Skip to content

fix: brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) #8144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 2, 2022
Merged

fix: brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) #8144

merged 1 commit into from
Sep 2, 2022

Conversation

mtrezza
Copy link
Member

@mtrezza mtrezza commented Sep 2, 2022 •
edited
Loading

@parse-github-assistant
Copy link

parse-github-assistant bot commented Sep 2, 2022 •
edited
Loading

Thanks for opening this pull request!

  • ❌ Please edit your post and use the provided template when creating a new pull request. This helps everyone to understand your post better and asks for essential information to quicker review the pull request.

@codecov
Copy link

codecov bot commented Sep 2, 2022 •
edited
Loading

Codecov Report

Merging #8144 (a2e9426) into release (309f64c) will decrease coverage by 0.46%.
The diff coverage is 100.00%.

❗ Current head a2e9426 differs from pull request most recent head b605a7d. Consider uploading reports for the commit b605a7d to get more accurate results

@@             Coverage Diff             @@
##           release    #8144      +/-   ##
===========================================
- Coverage    94.16%   93.70%   -0.47%     
===========================================
  Files          182      182              
  Lines        13669    13672       +3     
===========================================
- Hits         12872    12811      -61     
- Misses         797      861      +64
Impacted Files Coverage Δ
src/Controllers/DatabaseController.js 93.60% <100.00%> (-0.20%) ⬇️
src/RestQuery.js 95.78% <100.00%> (+0.08%) ⬆️
src/Adapters/Cache/RedisCacheAdapter.js 12.28% <0.00%> (-75.44%) ⬇️
src/batch.js 89.47% <0.00%> (-5.27%) ⬇️
src/ParseServerRESTController.js 92.42% <0.00%> (-4.55%) ⬇️
src/Adapters/Storage/Mongo/MongoStorageAdapter.js 90.59% <0.00%> (-2.57%) ⬇️
src/Adapters/Auth/gcenter.js 92.85% <0.00%> (-1.20%) ⬇️
src/Controllers/SchemaController.js 97.18% <0.00%> (-0.19%) ⬇️
src/RestWrite.js 93.94% <0.00%> (-0.16%) ⬇️
... and 1 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

This was referenced Sep 2, 2022
Merged
Merged
@mtrezza mtrezza changed the title fix: release p3c6 fix: brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) Sep 2, 2022
@mtrezza mtrezza merged commit e39d51b into parse-community:release Sep 2, 2022
parseplatformorg pushed a commit that referenced this pull request Sep 2, 2022
@semantic-release-bot
chore(release): 5.2.5 [skip ci]
83fd16c 
## [5.2.5](5.2.4...5.2.5) (2022-09-02)

### Bug Fixes

* brute force guessing of user sensitive data via search patterns; this fixes a security vulnerability in which internal and protected fields may be used as query constraints to guess the value of these fields and obtain sensitive data (GHSA-2m6g-crv8-p3c6) ([#8144](#8144)) ([e39d51b](e39d51b))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.2.5

@parseplatformorg parseplatformorg added the state:released Released as stable version label Sep 2, 2022
@mtrezza mtrezza deleted the fix-release-p3c6 branch September 3, 2022 09:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
state:released Released as stable version
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@mtrezza @parseplatformorg