.ts	Replace all object-backed maps with Object.create(null) in initialization, access, and cleanup paths; adjust functions to operate on prototype-free structures; add exported removeState(obj: ParseObject): State
Prototype pollution tests src/__tests__/SingleInstanceStateController-test.js	Add tests covering pollution attempts via "proto", "constructor", "prototype", and risky ids; verify no prototype pollution occurs and normal behavior remains intact; include cleanup assertions.
Type declarations import style types/SingleInstanceStateController.d.ts	Switch single-quoted type imports to double quotes; no signature or API changes.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Client
  participant Controller as SingleInstanceStateController
  participant ObjState as objectState (proto-free)
  participant ClassMap as per-class map (proto-free)

  Client->>Controller: initializeState(obj)
  Controller->>ObjState: ensure container (Object.create(null))
  Controller->>ClassMap: ensure class map (Object.create(null))
  Controller-->>Client: initialized

  Client->>Controller: getState(obj)
  Controller->>ObjState: lookup by className
  ObjState-->>Controller: class map (proto-free)
  Controller->>ClassMap: lookup by id
  ClassMap-->>Controller: State | undefined
  Controller-->>Client: State

  Client->>Controller: removeState(obj)
  Controller->>ObjState: lookup class map
  Controller->>ClassMap: delete id -> return State | null
  Controller-->>Client: removed State | null

  note over Controller,ObjState: All maps are prototype-free to avoid<br/>__proto__/constructor/prototype key collisions.

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The title succinctly indicates the prototype pollution vulnerability being fixed in SingleInstanceStateController and references the GHSA advisory identifier, clearly summarizing the main change for reviewers.
Description Check	✅ Passed	The pull request description adheres to the repository template by including the standard header, a linked advisory in the Issue section, a concise Approach summary, and completed task checkboxes, fulfilling all required sections.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8cbe1fb and bb53225.

📒 Files selected for processing (1)

• types/SingleInstanceStateController.d.ts (1 hunks)

✅ Files skipped from review due to trivial changes (1)

• types/SingleInstanceStateController.d.ts

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: build (Node 18, 18.20.4)
• GitHub Check: build (Node 20, 20.15.1)
• GitHub Check: build (Node 22, 22.4.1)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4a47f65) to head (bb53225).
⚠️ Report is 5 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff            @@
##             alpha     #2745   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           63        63           
  Lines         6185      6185           
  Branches      1456      1456           
=========================================
  Hits          6185      6185           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Moumouls]

@mtrezza ready to review

[mtrezza]

@Moumouls Could you please check the failing types job?

[parseplatformorg]

🎉 This change has been released in version 7.0.0-alpha.1

[parseplatformorg]

🎉 This change has been released in version 7.0.0