Sanitizes RestWrite.data before passing to inflated object

spec/ParseUser.spec.js

@@ -2006,5 +2006,23 @@ describe('Parse.User testing', () => {
       done();
     })
   });
-});
 
+  it('should aftersave with full object', (done) => {
+    var hit = 0;
+    Parse.Cloud.afterSave('_User', (req, res) => {
+      hit++;
+      expect(req.object.get('username')).toEqual('User');
+      res.success();
+    });
+    let user = new Parse.User()
+    user.setUsername('User');
+    user.setPassword('pass');
+    user.signUp().then(()=> {
+      user.set('hello', 'world');
+      return user.save();
+    }).then(() => {
+      Parse.Cloud._removeHook('Triggers', 'afterSave', '_User');
+      done();
+    });
+  })
+});

src/RestWrite.js

@@ -154,7 +154,7 @@ RestWrite.prototype.runBeforeTrigger = function() {
     // This is an update for existing object.
     originalObject = triggers.inflate(extraData, this.originalData);
   }
-  updatedObject.set(Parse._decode(undefined, this.data));
+  updatedObject.set(this.sanitizedData());
 
   return Promise.resolve().then(() => {
     return triggers.maybeRunTrigger(triggers.Types.beforeSave, this.auth, updatedObject, originalObject, this.config.applicationId);
@@ -770,7 +770,7 @@ RestWrite.prototype.runAfterTrigger = function() {
   // Build the inflated object, different from beforeSave, originalData is not empty
   // since developers can change data in the beforeSave.
   let updatedObject = triggers.inflate(extraData, this.originalData);
-  updatedObject.set(Parse._decode(undefined, this.data));
+  updatedObject.set(this.sanitizedData());
   updatedObject._handleSaveResponse(this.response.response, this.response.status || 200);
 
   triggers.maybeRunTrigger(triggers.Types.afterSave, this.auth, updatedObject, originalObject, this.config.applicationId);
@@ -789,5 +789,17 @@ RestWrite.prototype.objectId = function() {
   return this.data.objectId || this.query.objectId;
 };
 
+// Returns a copy of the data and delete bad keys (_auth_data, _hashed_password...)
+RestWrite.prototype.sanitizedData = function() {
+  let data = Object.keys(this.data).reduce((data, key) => {
+    // Regexp comes from Parse.Object.prototype.validate
+    if (!(/^[A-Za-z][0-9A-Za-z_]*$/).test(key)) {
+      delete data[key];
+    }
+    return data;
+  }, deepcopy(this.data));
+  return Parse._decode(undefined, data);
+}
+
 export default RestWrite;
 module.exports = RestWrite;