admin/parse-community-parse-server
1
0
Fork 0
mirror of https://github.com/parse-community/parse-server synced 2026-08-09 13:03:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Session field guard bypass via falsy values for ACL and user fields (#10382)

Browse Source
This commit is contained in:
Manuel
2026-04-01 21:25:30 +01:00
committed by GitHub
parent b587767aa3
commit ead12bd1df
2 changed files with 87 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spec/ParseSession.spec.js
+85
View File
@@ -546,6 +546,91 @@ describe('Parse.Session', () => {
expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
});
it('should reject null ACL when updating a session via PUT', async () => {
const user = await Parse.User.signUp('sessionupdatenull5', 'password');
const sessionToken = user.getSessionToken();
const sessionRes = await request({
method: 'GET',
url: 'http://localhost:8378/1/sessions/me',
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
'X-Parse-Session-Token': sessionToken,
},
});
const sessionId = sessionRes.data.objectId;
const updateRes = await request({
method: 'PUT',
url: `http://localhost:8378/1/sessions/${sessionId}`,
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
'X-Parse-Session-Token': sessionToken,
'Content-Type': 'application/json',
},
body: {
ACL: null,
},
}).catch(e => e);
expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
});
it('should reject null ACL when creating a session via POST', async () => {
const user = await Parse.User.signUp('sessioncreatenull1', 'password');
const sessionToken = user.getSessionToken();
const createRes = await request({
method: 'POST',
url: 'http://localhost:8378/1/sessions',
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
'X-Parse-Session-Token': sessionToken,
'Content-Type': 'application/json',
},
body: {
ACL: null,
},
}).catch(e => e);
expect(createRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
});
it('should reject null user when updating a session via PUT', async () => {
const user = await Parse.User.signUp('sessionupdatenull6', 'password');
const sessionToken = user.getSessionToken();
const sessionRes = await request({
method: 'GET',
url: 'http://localhost:8378/1/sessions/me',
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
'X-Parse-Session-Token': sessionToken,
},
});
const sessionId = sessionRes.data.objectId;
const updateRes = await request({
method: 'PUT',
url: `http://localhost:8378/1/sessions/${sessionId}`,
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-REST-API-Key': 'rest',
'X-Parse-Session-Token': sessionToken,
'Content-Type': 'application/json',
},
body: {
user: null,
},
}).catch(e => e);
expect(updateRes.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
});
describe('PUT /sessions/me', () => {
it('should return error with invalid session token', async () => {
const response = await request({
src/RestWrite.js
+2 -2
View File
@@ -1228,12 +1228,12 @@ RestWrite.prototype.handleSession = function () {
}
// TODO: Verify proper error to throw
if (this.data.ACL) {
if ('ACL' in this.data) {
throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, 'Cannot set ' + 'ACL on a Session.');
}
if (this.query) {
if (this.data.user && !this.auth.isMaster && this.data.user.objectId != this.auth.user.id) {
if ('user' in this.data && !this.auth.isMaster && this.data.user?.objectId !== this.auth.user.id) {
throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, 'Invalid key name: user');
} else if ('installationId' in this.data) {
throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, 'Invalid key name: installationId');