joe/kami-parse-server
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: improve security by deprecating creating users with public access by default (#7319)

Browse Source
This commit is contained in:
dblythy
2021-10-08 14:24:20 +11:00
committed by GitHub
parent 2b5bf2261b
commit 484c2e81ca
10 changed files with 86 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src/Security/CheckGroups/CheckGroupServerConfig.js
View File

@@ -8,9 +8,9 @@ import Config from '../../Config';
import Parse from 'parse/node';
/**
* The security checks group for Parse Server configuration.
* Checks common Parse Server parameters such as access keys.
*/
* The security checks group for Parse Server configuration.
* Checks common Parse Server parameters such as access keys.
*/
class CheckGroupServerConfig extends CheckGroup {
setName() {
return 'Parse Server Configuration';
@@ -21,7 +21,8 @@ class CheckGroupServerConfig extends CheckGroup {
new Check({
title: 'Secure master key',
warning: 'The Parse Server master key is insecure and vulnerable to brute force attacks.',
solution: 'Choose a longer and/or more complex master key with a combination of upper- and lowercase characters, numbers and special characters.',
solution:
'Choose a longer and/or more complex master key with a combination of upper- and lowercase characters, numbers and special characters.',
check: () => {
const masterKey = config.masterKey;
const hasUpperCase = /[A-Z]/.test(masterKey);
@@ -40,8 +41,9 @@ class CheckGroupServerConfig extends CheckGroup {
}),
new Check({
title: 'Security log disabled',
warning: 'Security checks in logs may expose vulnerabilities to anyone access to logs.',
solution: 'Change Parse Server configuration to \'security.enableCheckLog: false\'.',
warning:
'Security checks in logs may expose vulnerabilities to anyone with access to logs.',
solution: "Change Parse Server configuration to 'security.enableCheckLog: false'.",
check: () => {
if (config.security && config.security.enableCheckLog) {
throw 1;
@@ -50,14 +52,26 @@ class CheckGroupServerConfig extends CheckGroup {
}),
new Check({
title: 'Client class creation disabled',
warning: 'Attackers are allowed to create new classes without restriction and flood the database.',
solution: 'Change Parse Server configuration to \'allowClientClassCreation: false\'.',
warning:
'Attackers are allowed to create new classes without restriction and flood the database.',
solution: "Change Parse Server configuration to 'allowClientClassCreation: false'.",
check: () => {
if (config.allowClientClassCreation || config.allowClientClassCreation == null) {
throw 1;
}
},
}),
new Check({
title: 'Users are created without public access',
warning:
'Users with public read access are exposed to anyone who knows their object IDs, or to anyone who can query the Parse.User class.',
solution: "Change Parse Server configuration to 'enforcePrivateUsers: true'.",
check: () => {
if (!config.enforcePrivateUsers) {
throw 1;
}
},
}),
];
}
}