Skip to content

Commit 16cf793

Browse files
coratgerlcoratgerl
committed
fix: auto review
1 parent 767aba0 commit 16cf793

File tree

5 files changed

+52
-7
lines changed

5 files changed

+52
-7
lines changed

‎spec/ParseInstallation.spec.js‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ const Config = require('../lib/Config');
77
const Parse = require('parse/node').Parse;
88
const rest = require('../lib/rest');
99
const request = require('../lib/request');
10+
const { getSanitizedErrorCall } = require('../lib/TestUtils');
1011

1112
let config;
1213
let database;
@@ -157,6 +158,9 @@ describe('Installations', () => {
157158
});
158159

159160
it('should properly fail queying installations', done => {
161+
const sanitizedErrorCall = getSanitizedErrorCall();
162+
const callCountBefore = sanitizedErrorCall.callCountBefore();
163+
160164
const installId = '12345678-abcd-abcd-abcd-123456789abc';
161165
const device = 'android';
162166
const input = {
@@ -174,10 +178,11 @@ describe('Installations', () => {
174178
done();
175179
})
176180
.catch(error => {
177-
expect(error.code).toBe(119);
181+
expect(error.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
178182
expect(error.message).toBe(
179183
'Permission denied'
180184
);
185+
sanitizedErrorCall.checkMessage("Clients aren't allowed to perform the find operation on the installation collection.", callCountBefore);
181186
done();
182187
});
183188
});

‎spec/rest.spec.js‎

Lines changed: 34 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -775,6 +775,8 @@ describe('rest create', () => {
775775
});
776776

777777
it('cannot get object in volatileClasses if not masterKey through pointer', async () => {
778+
const sanitizedErrorCall = getSanitizedErrorCall();
779+
const callCountBefore = sanitizedErrorCall.callCountBefore();
778780
const masterKeyOnlyClassObject = new Parse.Object('_PushStatus');
779781
await masterKeyOnlyClassObject.save(null, { useMasterKey: true });
780782
const obj2 = new Parse.Object('TestObject');
@@ -788,9 +790,12 @@ describe('rest create', () => {
788790
await expectAsync(query.get(obj2.id)).toBeRejectedWithError(
789791
'Permission denied'
790792
);
793+
sanitizedErrorCall.checkMessage("Clients aren't allowed to perform the get operation on the _PushStatus collection.", callCountBefore);
791794
});
792795

793796
it_id('3ce563bf-93aa-4d0b-9af9-c5fb246ac9fc')(it)('cannot get object in _GlobalConfig if not masterKey through pointer', async () => {
797+
const sanitizedErrorCall = getSanitizedErrorCall();
798+
const callCountBefore = sanitizedErrorCall.callCountBefore();
794799
await Parse.Config.save({ privateData: 'secret' }, { privateData: true });
795800
const obj2 = new Parse.Object('TestObject');
796801
obj2.set('globalConfigPointer', {
@@ -804,6 +809,7 @@ describe('rest create', () => {
804809
await expectAsync(query.get(obj2.id)).toBeRejectedWithError(
805810
'Permission denied'
806811
);
812+
sanitizedErrorCall.checkMessage("Clients aren't allowed to perform the get operation on the _GlobalConfig collection.", callCountBefore);
807813
});
808814

809815
it('locks down session', done => {
@@ -949,6 +955,8 @@ describe('rest update', () => {
949955

950956
describe('read-only masterKey', () => {
951957
it('properly throws on rest.create, rest.update and rest.del', () => {
958+
const sanitizedErrorCall = getSanitizedErrorCall();
959+
const callCountBefore = sanitizedErrorCall.callCountBefore();
952960
const config = Config.get('test');
953961
const readOnly = auth.readOnly(config);
954962
expect(() => {
@@ -959,6 +967,7 @@ describe('read-only masterKey', () => {
959967
'Permission denied'
960968
)
961969
);
970+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to perform the create operation.", callCountBefore);
962971
expect(() => {
963972
rest.update(config, readOnly, 'AnObject', {});
964973
}).toThrow();
@@ -971,6 +980,8 @@ describe('read-only masterKey', () => {
971980
await reconfigureServer({
972981
readOnlyMasterKey: 'yolo-read-only',
973982
});
983+
const sanitizedErrorCall = getSanitizedErrorCall();
984+
const callCountBefore = sanitizedErrorCall.callCountBefore();
974985
try {
975986
await request({
976987
url: `${Parse.serverURL}/classes/MyYolo`,
@@ -988,6 +999,7 @@ describe('read-only masterKey', () => {
988999
expect(res.data.error).toBe(
9891000
'Permission denied'
9901001
);
1002+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to perform the create operation.", callCountBefore);
9911003
}
9921004
await reconfigureServer();
9931005
});
@@ -1015,18 +1027,20 @@ describe('read-only masterKey', () => {
10151027
});
10161028

10171029
it('should throw when trying to create RestWrite', () => {
1030+
const sanitizedErrorCall = getSanitizedErrorCall();
1031+
const callCountBefore = sanitizedErrorCall.callCountBefore();
10181032
const config = Config.get('test');
10191033
expect(() => {
10201034
new RestWrite(config, auth.readOnly(config));
10211035
}).toThrow(
1022-
new Parse.Error(
1023-
Parse.Error.OPERATION_FORBIDDEN,
1024-
'Cannot perform a write operation when using readOnlyMasterKey'
1025-
)
1036+
new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
10261037
);
1038+
sanitizedErrorCall.checkMessage("Cannot perform a write operation when using readOnlyMasterKey", callCountBefore);
10271039
});
10281040

10291041
it('should throw when trying to create schema', done => {
1042+
const sanitizedErrorCall = getSanitizedErrorCall();
1043+
const callCountBefore = sanitizedErrorCall.callCountBefore();
10301044
request({
10311045
method: 'POST',
10321046
url: `${Parse.serverURL}/schemas`,
@@ -1041,11 +1055,14 @@ describe('read-only masterKey', () => {
10411055
.catch(res => {
10421056
expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
10431057
expect(res.data.error).toBe('Permission denied');
1058+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to create a schema.", callCountBefore);
10441059
done();
10451060
});
10461061
});
10471062

10481063
it('should throw when trying to create schema with a name', done => {
1064+
const sanitizedErrorCall = getSanitizedErrorCall();
1065+
const callCountBefore = sanitizedErrorCall.callCountBefore();
10491066
request({
10501067
url: `${Parse.serverURL}/schemas/MyClass`,
10511068
method: 'POST',
@@ -1060,11 +1077,14 @@ describe('read-only masterKey', () => {
10601077
.catch(res => {
10611078
expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
10621079
expect(res.data.error).toBe('Permission denied');
1080+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to create a schema.", callCountBefore);
10631081
done();
10641082
});
10651083
});
10661084

10671085
it('should throw when trying to update schema', done => {
1086+
const sanitizedErrorCall = getSanitizedErrorCall();
1087+
const callCountBefore = sanitizedErrorCall.callCountBefore();
10681088
request({
10691089
url: `${Parse.serverURL}/schemas/MyClass`,
10701090
method: 'PUT',
@@ -1079,11 +1099,14 @@ describe('read-only masterKey', () => {
10791099
.catch(res => {
10801100
expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
10811101
expect(res.data.error).toBe('Permission denied');
1102+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to update a schema.", callCountBefore);
10821103
done();
10831104
});
10841105
});
10851106

10861107
it('should throw when trying to delete schema', done => {
1108+
const sanitizedErrorCall = getSanitizedErrorCall();
1109+
const callCountBefore = sanitizedErrorCall.callCountBefore();
10871110
request({
10881111
url: `${Parse.serverURL}/schemas/MyClass`,
10891112
method: 'DELETE',
@@ -1098,11 +1121,14 @@ describe('read-only masterKey', () => {
10981121
.catch(res => {
10991122
expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
11001123
expect(res.data.error).toBe('Permission denied');
1124+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to delete a schema.", callCountBefore);
11011125
done();
11021126
});
11031127
});
11041128

11051129
it('should throw when trying to update the global config', done => {
1130+
const sanitizedErrorCall = getSanitizedErrorCall();
1131+
const callCountBefore = sanitizedErrorCall.callCountBefore();
11061132
request({
11071133
url: `${Parse.serverURL}/config`,
11081134
method: 'PUT',
@@ -1117,11 +1143,14 @@ describe('read-only masterKey', () => {
11171143
.catch(res => {
11181144
expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
11191145
expect(res.data.error).toBe('Permission denied');
1146+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to update the config.", callCountBefore);
11201147
done();
11211148
});
11221149
});
11231150

11241151
it('should throw when trying to send push', done => {
1152+
const sanitizedErrorCall = getSanitizedErrorCall();
1153+
const callCountBefore = sanitizedErrorCall.callCountBefore();
11251154
request({
11261155
url: `${Parse.serverURL}/push`,
11271156
method: 'POST',
@@ -1138,6 +1167,7 @@ describe('read-only masterKey', () => {
11381167
expect(res.data.error).toBe(
11391168
'Permission denied'
11401169
);
1170+
sanitizedErrorCall.checkMessage("read-only masterKey isn't allowed to send push notifications.", callCountBefore);
11411171
done();
11421172
});
11431173
});

‎spec/schemas.spec.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,25 +168,31 @@ describe('schemas', () => {
168168
});
169169

170170
it('requires the master key to get one schema', done => {
171+
const sanitizedErrorCall = getSanitizedErrorCall();
172+
const callCountBefore = sanitizedErrorCall.callCountBefore();
171173
request({
172174
url: 'http://localhost:8378/1/schemas/SomeSchema',
173175
json: true,
174176
headers: restKeyHeaders,
175177
}).then(fail, response => {
176178
expect(response.status).toEqual(403);
177179
expect(response.data.error).toEqual('Permission denied');
180+
sanitizedErrorCall.checkMessage("unauthorized: master key is required", callCountBefore);
178181
done();
179182
});
180183
});
181184

182185
it('asks for the master key if you use the rest key', done => {
186+
const sanitizedErrorCall = getSanitizedErrorCall();
187+
const callCountBefore = sanitizedErrorCall.callCountBefore();
183188
request({
184189
url: 'http://localhost:8378/1/schemas',
185190
json: true,
186191
headers: restKeyHeaders,
187192
}).then(fail, response => {
188193
expect(response.status).toEqual(403);
189194
expect(response.data.error).toEqual('Permission denied');
195+
sanitizedErrorCall.checkMessage("unauthorized: master key is required", callCountBefore);
190196
done();
191197
});
192198
});

‎spec/vulnerabilities.spec.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
const request = require('../lib/request');
2+
const { getSanitizedErrorCall } = require('../lib/TestUtils');
23

34
describe('Vulnerabilities', () => {
45
describe('(GHSA-8xq9-g7ch-35hg) Custom object ID allows to acquire role privilege', () => {
@@ -13,9 +14,12 @@ describe('Vulnerabilities', () => {
1314
});
1415

1516
it('denies user creation with poisoned object ID', async () => {
17+
const sanitizedErrorCall = getSanitizedErrorCall();
18+
const callCountBefore = sanitizedErrorCall.callCountBefore();
1619
await expectAsync(
1720
new Parse.User({ id: 'role:a', username: 'a', password: '123' }).save()
1821
).toBeRejectedWith(new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied'));
22+
sanitizedErrorCall.checkMessage("Invalid object ID.", callCountBefore);
1923
});
2024

2125
describe('existing sessions for users with poisoned object ID', () => {

‎src/RestWrite.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ import defaultLogger from './logger';
3131
// for the _User class.
3232
function RestWrite(config, auth, className, query, data, originalData, clientSDK, context, action) {
3333
if (auth.isReadOnly) {
34-
throw new Parse.Error(
34+
throw createSanitizedError(
3535
Parse.Error.OPERATION_FORBIDDEN,
36-
'Cannot perform a write operation when using readOnlyMasterKey'
36+
'Cannot perform a write operation when using readOnlyMasterKey',
3737
);
3838
}
3939
this.config = config;

0 commit comments

Comments
 (0)