Prevent invalid column names (className and length) (#7053)

* Prevent invalid column names

* remove className as invalid

* remove className from beforeSave hook response

* improve tests

spec/CloudCode.spec.js

@@ -216,6 +216,21 @@ describe('Cloud Code', () => {
     );
   });
 
+  it('test beforeSave with invalid field', async () => {
+    Parse.Cloud.beforeSave('BeforeSaveChanged', function (req) {
+      req.object.set('length', 0);
+    });
+
+    const obj = new Parse.Object('BeforeSaveChanged');
+    obj.set('foo', 'bar');
+    try {
+      await obj.save();
+      fail('should not succeed');
+    } catch (e) {
+      expect(e.message).toBe('Invalid field name: length.');
+    }
+  });
+
   it("test beforeSave changed object fail doesn't change object", async function () {
     Parse.Cloud.beforeSave('BeforeSaveChanged', function (req) {
       if (req.object.has('fail')) {

spec/ParseObject.spec.js

@@ -701,29 +701,24 @@ describe('Parse.Object testing', () => {
       });
   });
 
-  it('length attribute', function (done) {
+  it('acl attribute', function (done) {
     Parse.User.signUp('bob', 'password').then(function (user) {
       const TestObject = Parse.Object.extend('TestObject');
       const obj = new TestObject({
-        length: 5,
         ACL: new Parse.ACL(user), // ACLs cause things like validation to run
       });
-      equal(obj.get('length'), 5);
       ok(obj.get('ACL') instanceof Parse.ACL);
 
       obj.save().then(function (obj) {
-        equal(obj.get('length'), 5);
         ok(obj.get('ACL') instanceof Parse.ACL);
 
         const query = new Parse.Query(TestObject);
         query.get(obj.id).then(function (obj) {
-          equal(obj.get('length'), 5);
           ok(obj.get('ACL') instanceof Parse.ACL);
 
           const query = new Parse.Query(TestObject);
           query.find().then(function (results) {
             obj = results[0];
-            equal(obj.get('length'), 5);
             ok(obj.get('ACL') instanceof Parse.ACL);
 
             done();
@@ -733,6 +728,21 @@ describe('Parse.Object testing', () => {
     });
   });
 
+  it('cannot save object with invalid field', async () => {
+    const invalidFields = ['className', 'length'];
+    const promises = invalidFields.map(async field => {
+      const obj = new TestObject();
+      obj.set(field, 'bar');
+      try {
+        await obj.save();
+        fail('should not succeed');
+      } catch (e) {
+        expect(e.message).toBe(`Invalid field name: ${field}.`);
+      }
+    });
+    await Promise.all(promises);
+  });
+
   it('old attribute unset then unset', function (done) {
     const TestObject = Parse.Object.extend('TestObject');
     const obj = new TestObject();

spec/ParseQuery.spec.js

@@ -2860,33 +2860,6 @@ describe('Parse.Query testing', () => {
     });
   });
 
-  it('object with length', function (done) {
-    const TestObject = Parse.Object.extend('TestObject');
-    const obj = new TestObject();
-    obj.set('length', 5);
-    equal(obj.get('length'), 5);
-    obj.save().then(
-      function () {
-        const query = new Parse.Query(TestObject);
-        query.find().then(
-          function (results) {
-            equal(results.length, 1);
-            equal(results[0].get('length'), 5);
-            done();
-          },
-          function (error) {
-            ok(false, error.message);
-            done();
-          }
-        );
-      },
-      function (error) {
-        ok(false, error.message);
-        done();
-      }
-    );
-  });
-
   it('include user', function (done) {
     Parse.User.signUp('bob', 'password', { age: 21 }).then(function (user) {
       const TestObject = Parse.Object.extend('TestObject');