Skip to content

Commit a310696

Browse files
coratgerlcoratgerl
committed
feat: sanitize error for security
1 parent 8ff1d89 commit a310696

34 files changed

+284
-138
lines changed

‎spec/AudienceRouter.spec.js‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,7 @@ describe('AudiencesRouter', () => {
269269
}).then(
270270
() => {},
271271
error => {
272-
expect(error.message).toEqual('unauthorized: master key is required');
272+
expect(error.message).toEqual('Permission denied');
273273
done();
274274
}
275275
);
@@ -279,7 +279,7 @@ describe('AudiencesRouter', () => {
279279
Parse._request('GET', 'push_audiences', {}).then(
280280
() => {},
281281
error => {
282-
expect(error.message).toEqual('unauthorized: master key is required');
282+
expect(error.message).toEqual('Permission denied');
283283
done();
284284
}
285285
);
@@ -289,7 +289,7 @@ describe('AudiencesRouter', () => {
289289
Parse._request('GET', `push_audiences/someId`, {}).then(
290290
() => {},
291291
error => {
292-
expect(error.message).toEqual('unauthorized: master key is required');
292+
expect(error.message).toEqual('Permission denied');
293293
done();
294294
}
295295
);
@@ -301,7 +301,7 @@ describe('AudiencesRouter', () => {
301301
}).then(
302302
() => {},
303303
error => {
304-
expect(error.message).toEqual('unauthorized: master key is required');
304+
expect(error.message).toEqual('Permission denied');
305305
done();
306306
}
307307
);
@@ -311,7 +311,7 @@ describe('AudiencesRouter', () => {
311311
Parse._request('DELETE', `push_audiences/someId`, {}).then(
312312
() => {},
313313
error => {
314-
expect(error.message).toEqual('unauthorized: master key is required');
314+
expect(error.message).toEqual('Permission denied');
315315
done();
316316
}
317317
);

‎spec/LogsRouter.spec.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ describe_only(() => {
6161
}).then(fail, response => {
6262
const body = response.data;
6363
expect(response.status).toEqual(403);
64-
expect(body.error).toEqual('unauthorized: master key is required');
64+
expect(body.error).toEqual('Permission denied');
6565
done();
6666
});
6767
});

‎spec/ParseAPI.spec.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1724,7 +1724,7 @@ describe('miscellaneous', () => {
17241724
fail('Should not succeed');
17251725
})
17261726
.catch(response => {
1727-
expect(response.data.error).toEqual('unauthorized: master key is required');
1727+
expect(response.data.error).toEqual('Permission denied');
17281728
done();
17291729
});
17301730
});

‎spec/ParseFile.spec.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ describe('Parse.File testing', () => {
156156
}).then(fail, response => {
157157
const del_b = response.data;
158158
expect(response.status).toEqual(403);
159-
expect(del_b.error).toMatch(/unauthorized/);
159+
expect(del_b.error).toBe('Permission denied');
160160
// incorrect X-Parse-Master-Key header
161161
request({
162162
method: 'DELETE',
@@ -169,7 +169,7 @@ describe('Parse.File testing', () => {
169169
}).then(fail, response => {
170170
const del_b2 = response.data;
171171
expect(response.status).toEqual(403);
172-
expect(del_b2.error).toMatch(/unauthorized/);
172+
expect(del_b2.error).toBe('Permission denied');
173173
done();
174174
});
175175
});
@@ -760,7 +760,7 @@ describe('Parse.File testing', () => {
760760
url: 'http://localhost:8378/1/files/invalid-id/invalid-file.txt',
761761
}).catch(e => e);
762762
expect(res1.status).toBe(403);
763-
expect(res1.data).toEqual({ code: 119, error: 'Invalid application ID.' });
763+
expect(res1.data).toEqual({ code: 119, error: 'Permission denied' });
764764
// Ensure server did not crash
765765
const res2 = await request({ url: 'http://localhost:8378/1/health' });
766766
expect(res2.status).toEqual(200);

‎spec/ParseGlobalConfig.spec.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ describe('a GlobalConfig', () => {
233233
}).then(fail, response => {
234234
const body = response.data;
235235
expect(response.status).toEqual(403);
236-
expect(body.error).toEqual('unauthorized: master key is required');
236+
expect(body.error).toEqual('Permission denied');
237237
done();
238238
});
239239
});

‎spec/ParseGraphQLServer.spec.js‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3501,7 +3501,7 @@ describe('ParseGraphQLServer', () => {
35013501
fail('should fail');
35023502
} catch (e) {
35033503
expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
3504-
expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
3504+
expect(e.graphQLErrors[0].message).toEqual('Permission denied');
35053505
}
35063506
});
35073507

@@ -3871,7 +3871,7 @@ describe('ParseGraphQLServer', () => {
38713871
fail('should fail');
38723872
} catch (e) {
38733873
expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
3874-
expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
3874+
expect(e.graphQLErrors[0].message).toEqual('Permission denied');
38753875
}
38763876
});
38773877

@@ -4096,7 +4096,7 @@ describe('ParseGraphQLServer', () => {
40964096
fail('should fail');
40974097
} catch (e) {
40984098
expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
4099-
expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
4099+
expect(e.graphQLErrors[0].message).toEqual('Permission denied');
41004100
}
41014101
});
41024102

@@ -4137,7 +4137,7 @@ describe('ParseGraphQLServer', () => {
41374137
fail('should fail');
41384138
} catch (e) {
41394139
expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
4140-
expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
4140+
expect(e.graphQLErrors[0].message).toEqual('Permission denied');
41414141
}
41424142
});
41434143

@@ -4155,7 +4155,7 @@ describe('ParseGraphQLServer', () => {
41554155
fail('should fail');
41564156
} catch (e) {
41574157
expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
4158-
expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
4158+
expect(e.graphQLErrors[0].message).toEqual('Permission denied');
41594159
}
41604160
});
41614161
});
@@ -6081,7 +6081,7 @@ describe('ParseGraphQLServer', () => {
60816081
}
60826082

60836083
await expectAsync(createObject('GraphQLClass')).toBeRejectedWith(
6084-
jasmine.stringMatching('Permission denied for action create on class GraphQLClass')
6084+
jasmine.stringMatching('Permission denied')
60856085
);
60866086
await expectAsync(createObject('PublicClass')).toBeResolved();
60876087
await expectAsync(
@@ -6115,7 +6115,7 @@ describe('ParseGraphQLServer', () => {
61156115
'X-Parse-Session-Token': user4.getSessionToken(),
61166116
})
61176117
).toBeRejectedWith(
6118-
jasmine.stringMatching('Permission denied for action create on class GraphQLClass')
6118+
jasmine.stringMatching('Permission denied')
61196119
);
61206120
await expectAsync(
61216121
createObject('PublicClass', {

‎spec/ParseInstallation.spec.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ describe('Installations', () => {
176176
.catch(error => {
177177
expect(error.code).toBe(119);
178178
expect(error.message).toBe(
179-
"Clients aren't allowed to perform the find operation on the installation collection."
179+
'Permission denied'
180180
);
181181
done();
182182
});

‎spec/ParseQuery.Aggregate.spec.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ describe('Parse.Query Aggregate testing', () => {
7777
Parse._request('GET', `aggregate/someClass`, {}).then(
7878
() => {},
7979
error => {
80-
expect(error.message).toEqual('unauthorized: master key is required');
80+
expect(error.message).toEqual('Permission denied');
8181
done();
8282
}
8383
);

‎spec/ParseUser.spec.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2661,7 +2661,7 @@ describe('Parse.User testing', () => {
26612661
}).then(fail, response => {
26622662
const b = response.data;
26632663
expect(b.code).toEqual(209);
2664-
expect(b.error).toBe('Invalid session token');
2664+
expect(b.error).toBe('Permission denied');
26652665
done();
26662666
});
26672667
});
@@ -3379,7 +3379,7 @@ describe('Parse.User testing', () => {
33793379
done();
33803380
})
33813381
.catch(err => {
3382-
expect(err.message).toBe("Clients aren't allowed to manually update email verification.");
3382+
expect(err.message).toBe('Permission denied');
33833383
done();
33843384
});
33853385
});
@@ -4393,7 +4393,7 @@ describe('login as other user', () => {
43934393
done();
43944394
} catch (err) {
43954395
expect(err.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
4396-
expect(err.data.error).toBe('master key is required');
4396+
expect(err.data.error).toBe('Permission denied');
43974397
}
43984398

43994399
const sessionsQuery = new Parse.Query(Parse.Session);

‎spec/RestQuery.spec.js‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -165,9 +165,7 @@ describe('rest query', () => {
165165
},
166166
err => {
167167
expect(err.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
168-
expect(err.message).toEqual(
169-
'This user is not allowed to access ' + 'non-existent class: ClientClassCreation'
170-
);
168+
expect(err.message).toEqual('Permission denied');
171169
done();
172170
}
173171
);
@@ -243,7 +241,7 @@ describe('rest query', () => {
243241
expectAsync(new Parse.Query('Test').exists('zip').find()).toBeRejectedWith(
244242
new Parse.Error(
245243
Parse.Error.OPERATION_FORBIDDEN,
246-
'This user is not allowed to query zip on class Test'
244+
'Permission denied'
247245
)
248246
),
249247
]);

0 commit comments

Comments
 (0)