Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: graphQL query ignores condition equalTo with value false #8032

Conversation

yomybaby
Copy link
Contributor

@yomybaby yomybaby commented Jun 9, 2022

New Pull Request Checklist

Issue Description

Related issue: #8031

Approach

Ignore only the value is undefined.

TODOs before merging

  • Add tests
  • Add changes to documentation (guides, repository pages, in-code descriptions)
  • Add security check
  • Add new Parse Error codes to Parse JS SDK
  • A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)

@parse-github-assistant
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title fix: GraphQL query transformer drop the condition on the object field with false value fix: graphQL query transformer drop the condition on the object field with false value Jun 9, 2022
@parse-github-assistant
Copy link

parse-github-assistant bot commented Jun 9, 2022

Thanks for opening this pull request!

  • 🎉 We are excited about your hands-on contribution!

@codecov
Copy link

codecov bot commented Jun 9, 2022

Codecov Report

Merging #8032 (252396d) into alpha (6e68656) will increase coverage by 0.03%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##            alpha    #8032      +/-   ##
==========================================
+ Coverage   94.14%   94.18%   +0.03%     
==========================================
  Files         182      182              
  Lines       13705    13712       +7     
==========================================
+ Hits        12903    12914      +11     
+ Misses        802      798       -4     
Impacted Files Coverage Δ
...dapters/Storage/Postgres/PostgresStorageAdapter.js 95.71% <100.00%> (+0.24%) ⬆️
src/GraphQL/transformers/query.js 89.77% <100.00%> (ø)
src/batch.js 94.73% <0.00%> (+1.75%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6e68656...252396d. Read the comment docs.

@Moumouls
Copy link
Member

Moumouls commented Jun 9, 2022

Thanks @yomybaby I'll give it a review asap 🚀

@mtrezza mtrezza requested a review from a team June 10, 2022 11:13
Copy link
Member

@mtrezza mtrezza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yomybaby could you please look at the failing tests and see whether they are related to this PR?

Copy link
Member

@Moumouls Moumouls left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some test refactoring 🚀

Thanks @yomybaby for the PR

spec/ParseGraphQLServer.spec.js Show resolved Hide resolved
spec/ParseGraphQLServer.spec.js Outdated Show resolved Hide resolved
spec/ParseGraphQLServer.spec.js Outdated Show resolved Hide resolved
Copy link
Member

@Moumouls Moumouls left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a query on a 0 object key value

spec/ParseGraphQLServer.spec.js Outdated Show resolved Hide resolved
spec/ParseGraphQLServer.spec.js Outdated Show resolved Hide resolved
@Moumouls
Copy link
Member

Hi @yomybaby are you still interested to finish this PR, you are close to the finish line 🏁

… has false or 0 value on object field

- Change test style
- Remove unnecessary assertion

Co-authored-by: Antoine Cormouls <contact.antoine.cormouls@gmail.com>
@yomybaby yomybaby force-pushed the graphql-where-argument-with-false-value-on-object-field branch from d3229f6 to 32c7ab6 Compare June 26, 2022 14:52
@yomybaby
Copy link
Contributor Author

Sorry for replying late.

@Moumouls Thank you for reviewing. 👍I followed your suggestion and rebase it to latest alpha branch.
@mtrezza I'll resolve failed test cases if still exists. 🙏

Copy link
Member

@mtrezza mtrezza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Postgres tests still failing

@yomybaby
Copy link
Contributor Author

@mtrezza I'm going to take a look today.

@yomybaby
Copy link
Contributor Author

I just pushed updated code.
I found another bug related with this PR. Please review again, @Moumouls . 🙏
The values of nested field should be casted to appropriate type on $ne and $eq condition.

@mtrezza
Only one test case is failed on ci / MongoDB 5.0,.

✗ validateAuthData invalid signature id
- Expected a promise to be rejected with ParseError: 141 Apple Game Center - invalid signature but it was rejected with Error: error:09091064:PEM routines:PEM_read_bio_ex:bad base64 decode.

This is not related to this PR.

@Moumouls
Copy link
Member

Hi, thanks @yomybaby for your additional work here !

Don't worry about the failing test, this is a flaky one...

I'll try to take a look today 🚀

@yomybaby
Copy link
Contributor Author

yomybaby commented Jul 3, 2022

@Moumouls @mtrezza It's close to the finish lien 🏁, right? 🙏 😁

Copy link
Member

@mtrezza mtrezza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good; @Moumouls anything you want to add?

@mtrezza mtrezza changed the title fix: graphQL query transformer drop the condition on the object field with false value fix: graphQL query ignores condition equalTo with value false Jul 3, 2022
@mtrezza
Copy link
Member

mtrezza commented Jul 3, 2022

@yomybaby I rephrased the PR title; please let me know in case it's incorrect.

Copy link
Member

@Moumouls Moumouls left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks @yomybaby 🚀

parseplatformorg pushed a commit that referenced this pull request Jul 3, 2022
# [5.3.0-alpha.19](5.3.0-alpha.18...5.3.0-alpha.19) (2022-07-03)

### Bug Fixes

* certificate in Apple Game Center auth adapter not validated [skip release] ([#8058](#8058)) ([75af9a2](75af9a2))
* graphQL query ignores condition `equalTo` with value `false` ([#8032](#8032)) ([7f5a15d](7f5a15d))
* invalid file request not properly handled [skip release] ([#8062](#8062)) ([4c9e956](4c9e956))
* protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8076](#8076)) ([9fd4516](9fd4516))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.3.0-alpha.19

@parseplatformorg parseplatformorg added the state:released-alpha Released as alpha version label Jul 3, 2022
parseplatformorg pushed a commit that referenced this pull request Oct 29, 2022
# [5.4.0-beta.1](5.3.0...5.4.0-beta.1) (2022-10-29)

### Bug Fixes

* authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([#8187](#8187)) ([8c8ec71](8c8ec71))
* brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([#8146](#8146)) [skip release] ([4c0c7c7](4c0c7c7))
* certificate in Apple Game Center auth adapter not validated [skip release] ([#8058](#8058)) ([75af9a2](75af9a2))
* graphQL query ignores condition `equalTo` with value `false` ([#8032](#8032)) ([7f5a15d](7f5a15d))
* internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([#8121](#8121)) ([c16f529](c16f529))
* invalid file request not properly handled [skip release] ([#8062](#8062)) ([4c9e956](4c9e956))
* liveQuery with `containedIn` not working when object field is an array ([#8128](#8128)) ([1d9605b](1d9605b))
* protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8076](#8076)) ([9fd4516](9fd4516))
* push notifications `badge` doesn't update with Installation beforeSave trigger ([#8162](#8162)) ([3c75c2b](3c75c2b))
* query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([#8167](#8167)) ([e424137](e424137))
* relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([#8203](#8203)) ([28f0d26](28f0d26))
* security upgrade undici from 5.6.0 to 5.8.0 ([#8108](#8108)) ([4aa016b](4aa016b))
* server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([#8238](#8238)) ([c03908f](c03908f))
* session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([#8180](#8180)) ([37fed30](37fed30))
* sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([#8157](#8157)) ([3b775a1](3b775a1))
* updating object includes unchanged keys in client response for certain key types ([#8159](#8159)) ([37af1d7](37af1d7))

### Features

* add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([#8244](#8244)) ([9f11115](9f11115))
* add option to change the default value of the `Parse.Query.limit()` constraint ([#8152](#8152)) ([0388956](0388956))
* add support for MongoDB 6 ([#8242](#8242)) ([aba0081](aba0081))
* add support for Postgres 15 ([#8215](#8215)) ([2feb6c4](2feb6c4))
* liveQuery support for unsorted distance queries ([#8221](#8221)) ([0f763da](0f763da))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.4.0-beta.1

@parseplatformorg parseplatformorg added the state:released-beta Released as beta version label Oct 29, 2022
parseplatformorg pushed a commit that referenced this pull request Oct 31, 2022
# [5.4.0-alpha.1](5.3.0...5.4.0-alpha.1) (2022-10-31)

### Bug Fixes

* authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([#8187](#8187)) ([8c8ec71](8c8ec71))
* brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([#8146](#8146)) [skip release] ([4c0c7c7](4c0c7c7))
* certificate in Apple Game Center auth adapter not validated [skip release] ([#8058](#8058)) ([75af9a2](75af9a2))
* graphQL query ignores condition `equalTo` with value `false` ([#8032](#8032)) ([7f5a15d](7f5a15d))
* internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([#8121](#8121)) ([c16f529](c16f529))
* invalid file request not properly handled [skip release] ([#8062](#8062)) ([4c9e956](4c9e956))
* liveQuery with `containedIn` not working when object field is an array ([#8128](#8128)) ([1d9605b](1d9605b))
* protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8076](#8076)) ([9fd4516](9fd4516))
* push notifications `badge` doesn't update with Installation beforeSave trigger ([#8162](#8162)) ([3c75c2b](3c75c2b))
* query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([#8167](#8167)) ([e424137](e424137))
* relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([#8203](#8203)) ([28f0d26](28f0d26))
* security upgrade undici from 5.6.0 to 5.8.0 ([#8108](#8108)) ([4aa016b](4aa016b))
* server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([#8238](#8238)) ([c03908f](c03908f))
* session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([#8180](#8180)) ([37fed30](37fed30))
* sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([#8157](#8157)) ([3b775a1](3b775a1))
* updating object includes unchanged keys in client response for certain key types ([#8159](#8159)) ([37af1d7](37af1d7))

### Features

* add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([#8244](#8244)) ([9f11115](9f11115))
* add option to change the default value of the `Parse.Query.limit()` constraint ([#8152](#8152)) ([0388956](0388956))
* add support for MongoDB 6 ([#8242](#8242)) ([aba0081](aba0081))
* add support for Postgres 15 ([#8215](#8215)) ([2feb6c4](2feb6c4))
* liveQuery support for unsorted distance queries ([#8221](#8221)) ([0f763da](0f763da))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.4.0-alpha.1

parseplatformorg pushed a commit that referenced this pull request Nov 19, 2022
# [5.4.0](5.3.3...5.4.0) (2022-11-19)

### Bug Fixes

* authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([#8187](#8187)) ([8c8ec71](8c8ec71))
* brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([#8146](#8146)) [skip release] ([4c0c7c7](4c0c7c7))
* certificate in Apple Game Center auth adapter not validated [skip release] ([#8058](#8058)) ([75af9a2](75af9a2))
* graphQL query ignores condition `equalTo` with value `false` ([#8032](#8032)) ([7f5a15d](7f5a15d))
* internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([#8121](#8121)) ([c16f529](c16f529))
* invalid file request not properly handled [skip release] ([#8062](#8062)) ([4c9e956](4c9e956))
* liveQuery with `containedIn` not working when object field is an array ([#8128](#8128)) ([1d9605b](1d9605b))
* protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8076](#8076)) ([9fd4516](9fd4516))
* push notifications `badge` doesn't update with Installation beforeSave trigger ([#8162](#8162)) ([3c75c2b](3c75c2b))
* query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([#8167](#8167)) ([e424137](e424137))
* relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([#8203](#8203)) ([28f0d26](28f0d26))
* security upgrade undici from 5.6.0 to 5.8.0 ([#8108](#8108)) ([4aa016b](4aa016b))
* server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([#8238](#8238)) ([c03908f](c03908f))
* session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([#8180](#8180)) ([37fed30](37fed30))
* sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([#8157](#8157)) ([3b775a1](3b775a1))
* updating object includes unchanged keys in client response for certain key types ([#8159](#8159)) ([37af1d7](37af1d7))

### Features

* add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([#8244](#8244)) ([9f11115](9f11115))
* add option to change the default value of the `Parse.Query.limit()` constraint ([#8152](#8152)) ([0388956](0388956))
* add support for MongoDB 6 ([#8242](#8242)) ([aba0081](aba0081))
* add support for Postgres 15 ([#8215](#8215)) ([2feb6c4](2feb6c4))
* liveQuery support for unsorted distance queries ([#8221](#8221)) ([0f763da](0f763da))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.4.0

@parseplatformorg parseplatformorg added the state:released Released as stable version label Nov 19, 2022
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.4.0

@parseplatformorg parseplatformorg added the state:released-5.x.x Released as LTS version label Nov 19, 2022
dblythy pushed a commit to dblythy/parse-server that referenced this pull request Feb 15, 2023
* authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([parse-community#8187](parse-community#8187)) ([8c8ec71](parse-community@8c8ec71))
* brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([parse-community#8146](parse-community#8146)) [skip release] ([4c0c7c7](parse-community@4c0c7c7))
* certificate in Apple Game Center auth adapter not validated [skip release] ([parse-community#8058](parse-community#8058)) ([75af9a2](parse-community@75af9a2))
* graphQL query ignores condition `equalTo` with value `false` ([parse-community#8032](parse-community#8032)) ([7f5a15d](parse-community@7f5a15d))
* internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([parse-community#8121](parse-community#8121)) ([c16f529](parse-community@c16f529))
* invalid file request not properly handled [skip release] ([parse-community#8062](parse-community#8062)) ([4c9e956](parse-community@4c9e956))
* liveQuery with `containedIn` not working when object field is an array ([parse-community#8128](parse-community#8128)) ([1d9605b](parse-community@1d9605b))
* protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([parse-community#8076](parse-community#8076)) ([9fd4516](parse-community@9fd4516))
* push notifications `badge` doesn't update with Installation beforeSave trigger ([parse-community#8162](parse-community#8162)) ([3c75c2b](parse-community@3c75c2b))
* query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([parse-community#8167](parse-community#8167)) ([e424137](parse-community@e424137))
* relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([parse-community#8203](parse-community#8203)) ([28f0d26](parse-community@28f0d26))
* security upgrade undici from 5.6.0 to 5.8.0 ([parse-community#8108](parse-community#8108)) ([4aa016b](parse-community@4aa016b))
* server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([parse-community#8238](parse-community#8238)) ([c03908f](parse-community@c03908f))
* session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([parse-community#8180](parse-community#8180)) ([37fed30](parse-community@37fed30))
* sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([parse-community#8157](parse-community#8157)) ([3b775a1](parse-community@3b775a1))
* updating object includes unchanged keys in client response for certain key types ([parse-community#8159](parse-community#8159)) ([37af1d7](parse-community@37af1d7))

* add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([parse-community#8244](parse-community#8244)) ([9f11115](parse-community@9f11115))
* add option to change the default value of the `Parse.Query.limit()` constraint ([parse-community#8152](parse-community#8152)) ([0388956](parse-community@0388956))
* add support for MongoDB 6 ([parse-community#8242](parse-community#8242)) ([aba0081](parse-community@aba0081))
* add support for Postgres 15 ([parse-community#8215](parse-community#8215)) ([2feb6c4](parse-community@2feb6c4))
* liveQuery support for unsorted distance queries ([parse-community#8221](parse-community#8221)) ([0f763da](parse-community@0f763da))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
state:released Released as stable version state:released-5.x.x Released as LTS version state:released-alpha Released as alpha version state:released-beta Released as beta version
Projects
None yet
Development

Successfully merging this pull request may close these issues.

GraphQL query transformer drop the condition on the object field with false value
4 participants