FileUpload options for Server Config #7071

dblythy · 2020-12-14T11:10:52Z

Continuing on from #6997

codecov · 2020-12-14T11:17:19Z

Codecov Report

Merging #7071 (9b87378) into master (c46e8a5) will decrease coverage by 0.25%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #7071      +/-   ##
==========================================
- Coverage   93.89%   93.63%   -0.26%     
==========================================
  Files         169      169              
  Lines       12468    12498      +30     
==========================================
- Hits        11707    11703       -4     
- Misses        761      795      +34

Impacted Files	Coverage Δ
src/Options/index.js	`100.00% <ø> (ø)`
src/Config.js	`91.46% <100.00%> (+0.98%)`	⬆️
src/Options/Definitions.js	`100.00% <100.00%> (ø)`
src/Routers/FilesRouter.js	`88.28% <100.00%> (+1.21%)`	⬆️
src/Options/parsers.js	`6.06% <0.00%> (-93.94%)`	⬇️
src/Adapters/Storage/Mongo/MongoStorageAdapter.js	`92.84% <0.00%> (-0.68%)`	⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c46e8a5...9b87378. Read the comment docs.

dblythy · 2020-12-14T14:48:47Z

Closes #6995

mtrezza

I think the config validation is missing, see /src/Config.js.

src/Options/docs.js

spec/ParseFile.spec.js

src/Routers/FilesRouter.js

spec/ParseFile.spec.js

Moumouls · 2020-12-15T16:57:50Z

@mtrezza i think due to the last security report on the community forum, we can set public and anonymous upload to false by default 👍

mtrezza · 2020-12-15T17:00:45Z

Yes, this was already discussed in #6995 (comment).

mtrezza

@dblythy Could you give me access to the branch, so I can change some minor things in the test cases and maybe consolidate? It's probably faster than writing a review.

dblythy · 2020-12-16T14:18:27Z

Of course @mtrezza, I have shared my fork with you so you can fix all my other future PRs too 😉

davimacedo

I agree with @Moumouls that we should work in a more sustainable solution for file security (I'd be happy to see a spec proposal @Moumouls), but I am ok in having this PR merged in the meantime. I still have two concerns before merging though:

I believe that, with master key, the file should be uploaded regardless of the options;
Before merging, we need to double check if all official SDKs are sending the session token headers when uploading a file. In the case they are, we are good to go. Otherwise, I am not so sure if we should merge this now.

mtrezza · 2020-12-17T00:27:57Z

Good points, I will look into that.

@Moumouls As I mentioned earlier, please open a separate issue for your proposal and we'll be happy to discuss.

davimacedo · 2020-12-17T00:30:43Z

I've just checked the JS SDK and it looks to send the header and even has the useMasterKey option to send the master key.

dblythy · 2020-12-17T03:44:21Z

I would be more than happy to work on an overarching PR that tackles this and other requested file features.

To prevent “public” upload to every other class we use CLPs, so I think it makes sense to use the same for consistency.

However, there is obviously no _File class to set the CLPs for.

I propose creating a _File class that handles:

-Tracking of file references for cleanup
-CLPs via schema
-file get ACLs
-authorisation of GET requests using a temporary token store
-Restrictions on save and get via CLP

Although most of these features cover different issues, most of them depend on a _File class.

mtrezza · 2020-12-17T09:07:14Z

Absolutely, this makes sense, and we can see by its scope that such a PR won't be done tomorrow.

@Moumouls Improvement happens incrementally, so I'm glad to see that you also support this PR eventually and your concerns could be resolved. I'm looking forward to your proposal to further improve the approach to file security.

This is an important step towards improving Parse Server security by disabling unrestricted file upload by default. A topic that has been much debated in 2020 in our community and beyond. I'm glad we could still make this improvement this year and maybe @davimacedo can plan for a release of Parse Server in the coming days to make this improvement available. Thanks @dblythy for his work and everyone for their feedback.

dblythy · 2020-12-17T09:11:03Z

Absolutely, this makes sense, and we can see by its scope that such a PR won't be done tomorrow.

I actually have done a good 80% of this, so I don't mind if you'd prefer to wait a week or two for the PR. It's up to you guys.

Moumouls · 2020-12-17T09:13:28Z

Thanks for the status report @dblythy, if you are at 80% of the final implementation i will vote for waiting the final implementation ! 😃

mtrezza · 2020-12-17T09:21:23Z

I actually have done a good 80% of this, so I don't mind if you'd prefer to wait a week or two for the PR. It's up to you guys.

@dblythy or @Moumouls Please open a new issue for this to discuss this thoroughly in an issue to decide on an approach, rather than discuss an already done approach. The scope as you described it earlier is too broad for that.

fix tests Postgres Support Update parse to 2.19.0 (#7060) Fix Prettier (#7066) Remove cache clear on validateObjects Improve add class if not exist Improve modifying schema instead of clearing Improve enforce class exists Fix flaky Test Release 4.5.0 (#7070) * Release 4.5.0 * Update CHANGELOG.md Co-authored-by: Tom Fox <13188249+TomWFox@users.noreply.github.com> * Improve braking change note * Create a breaking changes sub-section * Add release action Co-authored-by: Tom Fox <13188249+TomWFox@users.noreply.github.com> Improve issue templates & add PR template (#7051) * improved feature suggestion template * added test case chapter to bug report template * PR wording * added PR template * improved formatting in issue template * removed checkbox for concept due to new GH discussions process * improved wording * improved PR todo list * amended PR checklist; minor rewording * removed duplicate wording * add securtiy check section to contribution guide fix PR template file location (#7074) Optimize redundant logic used in queries (#7061) * Optimize redundant logic used in queries * Added CHANGELOG * Fixed comments and code style after recommendations. * Fixed code style after recommendation. * Improved explanation in comments * Added tests to for logic optimizations * Added two test cases more and some comments * Added extra test cases and fixed issue found with them. * Removed empty lines as requested. Co-authored-by: Pedro Diaz <p.diaz@wemersive.com> FileUpload options for Server Config (#7071) * New: fileUpload options to restrict file uploads * review changes * update review * Update helper.js * added complete fileUpload values for tests * fixed config validation * allow file upload only for authenicated user by default * fixed inconsistent error messages * consolidated and extended tests * minor compacting * removed irregular whitespace * added changelog entry * always allow file upload with master key * fix lint * removed fit Co-authored-by: Manuel Trezza <trezza.m@gmail.com> Fix: context for afterFind (#7078) * Fix: context for afterFind * Update CHANGELOG.md Co-authored-by: Manuel <trezza.m@gmail.com> Fix max listener warning from livequery server (#7083) * fix max listner warning * fix * Clean test log Run definitions pg fix fix: upgrade ws from 7.4.0 to 7.4.1 (#7098) Snyk has created this PR to upgrade ws from 7.4.0 to 7.4.1. See this package in npm: https://www.npmjs.com/package/ws See this project in Snyk: https://app.snyk.io/org/acinader/project/8c1a9edb-c8f5-4dc1-b221-4d6030a323eb?utm_source=github&utm_medium=upgrade-pr fix: upgrade ldapjs from 2.2.2 to 2.2.3 (#7095) Snyk has created this PR to upgrade ldapjs from 2.2.2 to 2.2.3. See this package in npm: https://www.npmjs.com/package/ldapjs See this project in Snyk: https://app.snyk.io/org/acinader/project/8c1a9edb-c8f5-4dc1-b221-4d6030a323eb?utm_source=github&utm_medium=upgrade-pr fix: upgrade semver from 7.3.2 to 7.3.4 (#7092) Snyk has created this PR to upgrade semver from 7.3.2 to 7.3.4. See this package in npm: https://www.npmjs.com/package/semver See this project in Snyk: https://app.snyk.io/org/acinader/project/8c1a9edb-c8f5-4dc1-b221-4d6030a323eb?utm_source=github&utm_medium=upgrade-pr fix: upgrade uuid from 8.3.1 to 8.3.2 (#7101) Snyk has created this PR to upgrade uuid from 8.3.1 to 8.3.2. See this package in npm: https://www.npmjs.com/package/uuid See this project in Snyk: https://app.snyk.io/org/acinader/project/8c1a9edb-c8f5-4dc1-b221-4d6030a323eb?utm_source=github&utm_medium=upgrade-pr

parseplatformorg · 2021-11-01T16:36:18Z

🎉 This change has been released in version 5.0.0-beta.1

parseplatformorg · 2022-03-14T13:08:17Z

🎉 This change has been released in version 5.0.0

vince1995 · 2022-03-17T07:13:06Z

Is this feature anywhere documented? There's no fileUpload option in the docs.

dblythy · 2022-03-17T07:17:53Z

https://parseplatform.org/parse-server/api/5.0.0/ParseServerOptions.html
https://parseplatform.org/parse-server/api/5.0.0/FileUploadOptions.html

mtrezza · 2022-03-18T15:21:13Z

@vince1995 Where did you find that link?
https://parseplatform.org/parse-server/api/master/ParseServerOptions.html

We may have to correct that link.

vince1995 · 2022-03-21T05:30:46Z

It's multiple times hardcoded in the README. 2 times with http and 2 times with https.

mtrezza · 2022-03-21T20:05:28Z

@vince1995 Thanks, would you want to submit a PR to fix these broken links?

vince1995 · 2022-03-22T07:19:54Z

@mtrezza but what would be the correct link?

mtrezza · 2022-03-22T18:00:25Z

https://parseplatform.org/parse-server/api always redirects to the latest stable release API version

I am not sure we can use a direct link to ParseServerOptions.html anymore. The API docs are now versioned, you can access a specific version by going to https://parseplatform.org/parse-server/api/<version>/, but I don't know whether there is a "latest version by branch" path for direct links.

vince1995 · 2022-03-23T06:16:45Z

I don't know how the server works (because I don't know where the code is) but wouldn't it possible to add a middleware that checks if an version was provided in the url and if not add the latest release version?

Or the master branch has always the docs updated too?

mtrezza · 2022-03-23T11:53:53Z

Not something we want to look into at the moment, but please feel free to go ahead and change the links to the URL I mentioned above for now.

New: fileUpload options to restrict file uploads

df8be61

dblythy closed this Dec 14, 2020

dblythy reopened this Dec 14, 2020

mtrezza requested changes Dec 15, 2020

View reviewed changes

mtrezza mentioned this pull request Dec 15, 2020

Add Security Checks Log #6973

Closed

dblythy added 3 commits December 15, 2020 12:35

review changes

25dfce3

update review

9ddd58c

Update helper.js

67f0cc3

Moumouls suggested changes Dec 15, 2020

View reviewed changes

spec/ParseFile.spec.js Outdated Show resolved Hide resolved

spec/ParseFile.spec.js Show resolved Hide resolved

mtrezza reviewed Dec 16, 2020

View reviewed changes

mtrezza added 9 commits December 17, 2020 00:07

added complete fileUpload values for tests

cd26ef2

fixed config validation

af12eda

allow file upload only for authenicated user by default

4887bf1

fixed inconsistent error messages

29adffc

consolidated and extended tests

08a64cb

minor compacting

04d2dc7

removed irregular whitespace

81b0de5

Merge remote-tracking branch 'upstream/master' into FileSecurity2

8aa6963

added changelog entry

1e8378e

mtrezza requested review from davimacedo and mtrezza December 17, 2020 00:09

mtrezza approved these changes Dec 17, 2020

View reviewed changes

davimacedo requested changes Dec 17, 2020

View reviewed changes

davimacedo approved these changes Dec 17, 2020

View reviewed changes

Moumouls self-requested a review December 17, 2020 07:18

Moumouls approved these changes Dec 17, 2020

View reviewed changes

mtrezza merged commit 97c3046 into parse-community:master Dec 17, 2020

gnunicorn mentioned this pull request Dec 19, 2020

File upload fails with "Cannot read property 'enableForAnonymousUser' of undefined" #7085

Closed

4 tasks

dblythy mentioned this pull request Jan 31, 2021

Improving default File Security #6995

Closed

Vortec4800 mentioned this pull request Oct 2, 2021

Typo in new FileUpload options #7602

Closed

parseplatformorg added the state:released-beta Released as beta version label Nov 1, 2021

mtrezza mentioned this pull request Mar 12, 2022

build: release 5.0 #7851

Merged

parseplatformorg added the state:released Released as stable version label Mar 14, 2022

dblythy mentioned this pull request Mar 17, 2022

File Upload Docs parse-community/docs#866

Merged

dblythy deleted the FileSecurity2 branch March 17, 2022 07:35

mtrezza mentioned this pull request Oct 15, 2022

Restrict file download #8241

Open

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FileUpload options for Server Config #7071

FileUpload options for Server Config #7071

dblythy commented Dec 14, 2020

codecov bot commented Dec 14, 2020 •

edited

dblythy commented Dec 14, 2020

mtrezza left a comment •

edited

Moumouls commented Dec 15, 2020

mtrezza commented Dec 15, 2020

mtrezza left a comment •

edited

dblythy commented Dec 16, 2020

davimacedo left a comment •

edited

mtrezza commented Dec 17, 2020 •

edited

davimacedo commented Dec 17, 2020

dblythy commented Dec 17, 2020

mtrezza commented Dec 17, 2020 •

edited

dblythy commented Dec 17, 2020

Moumouls commented Dec 17, 2020 •

edited

mtrezza commented Dec 17, 2020 •

edited

parseplatformorg commented Nov 1, 2021

parseplatformorg commented Mar 14, 2022

vince1995 commented Mar 17, 2022

dblythy commented Mar 17, 2022

mtrezza commented Mar 18, 2022

vince1995 commented Mar 21, 2022

mtrezza commented Mar 21, 2022

vince1995 commented Mar 22, 2022

mtrezza commented Mar 22, 2022 •

edited

vince1995 commented Mar 23, 2022

mtrezza commented Mar 23, 2022

FileUpload options for Server Config #7071

FileUpload options for Server Config #7071

Conversation

dblythy commented Dec 14, 2020

codecov bot commented Dec 14, 2020 • edited

Codecov Report

dblythy commented Dec 14, 2020

mtrezza left a comment • edited

Choose a reason for hiding this comment

Moumouls commented Dec 15, 2020

mtrezza commented Dec 15, 2020

mtrezza left a comment • edited

Choose a reason for hiding this comment

dblythy commented Dec 16, 2020

davimacedo left a comment • edited

Choose a reason for hiding this comment

mtrezza commented Dec 17, 2020 • edited

davimacedo commented Dec 17, 2020

dblythy commented Dec 17, 2020

mtrezza commented Dec 17, 2020 • edited

dblythy commented Dec 17, 2020

Moumouls commented Dec 17, 2020 • edited

mtrezza commented Dec 17, 2020 • edited

parseplatformorg commented Nov 1, 2021

parseplatformorg commented Mar 14, 2022

vince1995 commented Mar 17, 2022

dblythy commented Mar 17, 2022

mtrezza commented Mar 18, 2022

vince1995 commented Mar 21, 2022

mtrezza commented Mar 21, 2022

vince1995 commented Mar 22, 2022

mtrezza commented Mar 22, 2022 • edited

vince1995 commented Mar 23, 2022

mtrezza commented Mar 23, 2022

codecov bot commented Dec 14, 2020 •

edited

mtrezza left a comment •

edited

mtrezza left a comment •

edited

davimacedo left a comment •

edited

mtrezza commented Dec 17, 2020 •

edited

mtrezza commented Dec 17, 2020 •

edited

Moumouls commented Dec 17, 2020 •

edited

mtrezza commented Dec 17, 2020 •

edited

mtrezza commented Mar 22, 2022 •

edited