Commit Graph

37 Commits

Author SHA1 Message Date
Manuel
d6b17baa32 refactor: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-462x-c3jw-7vr6](https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6) (#8677) 2023-06-28 23:37:25 +02:00
Manuel
a318e7bbaf feat: Add new Parse Server option fileUpload.fileExtensions to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern ^[^hH][^tT][^mM][^lL]?$, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to ['.*'] (#8538) 2023-05-21 01:23:00 +02:00
Daniel
6c79f6a69e feat: Add request rate limiter based on IP address (#8174) 2023-01-06 13:39:02 +01:00
Manuel
42581225f1 refactor: Remote code execution via MongoDB BSON parser through prototype pollution; fixes security vulnerability [GHSA-prm5-8g2m-24gg](https://github.com/parse-community/parse-server/security/advisories/GHSA-prm5-8g2m-24gg) (#8297) 2022-11-07 23:17:03 +01:00
Manuel
4c1befabf2 fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) [skip release] (#8237) 2022-10-15 00:54:08 +02:00
Manuel
1a04a347cf fix: invalid file request not properly handled [skip release] (#8061) 2022-06-18 02:15:08 +02:00
dblythy
c6dcad8d16 feat: align file trigger syntax with class trigger; use the new syntax Parse.Cloud.beforeSave(Parse.File, (request) => {}), the old syntax Parse.Cloud.beforeSaveFile((request) => {}) has been deprecated (#7966) 2022-05-29 20:48:55 +02:00
Ali Oğuzhan Yıldız
4d167026ae fix: empty file tags cause upload error for some providers (#7300)
* fix: empty file tags cause upload error for some providers

DigitalOcean and Linode object storage solutions do not accept `tags` option while uploading a file. Previously, tags option was set to default empty object. Now, we do not include it if it is empty.

* chore: add tests for saving a file with/without tags

* chore: update file tags handling to make tests pass

* chore: refactor file tag tests

* chore: update file tag tests

* chore: update changelog

* chore: update changelog entry

* chore: remove duplicated changelog entry
2021-04-02 17:29:46 +02:00
dblythy
e53b6c2f87 run prettier (#7172) 2021-02-12 10:18:49 +01:00
dblythy
97c3046f3f FileUpload options for Server Config (#7071)
* New: fileUpload options to restrict file uploads

* review changes

* update review

* Update helper.js

* added complete fileUpload values for tests

* fixed config validation

* allow file upload only for authenicated user by default

* fixed inconsistent error messages

* consolidated and extended tests

* minor compacting

* removed irregular whitespace

* added changelog entry

* always allow file upload with master key

* fix lint

* removed fit

Co-authored-by: Manuel Trezza <trezza.m@gmail.com>
2020-12-17 10:16:37 +01:00
Diamond Lewis
e6ac3b6932 fix(prettier): Properly handle lint-stage files (#6970)
Now handles top level files and recursive files in folders.

Set max line length to be 100
2020-10-25 15:06:58 -05:00
dblythy
c2f2281e6d Validation Handler Update (#6968)
* Initial Commit

* Update FunctionsRouter.js

* Update FunctionsRouter.js

* Change params to fields

* Changes requested

* Fix failing tests

* More tests

* More tests

* Remove existing functionality

* Remove legacy tests

* fix array typo

* Update triggers.js

* Docs

* Allow requireUserKeys to be object

* validateMasterKey

* Improve documentation

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-10-25 12:36:54 -05:00
Diamond Lewis
142eaa71bd Run Prettier JS #2 (#6796) 2020-07-13 15:13:08 -07:00
Diamond Lewis
370215a39b Support Metadata in GridFSAdapter (#6660)
* Support Metadata in GridFSAdapter

* Useful for testing in the JS SDK
* Adds new endpoint to be used with `Parse.File.getData`
* Allows file adapters to return tags as well as future data.

* fix tests

* Make getMetadata optional

* Revert "fix tests"

This reverts commit 7706da13c688027483974e854b5b24321fb070cd.

* improve coverage
2020-05-08 15:32:20 -05:00
stevestencil
a9dba442b1 Add file triggers and file meta data (#6344)
* added hint to aggregate

* added support for hint in query

* added else clause to aggregate

* fixed tests

* updated tests

* Add tests and clean up

* added beforeSaveFile and afterSaveFile triggers

* Add support for explain

* added some validation

* added support for metadata and tags

* tests?

* trying tests

* added tests

* fixed failing tests

* added some docs for fileObject

* updated hooks to use Parse.File

* added test for already saved file being returned in hook

* added beforeDeleteFile and afterDeleteFile hooks

* removed contentLength because it's already in the header

* added fileSize param to FileTriggerRequest

* added support for client side metadata and tags

* removed fit test

* removed unused import

* added loging to file triggers

* updated error message

* updated error message

* fixed tests

* fixed typos

* Update package.json

* fixed failing test

* fixed error message

* fixed failing tests (hopefully)

* TESTS!!!

* Update FilesAdapter.js

fixed comment

* added test for changing file name

* updated comments

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-04-02 16:00:15 -05:00
Mike Patnode
1c8d4a6519 Move filename validation out of the Router and into the FilesAdaptor (#6157)
* Move filename validation out of the Router and into the FilesAdaptor

* Address PR comments

* Update unittests to handle FilesAdapter interface change

* Make validateFilename optional
2019-10-26 21:15:21 -05:00
Diamond Lewis
63cabb8423 Stream video with GridFSBucketAdapter (implements byte-range requests) (#6028)
* Stream video with GridFSBucketAdapter (implements byte-range requests)

Closes: https://github.com/parse-community/parse-server/issues/5834

Similar to https://github.com/parse-community/parse-server/pull/2437

I ran into this issue while trying to view a mov file in safari from the dashboard.

* Rename getFileStream to handleFileStream
2019-09-11 09:34:39 -05:00
Linus Unnebäck
366e12193e Avoid redundant allowCrossDomain calls (#5696) 2019-06-20 12:08:46 -07:00
Sam Ilic
6ffc41345f Winston 3 upgrade (#5496)
*  Release 3.1.3 (#5267)

*  Release 3.1.3

* Update CHANGELOG.md

* ⬆️ Bump winston and winston-daily-rotate-file

Bumps [winston](https://github.com/winstonjs/winston) and [winston-daily-rotate-file](https://github.com/winstonjs/winston-daily-rotate-file). These dependencies needed to be updated together.

Updates `winston` from 2.4.4 to 3.1.0
- [Release notes](https://github.com/winstonjs/winston/releases)
- [Changelog](https://github.com/winstonjs/winston/blob/master/CHANGELOG.md)
- [Commits](https://github.com/winstonjs/winston/compare/2.4.4...3.1.0)

Updates `winston-daily-rotate-file` from 1.7.2 to 3.5.1
- [Release notes](https://github.com/winstonjs/winston-daily-rotate-file/releases)
- [Commits](https://github.com/winstonjs/winston-daily-rotate-file/compare/v1.7.2...v3.5.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

* Rewrote WinstonLogger to work with winston 3.x api

* Changed winston logger test to use winston-transport

* Added winston-transport dependency

* Close and remove transports before adding them again

* Changed to strict equal

* Override adapter name

* Updated and added getLogs tests

* Bump winston and winston-daily-rotate-file

Bumps [winston](https://github.com/winstonjs/winston) and [winston-daily-rotate-file](https://github.com/winstonjs/winston-daily-rotate-file). These dependencies needed to be updated together.

Updates `winston` from 2.4.4 to 3.2.0
- [Release notes](https://github.com/winstonjs/winston/releases)
- [Changelog](https://github.com/winstonjs/winston/blob/master/CHANGELOG.md)
- [Commits](https://github.com/winstonjs/winston/compare/2.4.4...3.2.0)

Updates `winston-daily-rotate-file` from 1.7.2 to 3.6.0
- [Release notes](https://github.com/winstonjs/winston-daily-rotate-file/releases)
- [Commits](https://github.com/winstonjs/winston-daily-rotate-file/compare/v1.7.2...v3.6.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

* Fixed tests, updated parse logging

* Fixed tests, better error logging

* Fix failing tests

* Updates as per review
2019-04-14 18:03:33 -05:00
Florent Vilmart
d83a0b6808 Use Prettier JS (#5017)
* Adds prettier

* Run lint before tests
2018-09-01 13:58:06 -04:00
Florent Vilmart
6a1510729a Bump nodejs version to 6+ (#4272)
* let travis build against 3.x

* Cleanup dependencies and bump min version to current LTS

* Makes npm-git push all branches to -preview

* restores releases

* Bumps mime to 2.0.3 (requires node 6+)

* Bumps express to latest version

* Fixes linting issue after upgrade

* Use travis-branch for partial releases
2017-11-25 15:39:31 -05:00
Florent Vilmart
9de4b8b2a7 Refactors configuration management (#4271)
* Adds flow types / Configuration interfaces

* Lets call it options

* Use a single interface to generate the configurations

* Translates options to definitions only if comments are set

* improves logic

* Moves objects around

* Fixes issue affecting logging of circular objects

* fixes undefined env

* Moves all defaults to defaults

* Adds back CLI defaults

* Restored defaults in commander.js

* Merge provided defaults and platform defaults

* Addresses visual nits

* Improves Config.js code

* Adds ability to pass the default value in trailing comments

* Load platform defaults from the definitions file

* proper default values on various options

* Adds ParseServer.start and server.start(options) as quick startup methods

* Moves creating liveQueryServer http into ParseServer.js

* removes dead code

* Adds tests to guarantee we can start a LQ Server from main module

* Fixes incorrect code regading liveQuery init port

* Start a http server for LQ if port is specified

* ensure we dont fail if config.port is not set

* Specify port

* ignore other path skipped in tests

* Adds test for custom middleware setting

* Refactors new Config into Config.get

- Hides AppCache from ParseServer.js, use Config.put which validates

* Extracts controller creation into Controllers/index.js

- This makes the ParseServer init way simpler

* Move serverURL inference into ParseServer

* review nits
2017-10-23 08:43:05 -04:00
Florent Vilmart
139b9e1cb3 Finding areas that are untested and need love (#4131)
* Makes InstallationRouter like others

* Adds testing for Range file requests

- Fixes issue with small requests (0-2)

* Revert "Makes InstallationRouter like others"

This reverts commit e2d2a16ebf2757db6138c7b5b33c97c56c69ead6.

* Better handling of errors in FilesRouter

* Fix incorrectness in range requests

* Better/simpler logic

* Only on mongo at it requires Gridstore

* Open file streaming to all adapters supporting it

* Improves coverage of parsers

* Ensures depreciation warning is effective

* Removes unused function

* de-duplicate logic

* Removes necessity of overriding req.params.className on subclasses routers

* Use babel-preset-env to ensure min-version compatible code

* removes dead code

* Leverage indexes in order to infer which field is duplicated upon signup

- A note mentioned that it would be possible to leverage using the indexes on username/email to infer which is duplicated

* Small nit

* Better template to match column name

* Restores original implementation for safety

* nits
2017-09-05 17:51:11 -04:00
Arthur Cinader
d5940b17b6 Add logging on failure to create file (#3424) 2017-01-30 12:36:30 -05:00
Arthur Cinader
4cb6e7d209 Add lint rule space-infix-ops (#3237)
Disallows: 1+1.  Must be 1 + 1.
2017-01-11 12:31:40 -08:00
Florent Vilmart
8c2c76dd26 Adds liniting into the workflow (#3082)
* initial linting of src

* fix indent to 2 spaces

* Removes unnecessary rules

* ignore spec folder for now

* Spec linting

* Fix spec indent

* nits

* nits

* no no-empty rule
2016-11-24 15:47:41 -05:00
Brage G. Staven
9d2d208609 Fixed 'undefined' when getting request header (#2635) 2016-09-01 08:12:30 -04:00
Brage G. Staven
e690b73bb5 Stream video with GridStoreAdapter (implements byte-range requests) (#2437)
* Stream video with GridStoreAdapter

* fixing nits. Removing test(Range not accepted as header)

* nit

* Changed names. Added function to check if stream-requirements is fulfilled.
2016-08-12 15:58:18 -04:00
Florent Vilmart
fc3ebd0bd0 Style improvements (#2475)
* HooksRouter is enabled by default

* Adds middleswares on PromiseRouter, fixes #2410

* Move testing line to helper

* Modernize middlewares.js

* Moves DB uniqueness initialization to DBController, modernize

* Moves testing related code to spec folder

* remove unused _removeHook function

* Adds tests, docs for Analytics and improvements

* nit

* moves back TestUtils
2016-08-07 20:02:53 -07:00
Steven Van Bael
8d8192bbcc Add Content-Length header to HTTP response in FilesRouter (#2408) 2016-08-04 10:29:10 -07:00
Drew
7e868b2dcc Unique indexes (#1971)
* Add unique indexing

* Add unique indexing for username/email

* WIP

* Finish unique indexes

* Notes on how to upgrade to 2.3.0 safely

* index on unique-indexes: c454180 Revert "Log objects rather than JSON stringified objects (#1922)"

* reconfigure username/email tests

* Start dealing with test shittyness

* Remove tests for files that we are removing

* most tests passing

* fix failing test

* Make specific server config for tests async

* Fix more tests

* fix more tests

* Fix another test

* fix more tests

* Fix email validation

* move some stuff around

* Destroy server to ensure all connections are gone

* Fix broken cloud code

* Save callback to variable

* no need to delete non existant cloud

* undo

* Fix all tests where connections are left open after server closes.

* Fix issues caused by missing gridstore adapter

* Update guide for 2.3.0 and fix final tests

* use strict

* don't use features that won't work in node 4

* Fix syntax error

* Fix typos

* Add duplicate finding command

* Update 2.3.0.md
2016-06-10 20:27:21 -07:00
Florent Vilmart
7257ee858b Moves some logic from FilesRouter to FilesController for content-type and filename 2016-03-01 10:14:03 -05:00
Florent Vilmart
78d380df72 Adds content type support in S3 2016-03-01 09:28:17 -05:00
Florent Vilmart
9ac7a52e40 Adds Hooks API
Adds Parse.Hooks.js in src/cloud-code/Parse.Hooks.js
Moves Cloud code related functions in src/cloud-code
2016-02-25 08:10:07 -05:00
Florent Vilmart
61e8f2aeea Adds maxUploadSize option 2016-02-23 11:49:21 -05:00
Nikita Lutsenko
966d10ca43 Allow uploading files without content-type. 2016-02-22 14:07:58 -08:00
Florent Vilmart
305879a251 Refactors FilesController in FilesRouter and FilesController 2016-02-20 13:52:35 -05:00