Skip to content

Commit ede4d8d

Browse files
dblythydblythy
authored
Merge branch 'master' into improveUserSecurity
2 parents f9aade3 + 2b5bf22 commit ede4d8d

9 files changed

+222
-46
lines changed

‎.github/workflows/ci.yml

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
branches:
88
- '**'
99
env:
10-
NODE_VERSION: 14.17.6
10+
NODE_VERSION: 14.18.0
1111
PARSE_SERVER_TEST_TIMEOUT: 20000
1212
jobs:
1313
check-ci:
@@ -103,43 +103,43 @@ jobs:
103103
matrix:
104104
include:
105105
- name: MongoDB 5.0, ReplicaSet, WiredTiger
106-
MONGODB_VERSION: 5.0.2
106+
MONGODB_VERSION: 5.0.3
107107
MONGODB_TOPOLOGY: replicaset
108108
MONGODB_STORAGE_ENGINE: wiredTiger
109-
NODE_VERSION: 14.17.6
109+
NODE_VERSION: 14.18.0
110110
- name: MongoDB 4.4, ReplicaSet, WiredTiger
111-
MONGODB_VERSION: 4.4.8
111+
MONGODB_VERSION: 4.4.9
112112
MONGODB_TOPOLOGY: replicaset
113113
MONGODB_STORAGE_ENGINE: wiredTiger
114-
NODE_VERSION: 14.17.6
114+
NODE_VERSION: 14.18.0
115115
- name: MongoDB 4.2, ReplicaSet, WiredTiger
116-
MONGODB_VERSION: 4.2.16
116+
MONGODB_VERSION: 4.2.17
117117
MONGODB_TOPOLOGY: replicaset
118118
MONGODB_STORAGE_ENGINE: wiredTiger
119-
NODE_VERSION: 14.17.6
119+
NODE_VERSION: 14.18.0
120120
- name: MongoDB 4.0, ReplicaSet, WiredTiger
121121
MONGODB_VERSION: 4.0.27
122122
MONGODB_TOPOLOGY: replicaset
123123
MONGODB_STORAGE_ENGINE: wiredTiger
124-
NODE_VERSION: 14.17.6
124+
NODE_VERSION: 14.18.0
125125
- name: MongoDB 4.0, Standalone, MMAPv1
126126
MONGODB_VERSION: 4.0.27
127127
MONGODB_TOPOLOGY: standalone
128128
MONGODB_STORAGE_ENGINE: mmapv1
129-
NODE_VERSION: 14.17.6
129+
NODE_VERSION: 14.18.0
130130
- name: Redis Cache
131131
PARSE_SERVER_TEST_CACHE: redis
132-
MONGODB_VERSION: 4.4.8
132+
MONGODB_VERSION: 4.4.9
133133
MONGODB_TOPOLOGY: standalone
134134
MONGODB_STORAGE_ENGINE: wiredTiger
135-
NODE_VERSION: 14.17.6
135+
NODE_VERSION: 14.18.0
136136
- name: Node 12
137-
MONGODB_VERSION: 4.4.8
137+
MONGODB_VERSION: 4.4.9
138138
MONGODB_TOPOLOGY: standalone
139139
MONGODB_STORAGE_ENGINE: wiredTiger
140140
NODE_VERSION: 12.22.6
141141
- name: Node 15
142-
MONGODB_VERSION: 4.4.8
142+
MONGODB_VERSION: 4.4.9
143143
MONGODB_TOPOLOGY: standalone
144144
MONGODB_STORAGE_ENGINE: wiredTiger
145145
NODE_VERSION: 15.14.0
@@ -184,16 +184,16 @@ jobs:
184184
include:
185185
- name: PostgreSQL 11, PostGIS 3.0
186186
POSTGRES_IMAGE: postgis/postgis:11-3.0
187-
NODE_VERSION: 14.17.6
187+
NODE_VERSION: 14.18.0
188188
- name: PostgreSQL 11, PostGIS 3.1
189189
POSTGRES_IMAGE: postgis/postgis:11-3.1
190-
NODE_VERSION: 14.17.6
190+
NODE_VERSION: 14.18.0
191191
- name: PostgreSQL 12, PostGIS 3.1
192192
POSTGRES_IMAGE: postgis/postgis:12-3.1
193-
NODE_VERSION: 14.17.6
193+
NODE_VERSION: 14.18.0
194194
- name: PostgreSQL 13, PostGIS 3.1
195195
POSTGRES_IMAGE: postgis/postgis:13-3.1
196-
NODE_VERSION: 14.17.6
196+
NODE_VERSION: 14.18.0
197197
fail-fast: false
198198
name: ${{ matrix.name }}
199199
timeout-minutes: 15

‎.github/workflows/release-manual-docker.yml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Trigger this workflow only to manually create a Docker release; this should only be used
2+
# in extraordinary circumstances, as Docker releases are normally created automatically as
3+
# part of the automated release workflow.
4+
5+
name: release-manual-docker
6+
on:
7+
workflow_dispatch:
8+
inputs:
9+
ref:
10+
default: ''
11+
description: 'Reference (tag / SHA):'
12+
env:
13+
REGISTRY: docker.io
14+
IMAGE_NAME: parseplatform/parse-server
15+
jobs:
16+
build:
17+
runs-on: ubuntu-18.04
18+
permissions:
19+
contents: read
20+
packages: write
21+
steps:
22+
- name: Determine branch name
23+
id: branch
24+
run: echo "::set-output name=branch_name::${GITHUB_REF#refs/*/}"
25+
- name: Checkout repository
26+
uses: actions/checkout@v2
27+
with:
28+
ref: ${{ github.event.inputs.ref }}
29+
- name: Set up QEMU
30+
id: qemu
31+
uses: docker/setup-qemu-action@v1
32+
- name: Set up Docker Buildx
33+
uses: docker/setup-buildx-action@v1
34+
- name: Log into Docker Hub
35+
if: github.event_name != 'pull_request'
36+
uses: docker/login-action@v1
37+
with:
38+
username: ${{ secrets.DOCKERHUB_USERNAME }}
39+
password: ${{ secrets.DOCKERHUB_TOKEN }}
40+
- name: Extract Docker metadata
41+
id: meta
42+
uses: docker/metadata-action@v3
43+
with:
44+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
45+
flavor: |
46+
latest=${{ steps.branch.outputs.branch_name == 'master' && github.event.inputs.ref == '' }}
47+
tags: |
48+
type=semver,enable=true,pattern={{version}},value=${{ github.event.inputs.ref }}
49+
type=raw,enable=${{ github.event.inputs.ref == '' }},value=latest
50+
- name: Build and push Docker image
51+
uses: docker/build-push-action@v2
52+
with:
53+
context: .
54+
platforms: linux/amd64, linux/arm/v6, linux/arm/v7, linux/arm64/v8
55+
push: ${{ github.event_name != 'pull_request' }}
56+
tags: ${{ steps.meta.outputs.tags }}
57+
labels: ${{ steps.meta.outputs.labels }}

‎CHANGELOG.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ Jump directly to a version:
44

55
| 4.x |
66
|--------------------------------------|
7-
| [**4.10.3 (latest release)**](#4103) |
7+
| [**4.10.4 (latest release)**](#4104) |
8+
| [4.10.3](#4103) |
89
| [4.10.2](#4102) |
910
| [4.10.1](#4101) |
1011
| [4.10.0](#4100) |
@@ -94,7 +95,7 @@ Jump directly to a version:
9495
___
9596

9697
## Unreleased (Master Branch)
97-
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.3...master)
98+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.4...master)
9899

99100
### Breaking Changes
100101
- Improved schema caching through database real-time hooks. Reduces DB queries, decreases Parse Query execution time and fixes a potential schema memory leak. If multiple Parse Server instances connect to the same DB (for example behind a load balancer), set the [Parse Server Option](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) `databaseOptions.enableSchemaHooks: true` to enable this feature and keep the schema in sync across all instances. Failing to do so will cause a schema change to not propagate to other instances and re-syncing will only happen when these instances restart. The options `enableSingleSchemaCache` and `schemaCacheTTL` have been removed. To use this feature with MongoDB, a replica set cluster with [change stream](https://docs.mongodb.com/manual/changeStreams/#availability) support is required. (Diamond Lewis, SebC) [#7214](https://github.com/parse-community/parse-server/issues/7214)
@@ -157,6 +158,12 @@ ___
157158
- Allow cloud string for ES modules (Daniel Blyth) [#7560](https://github.com/parse-community/parse-server/pull/7560)
158159
- docs: Introduce deprecation ID for reference in comments and online search (Manuel Trezza) [#7562](https://github.com/parse-community/parse-server/pull/7562)
159160

161+
## 4.10.4
162+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.3...4.10.4)
163+
164+
### Security Fixes
165+
- Strip out sessionToken when LiveQuery is used on Parse.User (Daniel Blyth) [GHSA-7pr3-p5fm-8r9x](https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x)
166+
160167
## 4.10.3
161168
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.10.2...4.10.3)
162169

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ Parse Server is continuously tested with the most recent releases of Node.js to
115115
| Version | Latest Version | End-of-Life Date | Compatibility |
116116
|------------|----------------|------------------|--------------------|
117117
| Node.js 12 | 12.22.6 | April 2022 | ✅ Fully compatible |
118-
| Node.js 14 | 14.17.6 | April 2023 | ✅ Fully compatible |
118+
| Node.js 14 | 14.18.0 | April 2023 | ✅ Fully compatible |
119119
| Node.js 15 | 15.14.0 | June 2021 | ✅ Fully compatible |
120120

121121
#### MongoDB
@@ -124,9 +124,9 @@ Parse Server is continuously tested with the most recent releases of MongoDB to
124124
| Version | Latest Version | End-of-Life Date | Compatibility |
125125
|-------------|----------------|------------------|--------------------|
126126
| MongoDB 4.0 | 4.0.27 | April 2022 | ✅ Fully compatible |
127-
| MongoDB 4.2 | 4.2.16 | TBD | ✅ Fully compatible |
128-
| MongoDB 4.4 | 4.4.8 | TBD | ✅ Fully compatible |
129-
| MongoDB 5.0 | 5.0.2 | January 2024 | ✅ Fully compatible |
127+
| MongoDB 4.2 | 4.2.17 | TBD | ✅ Fully compatible |
128+
| MongoDB 4.4 | 4.4.9 | TBD | ✅ Fully compatible |
129+
| MongoDB 5.0 | 5.0.3 | January 2024 | ✅ Fully compatible |
130130

131131
#### PostgreSQL
132132
Parse Server is continuously tested with the most recent releases of PostgreSQL and PostGIS to ensure compatibility, using [PostGIS docker images](https://registry.hub.docker.com/r/postgis/postgis/tags?page=1&ordering=last_updated). We follow the [PostgreSQL support schedule](https://www.postgresql.org/support/versioning) and [PostGIS support schedule](https://www.postgis.net/eol_policy/) and only test against versions that are officially supported and have not reached their end-of-life date. Due to the extensive PostgreSQL support duration of 5 years, Parse Server drops support if a version is older than 3.5 years and a newer version has been available for at least 2.5 years.

‎package-lock.json

Lines changed: 13 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "parse-server",
3-
"version": "4.10.3",
3+
"version": "4.10.4",
44
"description": "An express module providing a Parse-compatible API server",
55
"main": "lib/index.js",
66
"repository": {
@@ -33,9 +33,9 @@
3333
"deepcopy": "2.1.0",
3434
"express": "4.17.1",
3535
"follow-redirects": "1.14.1",
36-
"graphql": "15.5.1",
36+
"graphql": "15.5.3",
3737
"graphql-list-fields": "2.0.2",
38-
"graphql-relay": "0.8.0",
38+
"graphql-relay": "0.9.0",
3939
"graphql-tag": "2.12.5",
4040
"graphql-upload": "11.0.0",
4141
"intersect": "1.0.1",
@@ -58,7 +58,7 @@
5858
"uuid": "8.3.2",
5959
"winston": "3.3.3",
6060
"winston-daily-rotate-file": "4.5.5",
61-
"ws": "8.2.1"
61+
"ws": "8.2.2"
6262
},
6363
"devDependencies": {
6464
"@actions/core": "1.2.6",
@@ -113,14 +113,14 @@
113113
"test:mongodb:testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=$npm_config_dbversion} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
114114
"test:mongodb": "npm run test:mongodb:runnerstart --dbversion=$npm_config_dbversion && npm run test:mongodb:testonly --dbversion=$npm_config_dbversion",
115115
"test:mongodb:4.0.27": "npm run test:mongodb --dbversion=4.0.27",
116-
"test:mongodb:4.2.16": "npm run test:mongodb --dbversion=4.2.16",
117-
"test:mongodb:4.4.8": "npm run test:mongodb --dbversion=4.4.8",
116+
"test:mongodb:4.2.17": "npm run test:mongodb --dbversion=4.2.17",
117+
"test:mongodb:4.4.9": "npm run test:mongodb --dbversion=4.4.9",
118118
"posttest:mongodb": "mongodb-runner stop",
119-
"pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
120-
"testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
119+
"pretest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner start",
120+
"testonly": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 jasmine",
121121
"test": "npm run testonly",
122-
"posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
123-
"coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.8} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
122+
"posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} mongodb-runner stop",
123+
"coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.4.9} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=wiredTiger} TESTING=1 nyc jasmine",
124124
"start": "node ./bin/parse-server",
125125
"prettier": "prettier --write {src,spec}/{**/*,*}.js",
126126
"prepare": "npm run build",

‎spec/ParseLiveQuery.spec.js

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -840,6 +840,52 @@ describe('ParseLiveQuery', function () {
840840
done();
841841
});
842842

843+
it('should strip out session token in LiveQuery', async () => {
844+
await reconfigureServer({
845+
liveQuery: { classNames: ['_User'] },
846+
startLiveQueryServer: true,
847+
verbose: false,
848+
silent: true,
849+
});
850+
851+
const user = new Parse.User();
852+
user.setUsername('username');
853+
user.setPassword('password');
854+
user.set('foo', 'bar');
855+
856+
const query = new Parse.Query(Parse.User);
857+
query.equalTo('foo', 'bar');
858+
const subscription = await query.subscribe();
859+
860+
const events = ['create', 'update', 'enter', 'leave', 'delete'];
861+
const response = (obj, prev) => {
862+
expect(obj.get('sessionToken')).toBeUndefined();
863+
expect(obj.sessionToken).toBeUndefined();
864+
expect(prev && prev.sessionToken).toBeUndefined();
865+
if (prev && prev.get) {
866+
expect(prev.get('sessionToken')).toBeUndefined();
867+
}
868+
};
869+
const calls = {};
870+
for (const key of events) {
871+
calls[key] = response;
872+
spyOn(calls, key).and.callThrough();
873+
subscription.on(key, calls[key]);
874+
}
875+
await user.signUp();
876+
user.unset('foo');
877+
await user.save();
878+
user.set('foo', 'bar');
879+
await user.save();
880+
user.set('yolo', 'bar');
881+
await user.save();
882+
await user.destroy();
883+
await new Promise(resolve => process.nextTick(resolve));
884+
for (const key of events) {
885+
expect(calls[key]).toHaveBeenCalled();
886+
}
887+
});
888+
843889
afterEach(async function (done) {
844890
const client = await Parse.CoreManager.getLiveQueryController().getDefaultLiveQueryClient();
845891
client.close();

0 commit comments

Comments
 (0)