Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security issue with default _User class permissions (new apps only) #387

Closed
jamiechapman opened this issue Feb 12, 2016 · 2 comments
Closed
Labels
type:bug Impaired feature or lacking behavior that is likely assumed

Comments

@jamiechapman
Copy link

I have recently noticed that a new parse-server project (i.e. one that hasn't been migrated from hosted Parse) has a security issue with the _User class.

Essentially parse-server creates the _User in the _SCHEMA collection, but it doesn't default to locked down _metadata permissions — thus exposing the entire user base with a simple new Parse.Query("_User").find() query.

I propose that when the _User class is created, we lock it down automatically. If I have time I'll try and add a fix for this, but I thought I would highlight it asap to prevent any undue security issues with new apps using parse-server.

@jamiechapman jamiechapman changed the title Default _metadata class permissions for _User Security issue with default _User class permissions (new apps only) Feb 12, 2016
@drew-gross drew-gross added the type:bug Impaired feature or lacking behavior that is likely assumed label Feb 12, 2016
@drew-gross
Copy link
Contributor

Thanks for the note! Fortunately this only affects new apps, so any migrated apps won't be vulnerable to new security issues. A PR would be very much appreciated :)

@flovilmart
Copy link
Contributor

@drew-gross I can take care of that one too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:bug Impaired feature or lacking behavior that is likely assumed
Projects
None yet
Development

No branches or pull requests

4 participants