Installation class cannot be accessible only with master key

[mtrezza]

Issue Description

From the client SDKs it seems that the Installation class is intended to be fully accessible to the user and cannot be made accessible only with the master key.

For example in Android SDK the ParseInstallation.getCurrentInstallation() does not expose all the fields it sends to the server when calling save() such as timeZone. This means that it is not easily possible to set the Installation to be accessible with master key only and use a cloud code function to create / update the Installation object. So a user can read and manipulate their Installation object.

Steps to reproduce

...

Expected Results

It should be possible to make the Installation class only accessible with master key.

Suggested Solution

It should be possible to use a cloud code function to create / update the fields of an Installation object.

Actual Outcome

There seems to be no way to not expose all fields of the Installation object to the user.

Environment Setup

• Server
  • parse-server version (Be specific! Don't say 'latest'.) : 3.x
  • parse-client android SDK version: 1.20.0

Logs/Trace

...

[davimacedo]

I didn't get the idea. Could you write a code example of what you wanted to run in the cloud code, what is the current result and what you expected to have?

[mtrezza]

The basic idea is that it should be possible to completely seal off the database objects from direct client SDK access and run all client-server communication through cloud code functions instead.

For example, instead of calling:

ParseInstallation.getCurrentInstallation().setDeviceToken(myDeviceToken);
ParseInstallation.getCurrentInstallation().saveInBackground(null);

I want to call a cloud code function instead:

HashMap<String, Object> params = new HashMap<>();
params.put("deviceToken", myDeviceToken);

ParseCloud.callFunctionInBackground("saveCurrentInstallation", params, null);

But this is not possible because there are several values of the Installation class that are composed SDK internally and not exposed. For example to set the value of timeZone as a cloud code function parameter, it should be accessible like this, which it currently is not:

String myTimeZone = ParseInstallation.getCurrentInstallation().getTimeZone();

Because the fields are not exposed, the Installation class requires at least read/write access on a user level. That exposes at least all custom fields of the Installation object to the client which opens the Installation object to arbitrary manipulation by the user. I would consider this to be a conceptual security issue.

[davimacedo]

So I understand that your suggestion is adding access methods (like ParseInstallation.getCurrentInstallation().getTimeZone()) in the ParseInstallation class of Android SDK, right?

[mtrezza]

If it is actually that simple. There seems to be some automated writing and reading happening for the Installation object by the client SDK.

I’d have to take a look into the SDK but it seems that the Installation object is currently designed to be directly accessible by the client SDK.

So task would be to see if/which automated reads/writes there are happening and then come up with a suggestion how to disintegrate. But before doing that I wanted to bring up the topic to see if anyone has any thoughts on that.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[mtrezza]

Yeah, I'll do the missing research asap.