Commit Graph

390 Commits

Author SHA1 Message Date
Manuel
7cb266b207 refactor: Prototype pollution via Cloud Code Webhooks; fixes security vulnerability [GHSA-93vw-8fm5-p2jf](https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf) (#8308) 2022-11-10 00:24:42 +01:00
dblythy
28f0d26677 fix: relation constraints in compound queries Parse.Query.or, Parse.Query.and not working (#8203) 2022-10-24 12:45:17 +02:00
dblythy
3b775a1fb8 fix: sorting by non-existing value throws INVALID_SERVER_ERROR on Postgres (#8157) 2022-09-17 20:41:45 +02:00
Manuel
4c0c7c77b7 fix: brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) (#8146) [skip release] 2022-09-02 21:43:31 +02:00
Manuel
9fd4516cde fix: protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] (#8076) 2022-06-30 13:01:40 +02:00
dblythy
199dfc1722 fix: live query role cache does not clear when a user is added to a role (#8026) 2022-06-11 10:21:55 +02:00
Antoine Cormouls
0cd902b8c2 refactor: upgrade GraphQL dependencies (#7970) 2022-06-10 14:01:45 +02:00
dblythy
47d796ea58 fix: afterSave trigger removes pointer in Parse object (#7913) 2022-05-20 10:47:38 +02:00
dblythy
b1e5565b22 fix: custom database options are not passed to MongoDB GridFS (#7911) 2022-05-01 04:21:40 +02:00
Manuel
0d6f9e951d fix: sensitive keyword detection may produce false positives (#7881) 2022-03-24 02:54:07 +01:00
Manuel
0c1b75fcbe Merge branch 'beta' into build-release-beta-19837863611 2022-03-15 00:56:54 +01:00
Manuel
e569f402b1 fix: security vulnerability that allows remote code execution (GHSA-p6h4-93qp-jhcm) (#7844) 2022-03-12 14:47:23 +01:00
Manuel
971adb5438 fix: security vulnerability that allows remote code execution (GHSA-p6h4-93qp-jhcm) (#7843) 2022-03-12 13:49:57 +01:00
Corey
a5ffb95022 refactor: remove deprecated url.parse() method (#7751) 2022-01-06 15:26:00 +01:00
Corey
0c3feaaa17 feat: add Idempotency to Postgres (#7750) 2022-01-02 19:25:53 +01:00
Corey
caf4a2341f feat: support postgresql protocol in database URI (#7757) 2022-01-02 15:25:43 +01:00
Ben Devore
6a6248b6cb fix: adding or modifying a nested property requires addField permissions (#7679) 2021-12-07 00:52:59 +01:00
Corey
c789f6c979 refactor: test moved to correct test group (#7717) 2021-11-25 19:16:46 +01:00
Samuel Denis-D'Ortun
25d5c30be2 feat: add user-defined schema and migrations (#7418) 2021-11-01 14:28:49 +01:00
Kingtous
174886e385 fix: combined and query with relational query condition returns incorrect results (#7593) 2021-10-29 19:03:50 +02:00
dblythy
caee281bc5 fix: allow LiveQuery on Parse.Session (#7554) 2021-10-08 17:24:33 +02:00
Manuel
24188a39a7 refactor: remove restricted session field (#7543)
* add issue bot for prs

* Update CHANGELOG.md

* Update issue-bot.yml

* remove session restriction artifacts

* Update CHANGELOG.md

* Update CHANGELOG.md
2021-09-04 03:03:46 +02:00
Manuel
c56d326b17 Add circular dependency detection to CI (#7316)
* add circular dependency detection to CI

* fixed Auth-RestWrite circular dependency

* updated package lock

* fixed Logger circular dependency

* fix lint
2021-04-07 20:47:57 -05:00
Diamond Lewis
a02014f557 Improve single schema cache (#7214)
* Initial Commit

* fix flaky test

* temporary set ci timeout

* turn off ci check

* fix postgres tests

* fix tests

* node flaky test

* remove improvements

* Update SchemaPerformance.spec.js

* fix tests

* revert ci

* Create Singleton Object

* properly clear cache testing

* Cleanup

* remove fit

* try PushController.spec

* try push test rewrite

* try push enqueue time

* Increase test timeout

* remove pg server creation test

* xit push tests

* more xit

* remove skipped tests

* Fix conflicts

* reduce ci timeout

* fix push tests

* Revert "fix push tests"

This reverts commit 05aba62f1cbbca7d5d3e80b9444529f59407cb56.

* improve initialization

* fix flaky tests

* xit flaky test

* Update CHANGELOG.md

* enable debug logs

* Update LogsRouter.spec.js

* create initial indexes in series

* lint

* horizontal scaling documentation

* Update Changelog

* change horizontalScaling db option

* Add enableSchemaHooks option

* move enableSchemaHooks to databaseOptions
2021-03-16 16:05:36 -05:00
Diamond Lewis
1666c3e382 [WIP] Enable test suite to be randomized (#7265)
* initial run

* Update ParseGraphQLServer.spec.js

* temporarily enable reporter

* Bump retry limit

* fix undefined database

* try to catch error

* Handle LiveQueryServers

* Update Config.js

* fast-fail false

* Remove usage of AppCache

* oops

* Update contributing guide

* enable debugger, try network retry attempt 1

* Fix ldap unbinding

* move non specs to support

* add missing mock adapter

* fix Parse.Push

* RestController should match batch.spec.js

* Remove request attempt limit

* handle index.spec.js

* Update CHANGELOG.md

* Handle error: tuple concurrently updated

* test transactions

* Clear RedisCache after every test

* LoggerController.spec.js

* Update schemas.spec.js

* finally fix transactions

* fix geopoint deadlock

* transaction with clean database

* batch.spec.js
2021-03-15 02:04:09 -05:00
Diamond Lewis
39fa17f914 Postgres: Properly initialize database on startup and debugger (#7255)
* PG: Properly initialize database

* fix flaky tests

* flaky test

* correct test

* no idea

* clean up debugger
2021-03-10 11:31:35 -08:00
dblythy
e53b6c2f87 run prettier (#7172) 2021-02-12 10:18:49 +01:00
Manuel
08b2ea45b0 Add account unlock on password reset (#7146)
* added account unlock on password reset

* added account policy option

* added changelog entry

* Added docs entry

* moved changelog entry to correct position

* improved tests to ensure requesting password reset email does not unlock account

* run prettier
2021-02-01 01:07:04 +01:00
jack092123
f846deaae3 Fix schemaCacheTTL ParseServerOption is not working (#7138)
* Add Test case for checking SchemaCacheTTL

* Fix schemaCacheTTL not working issue

* Add Test case for TTL expires

Co-authored-by: Roach Chang <roach.chang@aoitek.com>
2021-01-25 11:04:19 -06:00
Nikita
e592212b97 Supporting patterns in classNames for Live Queries (#7131)
* Parse LiveQuery Server. Supporting patterns in classNames.

* Parse LiveQuery Server. Supporting patterns in classNames. Small optimisation.

* Parse LiveQuery Server. Supporting patterns in classNames. Adding info to changelog.

* Parse LiveQuery Server. Supporting patterns in classNames. Test case.
2021-01-19 17:19:11 -05:00
Pedro Diaz
c46e8a525d Optimize redundant logic used in queries (#7061)
* Optimize redundant logic used in queries

* Added CHANGELOG

* Fixed comments and code style after recommendations.

* Fixed code style after recommendation.

* Improved explanation in comments

* Added tests to for logic optimizations

* Added two test cases more and some comments

* Added extra test cases and fixed issue found with them.

* Removed empty lines as requested.

Co-authored-by: Pedro Diaz <p.diaz@wemersive.com>
2020-12-15 23:41:14 -06:00
Diamond Lewis
ca1b78220f Prevent invalid column names (className and length) (#7053)
* Prevent invalid column names

* remove className as invalid

* remove className from beforeSave hook response

* improve tests
2020-12-09 12:19:15 -06:00
dblythy
e88f2e38f9 Feature: Reuse tokens if they haven't expired (#7017)
* Reuse tokens if they haven't expired

* Fix failing tests

* Update UserController.js

* Update tests

* Tests for invalid config

* restart tests
2020-11-25 09:30:52 -08:00
Diamond Lewis
e6ac3b6932 fix(prettier): Properly handle lint-stage files (#6970)
Now handles top level files and recursive files in folders.

Set max line length to be 100
2020-10-25 15:06:58 -05:00
Danaru
84896dbeec Set objectId into query for Email Validation (#6930)
* Retrieve user concerned by email verification and ser objectId into query

* Linter ok

* Testing live query fired when email validation done

* Setting objectId into query if user exists

* Setting objectId into query if user exists
2020-10-09 08:21:34 -07:00
Antoine Cormouls
62048260c9 GraphQL: Optimize queries, fixes some null returns (on object), fix stitched GraphQLUpload (#6709)
* Optimize query, fixes some null returns, fix stitched GraphQLUpload

* Fix authData key selection

* Prefer Iso string since other GraphQL solutions use this format

* fix tests

Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-10-01 15:19:26 -07:00
Antonio Davi Macedo Coelho de Castro
6f060e0909 Release 4.3.0 (#6811)
* Release version 4.3.0

* Update CHANGELOG.md

Co-authored-by: Tom Fox <13188249+TomWFox@users.noreply.github.com>

* Update CHANGELOG.md

Co-authored-by: Tom Fox <13188249+TomWFox@users.noreply.github.com>

* Update CHANGELOG.md

Co-authored-by: Tom Fox <13188249+TomWFox@users.noreply.github.com>

* Update CHANGELOG.md

Co-authored-by: Tom Fox <13188249+TomWFox@users.noreply.github.com>

Co-authored-by: Tom Fox <13188249+TomWFox@users.noreply.github.com>
2020-07-19 10:37:36 -07:00
mess-lelouch
d69833332c Optimizing pointer CLP query decoration done by DatabaseController#addPointerPermissions (#6747)
* Optimize CLP pointer query

* remove console log

* Update changelog

* Fix flow type checker issues

* Remove unused properties

* Fix typo, add one more test case for coverage

* Add support for CLP entry of type Object

Co-authored-by: Musa Yassin-Fort <musa.yassin@bureapr.com>
Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-07-17 13:14:43 -05:00
Manuel
3bd5684f67 Add idempotency (#6748)
* added idempotency router and middleware

* added idempotency rules for routes classes, functions, jobs, installaions, users

* fixed typo

* ignore requests without header

* removed unused var

* enabled feature only for MongoDB

* changed code comment

* fixed inconsistend storage adapter specification

* Trigger notification

* Travis CI trigger

* Travis CI trigger

* Travis CI trigger

* rebuilt option definitions

* fixed incorrect import path

* added new request ID header to allowed headers

* fixed typescript typos

* add new system class to spec helper

* fixed typescript typos

* re-added postgres conn parameter

* removed postgres conn parameter

* fixed incorrect schema for index creation

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* trying to fix postgres issue

* fixed incorrect auth when writing to _Idempotency

* trying to fix postgres issue

* Travis CI trigger

* added test cases

* removed number grouping

* fixed test description

* trying to fix postgres issue

* added Github readme docs

* added change log

* refactored tests; fixed some typos

* fixed test case

* fixed default TTL value

* Travis CI Trigger

* Travis CI Trigger

* Travis CI Trigger

* added test case to increase coverage

* Trigger Travis CI

* changed configuration syntax to use regex; added test cases

* removed unused vars

* removed IdempotencyRouter

* Trigger Travis CI

* updated docs

* updated docs

* updated docs

* updated docs

* update docs

* Trigger Travis CI

* fixed coverage

* removed code comments
2020-07-15 13:10:33 -05:00
Diamond Lewis
142eaa71bd Run Prettier JS #2 (#6796) 2020-07-13 15:13:08 -07:00
Diamond Lewis
e6a6354b29 Run Prettier JS (#6795) 2020-07-13 13:06:52 -05:00
Corey
5426f5a4f7 Add file bucket encryption using fileKey (#6765)
* add fileKey encryption to GridFSBucketStorageAdapter

* remove fileAdapter options from test spec

* ensure promise doesn't fall through in getFileData

* switch secretKey to fileKey
2020-07-01 18:43:26 -05:00
Diamond Lewis
370215a39b Support Metadata in GridFSAdapter (#6660)
* Support Metadata in GridFSAdapter

* Useful for testing in the JS SDK
* Adds new endpoint to be used with `Parse.File.getData`
* Allows file adapters to return tags as well as future data.

* fix tests

* Make getMetadata optional

* Revert "fix tests"

This reverts commit 7706da13c688027483974e854b5b24321fb070cd.

* improve coverage
2020-05-08 15:32:20 -05:00
Noah Silas
19086a8112 perf: Allow covering relation queries with minimal index (#6581)
* Apply linter changes on files I'm about to update

My actual changes were quite difficult to find when buried in this sea
of style changes, which were getting automatically applied during a
pre-commit hook. Here I just run the hooks against the files I'm going
to be touching in the following commit, so that a reviewer can ignore
these automatically generated diffs and just view the meaningful commit.

* perf: Allow covering relation queries with minimal index

When finding objects through a relation, we're sending Mongo queries
that look like this:
```
db.getCollection('_Join:foo:bar').find({ relatedId: { $in: [...] } });
```

From the result of that query, we're only reading the `owningId` field,
so we can start by adding it as a projection:
```
db.getCollection('_Join:foo:bar')
  .find({ relatedId: { $in: [...] } })
  .project({ owningId: 1 });
```

This seems like the perfect example of a query that could be satisfied
with an index scan: we are querying on one field, and only need one
field from the matching document.

For example, this can allow users to speed up the fetching of user roles
in authentication, because they query a `roles` relation on the `_Role`
collection. To add a covering index on that, you could now add an index
like the following:
```
db.getCollection('_Join:roles:_Role').createIndex(
  { relatedId: 1, owningId: 1 },
  { background: true }
);
```

One caveat there is that the index I propose above doesn't include the
`_id` column. For the query in question, we don't actually care about
the ID of the row in the join table, just the `owningId` field, so we
can avoid some overhead of putting the `_id` column into the index if we
can also drop it from the projection. This requires adding a small
special case to the MongoStorageAdapter, because the `_id` field is
special: you have to opt-out of using it by projecting `{ _id: 0 }`.
2020-04-08 11:43:45 -07:00
stevestencil
a9dba442b1 Add file triggers and file meta data (#6344)
* added hint to aggregate

* added support for hint in query

* added else clause to aggregate

* fixed tests

* updated tests

* Add tests and clean up

* added beforeSaveFile and afterSaveFile triggers

* Add support for explain

* added some validation

* added support for metadata and tags

* tests?

* trying tests

* added tests

* fixed failing tests

* added some docs for fileObject

* updated hooks to use Parse.File

* added test for already saved file being returned in hook

* added beforeDeleteFile and afterDeleteFile hooks

* removed contentLength because it's already in the header

* added fileSize param to FileTriggerRequest

* added support for client side metadata and tags

* removed fit test

* removed unused import

* added loging to file triggers

* updated error message

* updated error message

* fixed tests

* fixed typos

* Update package.json

* fixed failing test

* fixed error message

* fixed failing tests (hopefully)

* TESTS!!!

* Update FilesAdapter.js

fixed comment

* added test for changing file name

* updated comments

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-04-02 16:00:15 -05:00
Old Grandpa
6b0efaeffd Do not allow to protect default fields (#6439)
* consider default columns

* disallow protecting default fields
2020-02-28 15:52:48 -08:00
Arthur Cinader
5c7918980c Set min mongodb to 3.6 in prep for parse-server 4.0 (#6445)
* Set min mongodb to 3.6 in prep for parse-server 4.0

fixes: 6444

* don't use anonymous functions when we can just
pass the function.

Also remove the boolean argument in tests that no longer exists.

* generate the correct lock file.  ooops.
2020-02-27 10:56:14 -08:00
Old Grandpa
292bdb713a Allow protectedFields for Authenticated users and Public. Fix userField with keys/excludedKeys (#6415)
* fix error message and test it

* protected fields fixes

* clean

* remove duplicate test, add some comments

* no need for 'requiresAuthentication'
2020-02-19 01:34:08 -08:00
Arthur Cinader
fd0b535159 Case insensitive signup (#5634)
* Always delete data after each, even for mongo.

* Add failing simple case test

* run all tests

* 1. when validating username be case insensitive

2. add _auth_data_anonymous to specialQueryKeys...whatever that is!

* More case sensitivity

1. also make email validation case insensitive
2. update comments to reflect what this change does

* wordsmithery and grammar

* first pass at a preformant case insensitive query.  mongo only so far.

* change name of parameter from insensitive to
caseInsensitive

* Postgres support

* properly handle auth data null

* wip

* use 'caseInsensitive' instead of 'insensitive' in all places.

* update commenet to reclect current plan

* skip the mystery test for now

* create case insensitive indecies for
mongo to support case insensitive
checks for email and username

* remove unneeded specialKey

* pull collation out to a function.

* not sure what i planned
to do with this test.
removing.

* remove typo

* remove another unused flag

* maintain order

* maintain order of params

* boil the ocean on param sequence
i like having explain last cause it seems
like something you would
change/remove after getting what you want
from the explain?

* add test to verify creation
and use of caseInsensitive index

* add no op func to prostgress

* get collation object from mongocollection
make flow lint happy by declaring things Object.

* fix typo

* add changelog

* kick travis

* properly reference static method

* add a test to confirm that anonymous users with
unique username that do collide when compared
insensitively can still be created.

* minot doc nits

* add a few tests to make sure our spy is working as expected
wordsmith the changelog

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-02-14 09:44:51 -08:00
Old Grandpa
3c46117d9b Granular CLP pointer permissions (#6352)
* set pointer permissions per operatioon; tests

* more tests

* fixes addField permission; tests
2020-01-27 22:21:30 -08:00