Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Server crashes when receiving an array of Parse.Pointer in the request body #8784

Merged
merged 9 commits into from
Jan 15, 2024

Conversation

zivchen
Copy link
Contributor

@zivchen zivchen commented Oct 22, 2023

Pull Request

Issue

Closes: #8783

Approach

Tasks

  • Add tests
  • Add changes to documentation (guides, repository pages, code comments)
  • Add security check
  • Add new Parse Error codes to Parse JS SDK

@parse-github-assistant
Copy link

parse-github-assistant bot commented Oct 22, 2023

Thanks for opening this pull request!

@zivchen zivchen changed the title pass config object to parseObject function fix: Parse server crash - Cannot read property 'encodeParseObjectInCloudFunction' of undefined Oct 22, 2023
@mtrezza
Copy link
Member

mtrezza commented Oct 22, 2023

Could you please add a test that demonstrates the server crash?

@sadortun
Copy link
Contributor

@mtrezza I'm probably 100% looking at the wrong place, but where are the tests for parseObject() ?

@mtrezza
Copy link
Member

mtrezza commented Oct 23, 2023

Did you look at the blame line to see whether there were test in the PR?

@sadortun
Copy link
Contributor

sadortun commented Dec 9, 2023

Did you look at the blame line to see whether there were test in the PR?

Yes, and i don't really see test-cases covering the parseObject() in your original commit where the original change were made. But i might be looking at the wrong place, or parseObject() is tested indirectly.

e212eb5#diff-8f2f0b3d469b333004223792d072d82895edc96039eae3dba67a4eb4e37ae66dR12

The missing test could simply add [] to test the .map()

Ex: parseObject( [item] , config);

@rdhelms
Copy link

rdhelms commented Dec 11, 2023

Would love to see this fixed - we just tried to update and ran into this error

@pocketcolin
Copy link

pocketcolin commented Dec 11, 2023

@sadortun I'm not a Parse maintainer but I think I figured out where this test should live and created a PR to the forked repo to add one that verifies this fix: zivchen#2

Add spec to verify parseObject missing config fix
@zivchen
Copy link
Contributor Author

zivchen commented Dec 12, 2023

Hi
I merged @pocketcolin test spec into the PR
Thanks

@pocketcolin
Copy link

Awesome! Should we also create a PR for a v6 hotfix? This PR just fixes the issue in the v7 alpha and who knows when v7 will be ready for prod.

@mtrezza
Copy link
Member

mtrezza commented Dec 13, 2023

@zivchen Could you please edit the PR title so that it makes a meaningful change log entry where developers understand what issue this fixes? Can you confirm that this PR fixes the issue you faced?

Copy link

codecov bot commented Dec 13, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (1eb95ae) 93.83% compared to head (50d01c5) 84.93%.
Report is 1 commits behind head on alpha.

Additional details and impacted files
@@            Coverage Diff             @@
##            alpha    #8784      +/-   ##
==========================================
- Coverage   93.83%   84.93%   -8.90%     
==========================================
  Files         186      186              
  Lines       14814    14814              
==========================================
- Hits        13900    12582    -1318     
- Misses        914     2232    +1318     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@zivchen zivchen changed the title fix: Parse server crash - Cannot read property 'encodeParseObjectInCloudFunction' of undefined fix: Parse server crash - Cannot read property 'encodeParseObjectInCloudFunction' of undefined, parseObject function called with missing property Dec 13, 2023
@zivchen zivchen changed the title fix: Parse server crash - Cannot read property 'encodeParseObjectInCloudFunction' of undefined, parseObject function called with missing property fix: crash - cannot read property 'encodeParseObjectInCloudFunction' of undefined, parseObject function called with missing property Dec 13, 2023
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title fix: crash - cannot read property 'encodeParseObjectInCloudFunction' of undefined, parseObject function called with missing property fix: Crash - cannot read property 'encodeParseObjectInCloudFunction' of undefined, parseObject function called with missing property Dec 13, 2023
@mtrezza
Copy link
Member

mtrezza commented Dec 13, 2023

Could you rephrase the PR title so that it's not describing the source code but the use case which causes the crash? It seems this only happens when using a Pointer, right?

@zivchen zivchen changed the title fix: Crash - cannot read property 'encodeParseObjectInCloudFunction' of undefined, parseObject function called with missing property fix: when reciving data that has array of pointers, parseObject function called without config property which causes a crash "cannot read property 'encodeParseObjectInCloudFunction' of undefined" Dec 13, 2023
@gtzinos
Copy link

gtzinos commented Dec 13, 2023

Just dropping a line to say we're eagerly eyeing this pull request, like kids at a candy store window. 😊

spec/ParseAPI.spec.js Outdated Show resolved Hide resolved
spec/ParseAPI.spec.js Outdated Show resolved Hide resolved
spec/ParseAPI.spec.js Outdated Show resolved Hide resolved
spec/ParseAPI.spec.js Outdated Show resolved Hide resolved
@mtrezza mtrezza changed the title fix: when reciving data that has array of pointers, parseObject function called without config property which causes a crash "cannot read property 'encodeParseObjectInCloudFunction' of undefined" fix: Server crashes when recieving an array of Parse.Pointer. when reciving data that has array of pointers, parseObject function called without config property which causes a crash "cannot read property 'encodeParseObjectInCloudFunction' of undefined" Dec 14, 2023
@mtrezza mtrezza changed the title fix: Server crashes when recieving an array of Parse.Pointer. when reciving data that has array of pointers, parseObject function called without config property which causes a crash "cannot read property 'encodeParseObjectInCloudFunction' of undefined" fix: Server crashes when recieving an array of Parse.Pointer in the request body Dec 14, 2023
@mtrezza mtrezza changed the title fix: Server crashes when recieving an array of Parse.Pointer in the request body fix: Server crashes when receiving an array of Parse.Pointer in the request body Dec 14, 2023
@mtrezza
Copy link
Member

mtrezza commented Dec 14, 2023

We'll move Parse Server 6 to a LTS branch so a PR can be opened for it as well.

@mtrezza
Copy link
Member

mtrezza commented Jan 14, 2024

@zivchen Just a friendly ping regarding the feedback; it would be great to get this PR merged.

spec/ParseAPI.spec.js Outdated Show resolved Hide resolved
Signed-off-by: Manuel <5673677+mtrezza@users.noreply.github.com>
Copy link
Member

@mtrezza mtrezza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, waiting for CI to pass...

@mtrezza mtrezza merged commit 66e3603 into parse-community:alpha Jan 15, 2024
28 of 29 checks passed
parseplatformorg pushed a commit that referenced this pull request Jan 15, 2024
# [7.0.0-alpha.9](7.0.0-alpha.8...7.0.0-alpha.9) (2024-01-15)

### Bug Fixes

* Server crashes when receiving an array of `Parse.Pointer` in the request body ([#8784](#8784)) ([66e3603](66e3603))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 7.0.0-alpha.9

@jaysonng
Copy link

jaysonng commented Mar 14, 2024

Awesome! Should we also create a PR for a v6 hotfix? This PR just fixes the issue in the v7 alpha and who knows when v7 will be ready for prod.

yes pls. I need it for v6 and for the life of me can't figure out the proper procedure to do a PR for v6.

@szymon-wrobel-pronos
Copy link

@mtrezza Is there a timeline for carrying over this bugfix to the v6 version?

parseplatformorg pushed a commit that referenced this pull request Mar 19, 2024
# [7.0.0-beta.1](6.5.0-beta.1...7.0.0-beta.1) (2024-03-19)

### Bug Fixes

* CacheAdapter does not connect when using a CacheAdapter with a JSON config ([#8633](#8633)) ([720d24e](720d24e))
* Conditional email verification not working in some cases if `verifyUserEmails`, `preventLoginWithUnverifiedEmail` set to functions ([#8838](#8838)) ([8e7a6b1](8e7a6b1))
* Deny request if master key is not set in Parse Server option `masterKeyIps` regardless of ACL and CLP ([#8957](#8957)) ([a7b5b38](a7b5b38))
* Docker image not published to Docker Hub on new release ([#8905](#8905)) ([a2ac8d1](a2ac8d1))
* Docker version releases by removing arm/v6 and arm/v7 support ([#8976](#8976)) ([1f62dd0](1f62dd0))
* GraphQL file upload fails in case of use of pointer or relation ([#8721](#8721)) ([1aba638](1aba638))
* Improve PostgreSQL injection detection; fixes security vulnerability [GHSA-6927-3vr9-fxf2](GHSA-6927-3vr9-fxf2) which affects Parse Server deployments using a Postgres database ([#8961](#8961)) ([cbefe77](cbefe77))
* Incomplete user object in `verifyEmail` function if both username and email are changed ([#8889](#8889)) ([1eb95ae](1eb95ae))
* Parse Server option `emailVerifyTokenReuseIfValid: true` generates new token on every email verification request ([#8885](#8885)) ([0023ce4](0023ce4))
* Parse Server option `fileExtensions` default value rejects file extensions that are less than 3 or more than 4 characters long ([#8699](#8699)) ([2760381](2760381))
* Server crashes on invalid Cloud Function or Cloud Job name; fixes security vulnerability [GHSA-6hh7-46r2-vf29](GHSA-6hh7-46r2-vf29) ([#9024](#9024)) ([9f6e342](9f6e342))
* Server crashes when receiving an array of `Parse.Pointer` in the request body ([#8784](#8784)) ([66e3603](66e3603))
* Username is `undefined` in email verification link on email change ([#8887](#8887)) ([e315c13](e315c13))

### Features

* Add `installationId` to arguments for `verifyUserEmails`, `preventLoginWithUnverifiedEmail` ([#8836](#8836)) ([a22dbe1](a22dbe1))
* Add `installationId`, `ip`, `resendRequest` to arguments passed to `verifyUserEmails` on verification email request ([#8873](#8873)) ([8adcbee](8adcbee))
* Add `Parse.User` as function parameter to Parse Server options `verifyUserEmails`, `preventLoginWithUnverifiedEmail` on login ([#8850](#8850)) ([972f630](972f630))
* Add password validation via POST request for user with unverified email using master key and option `ignoreEmailVerification` ([#8895](#8895)) ([633a9d2](633a9d2))
* Add support for MongoDB 7 ([#8761](#8761)) ([3de8494](3de8494))
* Add support for MongoDB query comment ([#8928](#8928)) ([2170962](2170962))
* Add support for Node 20, drop support for Node 14, 16 ([#8907](#8907)) ([ced4872](ced4872))
* Add support for Postgres 16 ([#8898](#8898)) ([99489b2](99489b2))
* Allow `Parse.Session.current` on expired session token instead of throwing error ([#8722](#8722)) ([f9dde4a](f9dde4a))
* Deprecation DEPPS5: Config option `allowClientClassCreation` defaults to `false` ([#8849](#8849)) ([29624e0](29624e0))
* Deprecation DEPPS6: Authentication adapters disabled by default ([#8858](#8858)) ([0cf58eb](0cf58eb))
* Deprecation DEPPS7: Remove deprecated Cloud Code file trigger syntax ([#8855](#8855)) ([4e6a375](4e6a375))
* Deprecation DEPPS8:  Parse Server option `allowExpiredAuthDataToken` defaults to `false` ([#8860](#8860)) ([e29845f](e29845f))
* Deprecation DEPPS9: LiveQuery `fields` option is renamed to `keys` ([#8852](#8852)) ([38983e8](38983e8))
* Node process exits with error code 1 on uncaught exception to allow custom uncaught exception handling ([#8894](#8894)) ([70c280c](70c280c))
* Switch GraphQL server from Yoga v2 to Apollo v4 ([#8959](#8959)) ([105ae7c](105ae7c))
* Upgrade Parse Server Push Adapter to 5.0.2 ([#8813](#8813)) ([6ef1986](6ef1986))
* Upgrade to Parse JS SDK 5 ([#9022](#9022)) ([ad4aa83](ad4aa83))

### Performance Improvements

* Improved IP validation performance for `masterKeyIPs`, `maintenanceKeyIPs` ([#8510](#8510)) ([b87daba](b87daba))

### BREAKING CHANGES

* The Parse Server option `allowClientClassCreation` defaults to `false`. ([29624e0](29624e0))
* A request using the master key will now be rejected as unauthorized if the IP from which the request originates is not set in the Parse Server option `masterKeyIps`, even if the request does not require the master key permission, for example for a public object in a public class class. ([a7b5b38](a7b5b38))
* Node process now exits with code 1 on uncaught exceptions, enabling custom handlers that were blocked by Parse Server's default behavior of re-throwing errors. This change may lead to automatic process restarts by the environment, unlike before. ([70c280c](70c280c))
* Authentication adapters are disabled by default; to use an authentication adapter it needs to be explicitly enabled in the Parse Server authentication adapter option `auth.<provider>.enabled: true` ([0cf58eb](0cf58eb))
* Parse Server option `allowExpiredAuthDataToken` defaults to `false`; a 3rd party authentication token will be validated every time the user tries to log in and the login will fail if the token has expired; the effect of this change may differ for different authentication adapters, depending on the token lifetime and the token refresh logic of the adapter ([e29845f](e29845f))
* LiveQuery `fields` option is renamed to `keys` ([38983e8](38983e8))
* Cloud Code file trigger syntax has been aligned with object trigger syntax, for example `Parse.Cloud.beforeDeleteFile'` has been changed to `Parse.Cloud.beforeDelete(Parse.File, (request) => {})'` ([4e6a375](4e6a375))
* Removes support for Node 14 and 16 ([ced4872](ced4872))
* Removes support for Postgres 11 and 12 ([99489b2](99489b2))
* The `Parse.User` passed as argument if `verifyUserEmails` is set to a function is renamed from `user` to `object` for consistency with invocations of `verifyUserEmails` on signup or login; the user object is not a plain JavaScript object anymore but an instance of `Parse.User` ([8adcbee](8adcbee))
* `Parse.Session.current()` no longer throws an error if the session token is expired, but instead returns the session token with its expiration date to allow checking its validity ([f9dde4a](f9dde4a))
* `Parse.Query` no longer supports the BSON type `code`; although this feature was never officially documented, its removal is announced as a breaking change to protect deployments where it might be in use. ([3de8494](3de8494))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 7.0.0-beta.1

@parseplatformorg parseplatformorg added the state:released-beta Released as beta version label Mar 19, 2024
parseplatformorg pushed a commit that referenced this pull request Mar 19, 2024
# [7.0.0](6.4.0...7.0.0) (2024-03-19)

### Bug Fixes

* CacheAdapter does not connect when using a CacheAdapter with a JSON config ([#8633](#8633)) ([720d24e](720d24e))
* Conditional email verification not working in some cases if `verifyUserEmails`, `preventLoginWithUnverifiedEmail` set to functions ([#8838](#8838)) ([8e7a6b1](8e7a6b1))
* Context not passed to Cloud Code Trigger `beforeFind` when using `Parse.Query.include` ([#8765](#8765)) ([7d32d89](7d32d89))
* Deny request if master key is not set in Parse Server option `masterKeyIps` regardless of ACL and CLP ([#8957](#8957)) ([a7b5b38](a7b5b38))
* Docker image not published to Docker Hub on new release ([#8905](#8905)) ([a2ac8d1](a2ac8d1))
* Docker version releases by removing arm/v6 and arm/v7 support ([#8976](#8976)) ([1f62dd0](1f62dd0))
* GraphQL file upload fails in case of use of pointer or relation ([#8721](#8721)) ([1aba638](1aba638))
* Improve PostgreSQL injection detection; fixes security vulnerability [GHSA-6927-3vr9-fxf2](GHSA-6927-3vr9-fxf2) which affects Parse Server deployments using a Postgres database ([#8961](#8961)) ([cbefe77](cbefe77))
* Incomplete user object in `verifyEmail` function if both username and email are changed ([#8889](#8889)) ([1eb95ae](1eb95ae))
* Parse Server option `emailVerifyTokenReuseIfValid: true` generates new token on every email verification request ([#8885](#8885)) ([0023ce4](0023ce4))
* Parse Server option `fileExtensions` default value rejects file extensions that are less than 3 or more than 4 characters long ([#8699](#8699)) ([2760381](2760381))
* Parse Server option `fileUpload.fileExtensions` fails to determine file extension if filename contains multiple dots ([#8754](#8754)) ([3d6d50e](3d6d50e))
* Security bump @babel/traverse from 7.20.5 to 7.23.2 ([#8777](#8777)) ([2d6b3d1](2d6b3d1))
* Security upgrade graphql from 16.6.0 to 16.8.1 ([#8758](#8758)) ([71dfd8a](71dfd8a))
* Server crashes on invalid Cloud Function or Cloud Job name; fixes security vulnerability [GHSA-6hh7-46r2-vf29](GHSA-6hh7-46r2-vf29) ([#9024](#9024)) ([9f6e342](9f6e342))
* Server crashes when receiving an array of `Parse.Pointer` in the request body ([#8784](#8784)) ([66e3603](66e3603))
* Username is `undefined` in email verification link on email change ([#8887](#8887)) ([e315c13](e315c13))

### Features

* Add `$setOnInsert` operator to `Parse.Server.database.update` ([#8791](#8791)) ([f630a45](f630a45))
* Add `installationId` to arguments for `verifyUserEmails`, `preventLoginWithUnverifiedEmail` ([#8836](#8836)) ([a22dbe1](a22dbe1))
* Add `installationId`, `ip`, `resendRequest` to arguments passed to `verifyUserEmails` on verification email request ([#8873](#8873)) ([8adcbee](8adcbee))
* Add `Parse.User` as function parameter to Parse Server options `verifyUserEmails`, `preventLoginWithUnverifiedEmail` on login ([#8850](#8850)) ([972f630](972f630))
* Add compatibility for MongoDB Atlas Serverless and AWS Amazon DocumentDB with collation options `enableCollationCaseComparison`, `transformEmailToLowercase`, `transformUsernameToLowercase` ([#8805](#8805)) ([09fbeeb](09fbeeb))
* Add context to Cloud Code Triggers `beforeLogin` and `afterLogin` ([#8724](#8724)) ([a9c34ef](a9c34ef))
* Add password validation via POST request for user with unverified email using master key and option `ignoreEmailVerification` ([#8895](#8895)) ([633a9d2](633a9d2))
* Add support for MongoDB 7 ([#8761](#8761)) ([3de8494](3de8494))
* Add support for MongoDB query comment ([#8928](#8928)) ([2170962](2170962))
* Add support for Node 20, drop support for Node 14, 16 ([#8907](#8907)) ([ced4872](ced4872))
* Add support for Postgres 16 ([#8898](#8898)) ([99489b2](99489b2))
* Allow `Parse.Session.current` on expired session token instead of throwing error ([#8722](#8722)) ([f9dde4a](f9dde4a))
* Allow setting `createdAt` and `updatedAt` during `Parse.Object` creation with maintenance key ([#8696](#8696)) ([77bbfb3](77bbfb3))
* Deprecation DEPPS5: Config option `allowClientClassCreation` defaults to `false` ([#8849](#8849)) ([29624e0](29624e0))
* Deprecation DEPPS6: Authentication adapters disabled by default ([#8858](#8858)) ([0cf58eb](0cf58eb))
* Deprecation DEPPS7: Remove deprecated Cloud Code file trigger syntax ([#8855](#8855)) ([4e6a375](4e6a375))
* Deprecation DEPPS8:  Parse Server option `allowExpiredAuthDataToken` defaults to `false` ([#8860](#8860)) ([e29845f](e29845f))
* Deprecation DEPPS9: LiveQuery `fields` option is renamed to `keys` ([#8852](#8852)) ([38983e8](38983e8))
* Node process exits with error code 1 on uncaught exception to allow custom uncaught exception handling ([#8894](#8894)) ([70c280c](70c280c))
* Switch GraphQL server from Yoga v2 to Apollo v4 ([#8959](#8959)) ([105ae7c](105ae7c))
* Upgrade Parse Server Push Adapter to 5.0.2 ([#8813](#8813)) ([6ef1986](6ef1986))
* Upgrade to Parse JS SDK 5 ([#9022](#9022)) ([ad4aa83](ad4aa83))

### Performance Improvements

* Improved IP validation performance for `masterKeyIPs`, `maintenanceKeyIPs` ([#8510](#8510)) ([b87daba](b87daba))

### BREAKING CHANGES

* The Parse Server option `allowClientClassCreation` defaults to `false`. ([29624e0](29624e0))
* A request using the master key will now be rejected as unauthorized if the IP from which the request originates is not set in the Parse Server option `masterKeyIps`, even if the request does not require the master key permission, for example for a public object in a public class class. ([a7b5b38](a7b5b38))
* Node process now exits with code 1 on uncaught exceptions, enabling custom handlers that were blocked by Parse Server's default behavior of re-throwing errors. This change may lead to automatic process restarts by the environment, unlike before. ([70c280c](70c280c))
* Authentication adapters are disabled by default; to use an authentication adapter it needs to be explicitly enabled in the Parse Server authentication adapter option `auth.<provider>.enabled: true` ([0cf58eb](0cf58eb))
* Parse Server option `allowExpiredAuthDataToken` defaults to `false`; a 3rd party authentication token will be validated every time the user tries to log in and the login will fail if the token has expired; the effect of this change may differ for different authentication adapters, depending on the token lifetime and the token refresh logic of the adapter ([e29845f](e29845f))
* LiveQuery `fields` option is renamed to `keys` ([38983e8](38983e8))
* Cloud Code file trigger syntax has been aligned with object trigger syntax, for example `Parse.Cloud.beforeDeleteFile'` has been changed to `Parse.Cloud.beforeDelete(Parse.File, (request) => {})'` ([4e6a375](4e6a375))
* Removes support for Node 14 and 16 ([ced4872](ced4872))
* Removes support for Postgres 11 and 12 ([99489b2](99489b2))
* The `Parse.User` passed as argument if `verifyUserEmails` is set to a function is renamed from `user` to `object` for consistency with invocations of `verifyUserEmails` on signup or login; the user object is not a plain JavaScript object anymore but an instance of `Parse.User` ([8adcbee](8adcbee))
* `Parse.Session.current()` no longer throws an error if the session token is expired, but instead returns the session token with its expiration date to allow checking its validity ([f9dde4a](f9dde4a))
* `Parse.Query` no longer supports the BSON type `code`; although this feature was never officially documented, its removal is announced as a breaking change to protect deployments where it might be in use. ([3de8494](3de8494))
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 7.0.0

@parseplatformorg parseplatformorg added the state:released Released as stable version label Mar 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
state:released Released as stable version state:released-alpha Released as alpha version state:released-beta Released as beta version
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Parse server crash - Cannot read property 'encodeParseObjectInCloudFunction' of undefined