fix: afterSave trigger removes pointer in Parse object #7913

dblythy · 2022-03-31T05:05:57Z

New Pull Request Checklist

I am not disclosing a vulnerability.
I am creating this PR in reference to an issue.

Issue Description

As discussed in #7912, afterSave triggers cause response object to strip out all keys on pointers.

Related issue: #7912

Approach

Skip stripping out response pointers

TODOs before merging

A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)

parse-github-assistant · 2022-03-31T05:05:59Z

Thanks for opening this pull request!

🎉 We are excited about your hands-on contribution!

codecov · 2022-03-31T05:12:42Z

Codecov Report

Merging #7913 (ed6d299) into alpha (2e750b7) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##            alpha    #7913   +/-   ##
=======================================
  Coverage   94.12%   94.13%           
=======================================
  Files         182      182           
  Lines       13622    13630    +8     
=======================================
+ Hits        12822    12830    +8     
  Misses        800      800

Impacted Files	Coverage Δ
src/Controllers/SchemaController.js	`97.36% <100.00%> (ø)`
src/RestWrite.js	`94.52% <100.00%> (+0.06%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2e750b7...ed6d299. Read the comment docs.

dblythy · 2022-03-31T05:32:13Z

Also fixes API returning unchanged keys (which can lead to a massive increase in data traffic), which was an unexpected change due to #7839. Tests cases added as well to ensure save response has required keys only.

src/RestWrite.js

Moumouls · 2022-04-12T18:55:12Z

Hi @dblythy,

I know that we have "default columns" in "SchemaController" but it seems to not fit into the use case since for example for the Parse. User class, the password will be returned.

Here I can suggest to avoid any security issues, that you can return "objectId, createdAt, updatedAt" for all classes. And just return "username" in the case of "Parse. User" RestWrite ops.

In terms of variable definitions, you could use the same architecture as the SchemaController: Define at the top of the file a "defaultMandatoryColumsInResponse" in object format like

const defaultMandatoryColumnsInResponse = Object.freeze({
  _Default: ['objectId', 'createdAt', 'updatedAt']
  _User: ['username']
}

In the future, it will be easily extensible and readable.

Moumouls · 2022-05-10T12:31:41Z

@dblythy there was an issue with the commit history, for the review, could you rebase on alpha to get a clean changes diffs. Then request me a new review 🚀

src/RestWrite.js

dblythy · 2022-05-19T04:22:20Z

Anything outstanding @mtrezza @Moumouls?

spec/CloudCode.spec.js

src/Controllers/SchemaController.js

…into fix-pointers

mtrezza

Looks good! Ready to merge?

Moumouls

LGTM

dblythy · 2022-05-20T08:17:58Z

Yep!

# [5.3.0-alpha.12](5.3.0-alpha.11...5.3.0-alpha.12) (2022-05-20) ### Bug Fixes * afterSave trigger removes pointer in Parse object ([#7913](#7913)) ([47d796e](47d796e))

parseplatformorg · 2022-05-20T08:57:30Z

🎉 This change has been released in version 5.3.0-alpha.12

# [5.3.0-beta.1](5.2.1...5.3.0-beta.1) (2022-06-17) ### Bug Fixes * afterSave trigger removes pointer in Parse object ([#7913](#7913)) ([47d796e](47d796e)) * auto-release process may fail if optional back-merging task fails ([#8051](#8051)) ([cf925e7](cf925e7)) * custom database options are not passed to MongoDB GridFS ([#7911](#7911)) ([b1e5565](b1e5565)) * depreciate allowClientClassCreation defaulting to true ([#7925](#7925)) ([38ed96a](38ed96a)) * errors in GraphQL do not show the original error but a general `Unexpected Error` ([#8045](#8045)) ([0d81887](0d81887)) * interrupted WebSocket connection not closed by LiveQuery server ([#8012](#8012)) ([2d5221e](2d5221e)) * live query role cache does not clear when a user is added to a role ([#8026](#8026)) ([199dfc1](199dfc1)) * peer dependency mismatch for GraphQL dependencies ([#7934](#7934)) ([0a6faa8](0a6faa8)) * return correct response when revert is used in beforeSave ([#7839](#7839)) ([19900fc](19900fc)) * security upgrade @parse/fs-files-adapter from 1.2.1 to 1.2.2 ([#7948](#7948)) ([3a70fda](3a70fda)) * security upgrade moment from 2.29.1 to 2.29.2 ([#7931](#7931)) ([731c550](731c550)) * security upgrade parse push adapter from 4.1.0 to 4.1.2 ([#7893](#7893)) ([93667b4](93667b4)) * websocket connection of LiveQuery interrupts frequently ([#8048](#8048)) ([03caae1](03caae1)) ### Features * add MongoDB 5.1 compatibility ([#7682](#7682)) ([022a856](022a856)) * add MongoDB 5.2 support ([#7894](#7894)) ([5bfa716](5bfa716)) * add support for Node 17 and 18 ([#7896](#7896)) ([3e9f292](3e9f292)) * align file trigger syntax with class trigger; use the new syntax `Parse.Cloud.beforeSave(Parse.File, (request) => {})`, the old syntax `Parse.Cloud.beforeSaveFile((request) => {})` has been deprecated ([#7966](#7966)) ([c6dcad8](c6dcad8)) * replace GraphQL Apollo with GraphQL Yoga ([#7967](#7967)) ([1aa2204](1aa2204)) * selectively enable / disable default authentication adapters ([#7953](#7953)) ([c1e808f](c1e808f)) * upgrade mongodb from 4.4.1 to 4.5.0 ([#7991](#7991)) ([e692b5d](e692b5d)) ### Performance Improvements * reduce database operations when using the constant parameter in Cloud Function validation ([#7892](#7892)) ([041197f](041197f))

parseplatformorg · 2022-06-17T12:40:16Z

🎉 This change has been released in version 5.3.0-beta.1

# [5.3.0](5.2.8...5.3.0) (2022-10-29) ### Bug Fixes * afterSave trigger removes pointer in Parse object ([#7913](#7913)) ([47d796e](47d796e)) * authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([#8188](#8188)) ([1a2b1b9](1a2b1b9)) * auto-release process may fail if optional back-merging task fails ([#8051](#8051)) ([cf925e7](cf925e7)) * brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([#8145](#8145)) [skip release] ([f0db4ca](f0db4ca)) * certificate in Apple Game Center auth adapter not validated [skip release] ([#8055](#8055)) ([4c2aa63](4c2aa63)) * custom database options are not passed to MongoDB GridFS ([#7911](#7911)) ([b1e5565](b1e5565)) * depreciate allowClientClassCreation defaulting to true ([#7925](#7925)) ([38ed96a](38ed96a)) * errors in GraphQL do not show the original error but a general `Unexpected Error` ([#8045](#8045)) ([0d81887](0d81887)) * interrupted WebSocket connection not closed by LiveQuery server ([#8012](#8012)) ([2d5221e](2d5221e)) * invalid file request not properly handled [skip release] ([#8061](#8061)) ([1a04a34](1a04a34)) * live query role cache does not clear when a user is added to a role ([#8026](#8026)) ([199dfc1](199dfc1)) * peer dependency mismatch for GraphQL dependencies ([#7934](#7934)) ([0a6faa8](0a6faa8)) * protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8075](#8075)) ([636d16e](636d16e)) * return correct response when revert is used in beforeSave ([#7839](#7839)) ([19900fc](19900fc)) * security upgrade @parse/fs-files-adapter from 1.2.1 to 1.2.2 ([#7948](#7948)) ([3a70fda](3a70fda)) * security upgrade moment from 2.29.1 to 2.29.2 ([#7931](#7931)) ([731c550](731c550)) * security upgrade parse push adapter from 4.1.0 to 4.1.2 ([#7893](#7893)) ([93667b4](93667b4)) * server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([#8237](#8237)) ([4c1befa](4c1befa)) * session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([#8181](#8181)) ([83cdc89](83cdc89)) * websocket connection of LiveQuery interrupts frequently ([#8048](#8048)) ([03caae1](03caae1)) ### Features * add MongoDB 5.1 compatibility ([#7682](#7682)) ([022a856](022a856)) * add MongoDB 5.2 support ([#7894](#7894)) ([5bfa716](5bfa716)) * add support for Node 17 and 18 ([#7896](#7896)) ([3e9f292](3e9f292)) * align file trigger syntax with class trigger; use the new syntax `Parse.Cloud.beforeSave(Parse.File, (request) => {})`, the old syntax `Parse.Cloud.beforeSaveFile((request) => {})` has been deprecated ([#7966](#7966)) ([c6dcad8](c6dcad8)) * replace GraphQL Apollo with GraphQL Yoga ([#7967](#7967)) ([1aa2204](1aa2204)) * selectively enable / disable default authentication adapters ([#7953](#7953)) ([c1e808f](c1e808f)) * upgrade mongodb from 4.4.1 to 4.5.0 ([#7991](#7991)) ([e692b5d](e692b5d)) ### Performance Improvements * reduce database operations when using the constant parameter in Cloud Function validation ([#7892](#7892)) ([041197f](041197f))

parseplatformorg · 2022-10-29T19:15:50Z

🎉 This change has been released in version 5.3.0

dblythy requested a review from a team March 31, 2022 07:56

mtrezza reviewed Mar 31, 2022

View reviewed changes

src/RestWrite.js Outdated Show resolved Hide resolved

src/RestWrite.js Show resolved Hide resolved

Moumouls suggested changes Apr 3, 2022

View reviewed changes

src/RestWrite.js Outdated Show resolved Hide resolved

mtrezza force-pushed the alpha branch 2 times, most recently from 59215e6 to e6d7d8f Compare May 1, 2022 02:29

dblythy added 7 commits May 10, 2022 15:04

fix pointers

96aa29a

check save response

3e88cf0

Update RestWrite.js

41703ca

Update RestWrite.js

dd59f2a

Update RestWrite.js

8dbdbbc

Update RestWrite.js

5e53a48

Update RestWrite.js

49f7665

dblythy force-pushed the fix-pointers branch from 0440323 to 49f7665 Compare May 10, 2022 13:04

dblythy requested a review from a team May 10, 2022 13:15

mtrezza reviewed May 10, 2022

View reviewed changes

src/RestWrite.js Outdated Show resolved Hide resolved

dblythy added 4 commits May 11, 2022 15:00

add requiredColumns

9362fbb

Update SchemaController.js

519beae

rename

b3a136b

Merge branch 'alpha' into fix-pointers

704551b

dblythy requested a review from a team May 11, 2022 11:34

Merge branch 'alpha' into fix-pointers

52fa70a

mtrezza requested changes May 19, 2022

View reviewed changes

spec/CloudCode.spec.js Outdated Show resolved Hide resolved

spec/CloudCode.spec.js Outdated Show resolved Hide resolved

src/Controllers/SchemaController.js Outdated Show resolved Hide resolved

rename

16c68b9

dblythy requested a review from mtrezza May 19, 2022 12:15

Merge branch 'alpha' into fix-pointers

17300cb

mtrezza requested changes May 19, 2022

View reviewed changes

src/Controllers/SchemaController.js Show resolved Hide resolved

src/Controllers/SchemaController.js Outdated Show resolved Hide resolved

dblythy added 2 commits May 20, 2022 12:11

Update SchemaController.js

55768a7

Merge branch 'fix-pointers' of https://github.com/dblythy/parse-server …

ed6d299

…into fix-pointers

mtrezza approved these changes May 20, 2022

View reviewed changes

Moumouls approved these changes May 20, 2022

View reviewed changes

mtrezza changed the title ~~fix: fix afterSave stripping out pointers~~ fix: afterSave trigger removes pointer in Parse object May 20, 2022

mtrezza merged commit 47d796e into parse-community:alpha May 20, 2022

parseplatformorg added the state:released-alpha Released as alpha version label May 20, 2022

dblythy deleted the fix-pointers branch May 20, 2022 10:09

parseplatformorg added the state:released-beta Released as beta version label Jun 17, 2022

parseplatformorg added the state:released Released as stable version label Oct 29, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: afterSave trigger removes pointer in Parse object #7913

fix: afterSave trigger removes pointer in Parse object #7913

dblythy commented Mar 31, 2022 •

edited

Loading

parse-github-assistant bot commented Mar 31, 2022 •

edited

Loading

codecov bot commented Mar 31, 2022 •

edited

Loading

dblythy commented Mar 31, 2022

Moumouls commented Apr 12, 2022

Moumouls commented May 10, 2022

dblythy commented May 19, 2022

mtrezza left a comment

Moumouls left a comment

dblythy commented May 20, 2022

parseplatformorg commented May 20, 2022

parseplatformorg commented Jun 17, 2022

parseplatformorg commented Oct 29, 2022

fix: afterSave trigger removes pointer in Parse object #7913

fix: afterSave trigger removes pointer in Parse object #7913

Conversation

dblythy commented Mar 31, 2022 • edited Loading

New Pull Request Checklist

Issue Description

Approach

TODOs before merging

parse-github-assistant bot commented Mar 31, 2022 • edited Loading

Thanks for opening this pull request!

codecov bot commented Mar 31, 2022 • edited Loading

Codecov Report

dblythy commented Mar 31, 2022

Moumouls commented Apr 12, 2022

Moumouls commented May 10, 2022

dblythy commented May 19, 2022

mtrezza left a comment

Choose a reason for hiding this comment

Moumouls left a comment

Choose a reason for hiding this comment

dblythy commented May 20, 2022

parseplatformorg commented May 20, 2022

parseplatformorg commented Jun 17, 2022

parseplatformorg commented Oct 29, 2022

dblythy commented Mar 31, 2022 •

edited

Loading

parse-github-assistant bot commented Mar 31, 2022 •

edited

Loading

codecov bot commented Mar 31, 2022 •

edited

Loading