fix: LiveQuery can return incorrectly formatted date #8456

dblythy · 2023-03-05T02:52:17Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.
Link this pull request to an issue.

Issue

The date response can be invalid with LiveQueries on the client.

const Parse = require('parse/node');
Parse.serverURL = 'http://localhost:8378/1';
Parse.initialize('test','test', 'test');

const main = async ()=>{
  const query = new Parse.Query('Contact');
  query.exists('birthDate');
  const subscribe = await query.subscribe();
  subscribe.on('create',async (data)=>{
    console.log(data.get('birthDate') instanceof Date); // returns false
    await data.fetch();
    console.log(data.get('birthDate') instanceof Date); // returns true
  });

  const contact = new Parse.Object('Contact');
  contact.set('birthDate', new Date());
  await contact.save();
};
main();

Closes: #8005

Approach

First commit is failing test.

If a key constraint exists (e.g query.exists('birthDate')) QueryTools will convert the field to be able to compare. However this conversion introduces an unintended side-effect on the JSON that is then sent to the client

Tasks

Add tests

parse-github-assistant · 2023-03-05T02:52:20Z

Thanks for opening this pull request!

dblythy · 2023-03-05T02:53:03Z

Thanks @catalunha for the example code - it helped isolate this issue!

codecov · 2023-03-05T06:41:25Z

Codecov Report

Patch coverage: 100.00% and project coverage change: +0.43 🎉

Comparison is base (ce34747) 93.87% compared to head (53725f9) 94.31%.

❗ Current head 53725f9 differs from pull request most recent head bfd823b. Consider uploading reports for the commit bfd823b to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #8456      +/-   ##
==========================================
+ Coverage   93.87%   94.31%   +0.43%     
==========================================
  Files         183      183              
  Lines       14483    14484       +1     
==========================================
+ Hits        13596    13660      +64     
+ Misses        887      824      -63

Impacted Files	Coverage Δ
src/LiveQuery/ParseLiveQueryServer.js	`95.99% <100.00%> (+0.21%)`	⬆️
src/RestWrite.js	`94.76% <0.00%> (+0.14%)`	⬆️
src/ParseServer.js	`92.64% <0.00%> (+0.43%)`	⬆️
src/Adapters/Files/GridFSBucketAdapter.js	`94.20% <0.00%> (+0.72%)`	⬆️
src/GraphQL/transformers/mutation.js	`97.19% <0.00%> (+9.34%)`	⬆️
src/LiveQuery/ParseCloudCodePublisher.js	`100.00% <0.00%> (+15.78%)`	⬆️
src/GraphQL/loaders/filesMutations.js	`80.64% <0.00%> (+38.70%)`	⬆️
src/Adapters/Cache/RedisCacheAdapter.js	`91.30% <0.00%> (+73.91%)`	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

mtrezza

Looks good! Waiting for CI to pass...

# [6.1.0-alpha.5](6.1.0-alpha.4...6.1.0-alpha.5) (2023-03-06) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a))

parseplatformorg · 2023-03-06T10:27:53Z

🎉 This change has been released in version 6.1.0-alpha.5

# [6.1.0-beta.2](6.1.0-beta.1...6.1.0-beta.2) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([#8446](#8446)) ([22d2446](22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747)) * Rate limiting across multiple servers via Redis not working ([#8469](#8469)) ([d9e347d](d9e347d)) ### Features * Add `afterFind` trigger to authentication adapters ([#8444](#8444)) ([c793bb8](c793bb8)) * Add rate limiting across multiple servers via Redis ([#8394](#8394)) ([34833e4](34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))

parseplatformorg · 2023-05-01T21:37:20Z

🎉 This change has been released in version 6.1.0-beta.2

# [6.1.0](6.0.0...6.1.0) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([#8456](#8456)) ([4ce135a](4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([#8446](#8446)) ([22d2446](22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([#8458](#8458)) ([ce34747](ce34747)) * Rate limiting across multiple servers via Redis not working ([#8469](#8469)) ([d9e347d](d9e347d)) * Security upgrade jsonwebtoken to 9.0.0 ([#8420](#8420)) ([f5bfe45](f5bfe45)) ### Features * Add `afterFind` trigger to authentication adapters ([#8444](#8444)) ([c793bb8](c793bb8)) * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([#8436](#8436)) ([b3b76de](b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([#7551](#7551)) ([e5d610e](e5d610e)) * Add rate limiting across multiple servers via Redis ([#8394](#8394)) ([34833e4](34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([#8517](#8517)) ([4f15539](4f15539)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([#8388](#8388)) ([a49e323](a49e323)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([#8443](#8443)) ([40c1961](40c1961))

parseplatformorg · 2023-05-01T21:52:07Z

🎉 This change has been released in version 6.1.0

commit 1506273 Author: semantic-release-bot <semantic-release-bot@martynus.net> Date: Sat May 20 23:24:03 2023 +0000 chore(release): 6.2.0 [skip ci] # [6.2.0](parse-community/parse-server@6.1.0...6.2.0) (2023-05-20) ### Features * Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` ([parse-community#8538](parse-community#8538)) ([a318e7b](parse-community@a318e7b)) commit a318e7b Author: Manuel <5673677+mtrezza@users.noreply.github.com> Date: Sun May 21 01:23:00 2023 +0200 feat: Add new Parse Server option `fileUpload.fileExtensions` to restrict file upload by file extension; this fixes a security vulnerability in which a phishing attack could be performed using an uploaded HTML file; by default the new option only allows file extensions matching the regex pattern `^[^hH][^tT][^mM][^lL]?$`, which excludes HTML files; if your app currently depends on uploading files with HTML file extensions then this may be a breaking change and you could allow HTML file upload by setting the option to `['.*']` (parse-community#8538) commit 832702d Author: semantic-release-bot <semantic-release-bot@martynus.net> Date: Mon May 1 21:50:23 2023 +0000 chore(release): 6.1.0 [skip ci] # [6.1.0](parse-community/parse-server@6.0.0...6.1.0) (2023-05-01) ### Bug Fixes * LiveQuery can return incorrectly formatted date ([parse-community#8456](parse-community#8456)) ([4ce135a](parse-community@4ce135a)) * Nested date is incorrectly decoded as empty object `{}` when fetching a Parse Object ([parse-community#8446](parse-community#8446)) ([22d2446](parse-community@22d2446)) * Parameters missing in `afterFind` trigger of authentication adapters ([parse-community#8458](parse-community#8458)) ([ce34747](parse-community@ce34747)) * Rate limiting across multiple servers via Redis not working ([parse-community#8469](parse-community#8469)) ([d9e347d](parse-community@d9e347d)) * Security upgrade jsonwebtoken to 9.0.0 ([parse-community#8420](parse-community#8420)) ([f5bfe45](parse-community@f5bfe45)) ### Features * Add `afterFind` trigger to authentication adapters ([parse-community#8444](parse-community#8444)) ([c793bb8](parse-community@c793bb8)) * Add option `schemaCacheTtl` for schema cache pulling as alternative to `enableSchemaHooks` ([parse-community#8436](parse-community#8436)) ([b3b76de](parse-community@b3b76de)) * Add Parse Server option `resetPasswordSuccessOnInvalidEmail` to choose success or error response on password reset with invalid email ([parse-community#7551](parse-community#7551)) ([e5d610e](parse-community@e5d610e)) * Add rate limiting across multiple servers via Redis ([parse-community#8394](parse-community#8394)) ([34833e4](parse-community@34833e4)) * Allow multiple origins for header `Access-Control-Allow-Origin` ([parse-community#8517](parse-community#8517)) ([4f15539](parse-community@4f15539)) * Deprecate LiveQuery `fields` option in favor of `keys` for semantic consistency ([parse-community#8388](parse-community#8388)) ([a49e323](parse-community@a49e323)) * Export `AuthAdapter` to make it available for extension with custom authentication adapters ([parse-community#8443](parse-community#8443)) ([40c1961](parse-community@40c1961)) commit 18b63d1 Merge: f7eee19 f59d46c Author: Manuel <5673677+mtrezza@users.noreply.github.com> Date: Mon May 1 23:49:22 2023 +0200 build: Release (parse-community#8526)

fix: LiveQuery can return incorrectly formatted Dates

5b17a33

Merge branch 'alpha' into fix-dates

1ec0a7e

fix

3020c69

dblythy requested a review from a team March 5, 2023 03:04

deep copy

899c97e

Merge branch 'alpha' into fix-dates

056a8b9

mtrezza approved these changes Mar 5, 2023

View reviewed changes

mtrezza changed the title ~~fix: LiveQuery can return incorrectly formatted Dates~~ fix: LiveQuery can return incorrectly formatted date Mar 5, 2023

mtrezza added 3 commits March 6, 2023 01:35

Merge branch 'alpha' into fix-dates

e5886aa

Merge branch 'alpha' into fix-dates

e1c29e2

Merge branch 'alpha' into fix-dates

bfd823b

mtrezza merged commit 4ce135a into parse-community:alpha Mar 6, 2023

parseplatformorg added the state:released-alpha Released as alpha version label Mar 6, 2023

dblythy deleted the fix-dates branch March 6, 2023 11:32

parseplatformorg added the state:released-beta Released as beta version label May 1, 2023

parseplatformorg added the state:released Released as stable version label May 1, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: LiveQuery can return incorrectly formatted date #8456

fix: LiveQuery can return incorrectly formatted date #8456

dblythy commented Mar 5, 2023

parse-github-assistant bot commented Mar 5, 2023

dblythy commented Mar 5, 2023

codecov bot commented Mar 5, 2023 •

edited

Loading

mtrezza left a comment

parseplatformorg commented Mar 6, 2023

parseplatformorg commented May 1, 2023

parseplatformorg commented May 1, 2023

fix: LiveQuery can return incorrectly formatted date #8456

fix: LiveQuery can return incorrectly formatted date #8456

Conversation

dblythy commented Mar 5, 2023

Pull Request

Issue

Approach

Tasks

parse-github-assistant bot commented Mar 5, 2023

Thanks for opening this pull request!

dblythy commented Mar 5, 2023

codecov bot commented Mar 5, 2023 • edited Loading

Codecov Report

mtrezza left a comment

Choose a reason for hiding this comment

parseplatformorg commented Mar 6, 2023

parseplatformorg commented May 1, 2023

parseplatformorg commented May 1, 2023

codecov bot commented Mar 5, 2023 •

edited

Loading