Skip to content

refactor: Remote code execution via MongoDB BSON parser through prototype pollution #8297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 7, 2022

Conversation

mtrezza
Copy link
Member

@mtrezza mtrezza commented Nov 7, 2022

Fixes security vulnerability GHSA-prm5-8g2m-24gg

@parse-github-assistant
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title fix: alpha-24gg fix: Alpha-24gg Nov 7, 2022
@parse-github-assistant
Copy link

parse-github-assistant bot commented Nov 7, 2022

Thanks for opening this pull request!

  • ❌ Please edit your post and use the provided template when creating a new pull request. This helps everyone to understand your post better and asks for essential information to quicker review the pull request.

@mtrezza mtrezza changed the title fix: Alpha-24gg refactor: Remote code execution via MongoDB BSON parser through prototype pollution Nov 7, 2022
@codecov
Copy link

codecov bot commented Nov 7, 2022

Codecov Report

Base: 94.11% // Head: 86.80% // Decreases project coverage by -7.31% ⚠️

Coverage data is based on head (c348d74) compared to base (81304be).
Patch coverage: 100.00% of modified lines in pull request are covered.

Additional details and impacted files
@@            Coverage Diff             @@
##            alpha    #8297      +/-   ##
==========================================
- Coverage   94.11%   86.80%   -7.32%     
==========================================
  Files         182      182              
  Lines       13775    13782       +7     
==========================================
- Hits        12964    11963    -1001     
- Misses        811     1819    +1008     
Impacted Files Coverage Δ
src/Routers/FilesRouter.js 86.98% <100.00%> (-5.11%) ⬇️
src/Adapters/Storage/Mongo/MongoCollection.js 4.76% <0.00%> (-92.86%) ⬇️
src/Adapters/Files/GridFSBucketAdapter.js 9.48% <0.00%> (-83.95%) ⬇️
src/Adapters/Storage/Mongo/MongoStorageAdapter.js 11.91% <0.00%> (-81.28%) ⬇️
src/Adapters/Cache/RedisCacheAdapter.js 12.28% <0.00%> (-75.44%) ⬇️
...rc/Adapters/Storage/Mongo/MongoSchemaCollection.js 35.48% <0.00%> (-62.37%) ⬇️
src/GraphQL/loaders/filesMutations.js 37.93% <0.00%> (-41.38%) ⬇️
src/Adapters/Storage/Mongo/MongoTransform.js 48.51% <0.00%> (-39.91%) ⬇️
src/Routers/SessionsRouter.js 65.71% <0.00%> (-25.72%) ⬇️
src/GraphQL/transformers/mutation.js 83.96% <0.00%> (-13.21%) ⬇️
... and 17 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@mtrezza mtrezza merged commit 4258122 into parse-community:alpha Nov 7, 2022
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 6.0.0-alpha.1

@parseplatformorg parseplatformorg added the state:released-alpha Released as alpha version label Nov 10, 2022
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 6.0.0-beta.1

@parseplatformorg parseplatformorg added the state:released-beta Released as beta version label Jan 31, 2023
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 6.0.0

@parseplatformorg parseplatformorg added the state:released Released as stable version label Jan 31, 2023
@mtrezza mtrezza deleted the fix-alpha-24gg branch June 5, 2023 16:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
state:released Released as stable version state:released-alpha Released as alpha version state:released-beta Released as beta version
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants