Skip to content

Sanitizes RestWrite.data before passing to inflated object #992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 14, 2016
Merged

Sanitizes RestWrite.data before passing to inflated object #992

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 29 additions & 11 deletions spec/ParseUser.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -905,7 +905,7 @@ describe('Parse.User testing', () => {
}
};
};

var getMockMyOauthProvider = function() {
return {
authData: {
Expand Down Expand Up @@ -1329,7 +1329,7 @@ describe('Parse.User testing', () => {
}
});
});

it("link multiple providers", (done) => {
var provider = getMockFacebookProvider();
var mockProvider = getMockMyOauthProvider();
Expand All @@ -1351,7 +1351,7 @@ describe('Parse.User testing', () => {
ok(model._isLinked("facebook"), "User should be linked to facebook");
ok(model._isLinked("myoauth"), "User should be linked to myoauth");
done();
},
},
error: function(error) {
console.error(error);
fail('SHould not fail');
Expand Down Expand Up @@ -1437,9 +1437,9 @@ describe('Parse.User testing', () => {
}
});
});

it('should have authData in beforeSave and afterSave', (done) => {

Parse.Cloud.beforeSave('_User', (request, response) => {
let authData = request.object.get('authData');
expect(authData).not.toBeUndefined();
Expand All @@ -1451,7 +1451,7 @@ describe('Parse.User testing', () => {
}
response.success();
});

Parse.Cloud.afterSave('_User', (request, response) => {
let authData = request.object.get('authData');
expect(authData).not.toBeUndefined();
Expand All @@ -1463,7 +1463,7 @@ describe('Parse.User testing', () => {
}
response.success();
});

var provider = getMockFacebookProvider();
Parse.User._registerAuthenticationProvider(provider);
Parse.User._logInWith("facebook", {
Expand Down Expand Up @@ -1970,9 +1970,9 @@ describe('Parse.User testing', () => {
}
});
});

// Sometimes the authData still has null on that keys
// https://github.com/ParsePlatform/parse-server/issues/935
// https://github.com/ParsePlatform/parse-server/issues/935
it('should cleanup null authData keys', (done) => {
let database = new Config(Parse.applicationId).database;
database.create('_User', {
Expand Down Expand Up @@ -2003,8 +2003,26 @@ describe('Parse.User testing', () => {
done();
}).catch((err) => {
fail('this should not fail');
done();
done();
})
});
});

it('should aftersave with full object', (done) => {
var hit = 0;
Parse.Cloud.afterSave('_User', (req, res) => {
hit++;
expect(req.object.get('username')).toEqual('User');
res.success();
});
let user = new Parse.User()
user.setUsername('User');
user.setPassword('pass');
user.signUp().then(()=> {
user.set('hello', 'world');
return user.save();
}).then(() => {
Parse.Cloud._removeHook('Triggers', 'afterSave', '_User');
done();
});
})
});
36 changes: 24 additions & 12 deletions src/RestWrite.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ function RestWrite(config, auth, className, query, data, originalData) {
throw new Parse.Error(Parse.Error.INVALID_KEY_NAME, 'objectId ' +
'is an invalid field name.');
}

// When the operation is complete, this.response may have several
// fields.
// response: the actual data to be returned
Expand Down Expand Up @@ -136,7 +136,7 @@ RestWrite.prototype.runBeforeTrigger = function() {
if (this.response) {
return;
}

// Avoid doing any setup for triggers if there is no 'beforeSave' trigger for this class.
if (!triggers.triggerExists(this.className, triggers.Types.beforeSave, this.config.applicationId)) {
return Promise.resolve();
Expand All @@ -154,7 +154,7 @@ RestWrite.prototype.runBeforeTrigger = function() {
// This is an update for existing object.
originalObject = triggers.inflate(extraData, this.originalData);
}
updatedObject.set(Parse._decode(undefined, this.data));
updatedObject.set(this.sanitizedData());

return Promise.resolve().then(() => {
return triggers.maybeRunTrigger(triggers.Types.beforeSave, this.auth, updatedObject, originalObject, this.config.applicationId);
Expand Down Expand Up @@ -254,14 +254,14 @@ RestWrite.prototype.findUsersWithAuthData = function(authData) {
}, []).filter((q) => {
return typeof q !== undefined;
});

let findPromise = Promise.resolve([]);
if (query.length > 0) {
findPromise = this.config.database.find(
this.className,
{'$or': query}, {})
}

return findPromise;
}

Expand All @@ -276,9 +276,9 @@ RestWrite.prototype.handleAuthData = function(authData) {
throw new Parse.Error(Parse.Error.ACCOUNT_ALREADY_LINKED,
'this auth is already used');
}

this.storage['authProvider'] = Object.keys(authData).join(',');

if (results.length == 0) {
this.data.username = cryptoUtils.newToken();
} else if (!this.query) {
Expand Down Expand Up @@ -404,7 +404,7 @@ RestWrite.prototype.transformUser = function() {

// Handles any followup logic
RestWrite.prototype.handleFollowup = function() {

if (this.storage && this.storage['clearSessions']) {
var sessionQuery = {
user: {
Expand All @@ -417,7 +417,7 @@ RestWrite.prototype.handleFollowup = function() {
this.config.database.destroy('_Session', sessionQuery)
.then(this.handleFollowup.bind(this));
}

if (this.storage && this.storage['sendVerificationEmail']) {
delete this.storage['sendVerificationEmail'];
// Fire and forget!
Expand Down Expand Up @@ -695,7 +695,7 @@ RestWrite.prototype.runDatabaseOperation = function() {
throw new Parse.Error(Parse.Error.SESSION_MISSING,
'cannot modify user ' + this.query.objectId);
}

if (this.className === '_Product' && this.data.download) {
this.data.downloadName = this.data.download.name;
}
Expand All @@ -722,7 +722,7 @@ RestWrite.prototype.runDatabaseOperation = function() {
ACL[this.data.objectId] = { read: true, write: true };
ACL['*'] = { read: true, write: false };
this.data.ACL = ACL;
}
}
// Run a create
return this.config.database.create(this.className, this.data, this.runOptions)
.then(() => {
Expand Down Expand Up @@ -770,7 +770,7 @@ RestWrite.prototype.runAfterTrigger = function() {
// Build the inflated object, different from beforeSave, originalData is not empty
// since developers can change data in the beforeSave.
let updatedObject = triggers.inflate(extraData, this.originalData);
updatedObject.set(Parse._decode(undefined, this.data));
updatedObject.set(this.sanitizedData());
updatedObject._handleSaveResponse(this.response.response, this.response.status || 200);

triggers.maybeRunTrigger(triggers.Types.afterSave, this.auth, updatedObject, originalObject, this.config.applicationId);
Expand All @@ -789,5 +789,17 @@ RestWrite.prototype.objectId = function() {
return this.data.objectId || this.query.objectId;
};

// Returns a copy of the data and delete bad keys (_auth_data, _hashed_password...)
RestWrite.prototype.sanitizedData = function() {
let data = Object.keys(this.data).reduce((data, key) => {
// Regexp comes from Parse.Object.prototype.validate
if (!(/^[A-Za-z][0-9A-Za-z_]*$/).test(key)) {
delete data[key];
}
return data;
}, deepcopy(this.data));
return Parse._decode(undefined, data);
}

export default RestWrite;
module.exports = RestWrite;