Cannot create role with : in name

[dblythy]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest versions of Parse Server and the Parse JS SDK.

Issue Description

When creating a new role, using : in the string prevents "name" from being set. I am not sure why this is.

Steps to reproduce

await new Parse.Role(Test:Test, new Parse.ACL()).save(null, {useMasterKey: true});

Actual Outcome

Error: name is required.

Expected Outcome

Role to save

Environment

Server

• Parse Server version: FILL_THIS_OUT
• Operating system: FILL_THIS_OUT
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): FILL_THIS_OUT

Database

• System (MongoDB or Postgres): FILL_THIS_OUT
• Database version: FILL_THIS_OUT
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): FILL_THIS_OUT

Client

• Parse JS SDK version: FILL_THIS_OUT

Logs

[parse-github-assistant]

Thanks for opening this issue!

• ❌ Please fill out all fields with a placeholder FILL_THIS_OUT, otherwise your issue will be closed. If a field does not apply to the issue, fill in n/a.

[cbaker6]

Does the server allow a : in the role name? The error in the code in this SDK says it limits the characters on purpose:

Parse-SDK-JS/src/ParseRole.js

Lines 131 to 135 in e2bd6be

	if (!/^[0-9a-zA-Z\-_ ]+$/.test(newName)) {
	return new ParseError(
	ParseError.OTHER_CAUSE,
	"A role's name can be only contain alphanumeric characters, _, " + '-, and spaces.'
	);

I remember the other SDKs having similar code when I was adding Role to the Swift SDK:

• Swift SDK: https://github.com/parse-community/Parse-Swift/blob/c57fc2e1e923c2373fcfcd52eac213a7c618ff92/Sources/ParseSwift/Objects/ParseRole.swift#L118-L125
• Objective C SDK: https://github.com/parse-community/Parse-SDK-iOS-OSX/blob/21de5089f0b09662c06c972c487b1d5731238bff/Parse/Parse/PFRole.m#L70-L71
• Android SDK: https://github.com/parse-community/Parse-SDK-Android/blob/3cd4581f4be4bf34759f43a5ca41619a2190904f/parse/src/main/java/com/parse/ParseRole.java#L25

[dblythy]

It doesn't allow it, trying to set an invalid key as a role name simply results in the name being unset, which causes Error: name is required

[mtrezza]

trying to set an invalid key as a role name simply results in the name being unset

Could you elaborate on this?

[dblythy]

Yes, the following code:

await new Parse.Role(':%#', new Parse.ACL()).save()

rejects on the server side with "Error: name is required"

Where it should reject on the client side with "invalid role name"

[mtrezza]

Got it, so the solution will still deny roles names with colon.