From ea0921351159a2938f85a4c89b681ba1f56fe980 Mon Sep 17 00:00:00 2001
From: Drew Gross <drew.a.gross@gmail.com>
Date: Wed, 18 May 2016 16:26:59 -0700
Subject: [PATCH] lift query key validation out of transformWhere

---
 src/Adapters/Storage/Mongo/MongoStorageAdapter.js |  6 +++++-
 src/Adapters/Storage/Mongo/MongoTransform.js      | 10 ++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/Adapters/Storage/Mongo/MongoStorageAdapter.js b/src/Adapters/Storage/Mongo/MongoStorageAdapter.js
index 9096d4b8..949ef1cc 100644
--- a/src/Adapters/Storage/Mongo/MongoStorageAdapter.js
+++ b/src/Adapters/Storage/Mongo/MongoStorageAdapter.js
@@ -25,6 +25,7 @@ const storageAdapterAllCollections = mongoAdapter => {
   });
 }
 
+const specialQuerykeys = ['$and', '$or', '_rperm', '_wperm', '_perishable_token', '_email_verify_token'];
 export class MongoStorageAdapter {
   // Private
   _uri: string;
@@ -187,7 +188,10 @@ export class MongoStorageAdapter {
       if (query.ACL) {
         throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Cannot query on ACL.');
       }
-      let mongoWhere = transform.transformWhere(className, query, { validate }, schema);
+      if (validate && Object.keys(query).some(restKey => !specialQuerykeys.includes(restKey) && !restKey.match(/^[a-zA-Z][a-zA-Z0-9_\.]*$/))) {
+        throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, `Invalid key name: ${restKey}`);
+      }
+      let mongoWhere = transform.transformWhere(className, query, schema);
       return collection.deleteMany(mongoWhere)
     })
     .then(({ result }) => {
diff --git a/src/Adapters/Storage/Mongo/MongoTransform.js b/src/Adapters/Storage/Mongo/MongoTransform.js
index a7aee55a..279888c9 100644
--- a/src/Adapters/Storage/Mongo/MongoTransform.js
+++ b/src/Adapters/Storage/Mongo/MongoTransform.js
@@ -172,6 +172,11 @@ function transformQueryKeyValue(className, key, value, schema) {
     }
     if (value.some(subQuery => subQuery.ACL)) {
       throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Cannot query on ACL.');
+      Object.keys(subQuery).forEach(restKey => {
+        if (!specialQuerykeys.includes(restKey) && !restKey.match(/^[a-zA-Z][a-zA-Z0-9_\.]*$/)) {
+          throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, `Invalid key name: ${restKey}`);
+        }
+      });
     }
     return {key: '$or', value: value.map(subQuery => transformWhere(className, subQuery, {}, schema))};
   case '$and':
@@ -180,6 +185,11 @@ function transformQueryKeyValue(className, key, value, schema) {
     }
     if (value.some(subQuery => subQuery.ACL)) {
       throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Cannot query on ACL.');
+      Object.keys(subQuery).forEach(restKey => {
+        if (!specialQuerykeys.includes(restKey) && !restKey.match(/^[a-zA-Z][a-zA-Z0-9_\.]*$/)) {
+          throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, `Invalid key name: ${restKey}`);
+        }
+      });
     }
     return {key: '$and', value: value.map(subQuery => transformWhere(className, subQuery, {}, schema))};
   default: