fix: updating object includes unchanged keys in client response for certain key types #8159

dblythy · 2022-09-10T03:01:37Z

New Pull Request Checklist

I am not disclosing a vulnerability.
I am creating this PR in reference to an issue.

Issue Description

== does not work for objects, so if the field is an object type, the key will be in the response. This can lead to the JS SDK storing it as a new value, breaking object reference and causing the JS SDK CI to fail.

Related issue: #1515

Approach

Uses lodash isEqual

TODOs before merging

A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)

parse-github-assistant · 2022-09-10T03:01:39Z

Thanks for opening this pull request!

🎉 We are excited about your hands-on contribution!

codecov · 2022-09-10T03:09:34Z

Codecov Report

Base: 94.20% // Head: 94.21% // Increases project coverage by +0.00% 🎉

Coverage data is based on head (a0fa4bf) compared to base (e424137).
Patch coverage: 100.00% of modified lines in pull request are covered.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha    #8159   +/-   ##
=======================================
  Coverage   94.20%   94.21%           
=======================================
  Files         182      182           
  Lines       13726    13731    +5     
=======================================
+ Hits        12931    12936    +5     
  Misses        795      795

Impacted Files	Coverage Δ
src/RestWrite.js	`94.76% <100.00%> (+0.03%)`	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

src/RestWrite.js

mtrezza

Looks good! Let's see whether CI passes.

dblythy · 2022-09-12T00:34:11Z

Seems to be all good

mtrezza · 2022-09-12T09:15:14Z

So this can be merged?

mtrezza · 2022-09-12T09:16:45Z

Could you rephrase the PR title, to make it more understandable when someone reads the changelog?

mtrezza · 2022-09-14T10:54:20Z

I'm still not sure about the PR title; is this only a CI issue? Or is this a bug that has any relevance for developers?

dblythy · 2022-09-14T10:57:22Z

It does have relevance to developers, the write response will have GeoPoints, Array, Objects, etc that are unchanged (object types that === doesn't work for). This means that since the equality check was introduced, Parse Server added unnecessary keys to the response object.

mtrezza · 2022-09-14T11:47:58Z

Got it, and this issue only occurs when updating an object? So maybe we can say

fix: updating object includes unchanged keys in client response for certain key types ?

dblythy · 2022-09-14T11:49:54Z

Yes that’s a bit more descriptive - thanks! I might write a test to make sure this issue doesn’t happen again

…o patch-4

mtrezza · 2022-09-14T12:07:41Z

OK, I removed the review request, could you please request again when the test is added?

mtrezza · 2022-09-14T17:17:26Z

Could you link the tests (PR) you are referring to?

dblythy · 2022-09-15T06:22:22Z

Yes, this PR in the JS SDK is pointed to this branch, so the tests there had to pass as well. For this issue to be resolved, tests had to pass both here and in the PR that points to this branch, to ensure that the JS SDK integration tests will be stable moving forward.

mtrezza · 2022-09-15T14:45:30Z

I want to make sure I don't overlook a review. How is this issue progressing, anything ready for review / merge?

dblythy · 2022-09-15T16:45:46Z

It is ready for review now. Was a bit of a challenge to get going but should be good

spec/RestQuery.spec.js

mtrezza

Looks good! Waiting for CI to pass...

# [5.3.0-alpha.25](5.3.0-alpha.24...5.3.0-alpha.25) (2022-09-17) ### Bug Fixes * updating object includes unchanged keys in client response for certain key types ([#8159](#8159)) ([37af1d7](37af1d7))

parseplatformorg · 2022-09-17T16:30:40Z

🎉 This change has been released in version 5.3.0-alpha.25

# [5.4.0-beta.1](5.3.0...5.4.0-beta.1) (2022-10-29) ### Bug Fixes * authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([#8187](#8187)) ([8c8ec71](8c8ec71)) * brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([#8146](#8146)) [skip release] ([4c0c7c7](4c0c7c7)) * certificate in Apple Game Center auth adapter not validated [skip release] ([#8058](#8058)) ([75af9a2](75af9a2)) * graphQL query ignores condition `equalTo` with value `false` ([#8032](#8032)) ([7f5a15d](7f5a15d)) * internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([#8121](#8121)) ([c16f529](c16f529)) * invalid file request not properly handled [skip release] ([#8062](#8062)) ([4c9e956](4c9e956)) * liveQuery with `containedIn` not working when object field is an array ([#8128](#8128)) ([1d9605b](1d9605b)) * protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8076](#8076)) ([9fd4516](9fd4516)) * push notifications `badge` doesn't update with Installation beforeSave trigger ([#8162](#8162)) ([3c75c2b](3c75c2b)) * query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([#8167](#8167)) ([e424137](e424137)) * relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([#8203](#8203)) ([28f0d26](28f0d26)) * security upgrade undici from 5.6.0 to 5.8.0 ([#8108](#8108)) ([4aa016b](4aa016b)) * server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([#8238](#8238)) ([c03908f](c03908f)) * session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([#8180](#8180)) ([37fed30](37fed30)) * sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([#8157](#8157)) ([3b775a1](3b775a1)) * updating object includes unchanged keys in client response for certain key types ([#8159](#8159)) ([37af1d7](37af1d7)) ### Features * add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([#8244](#8244)) ([9f11115](9f11115)) * add option to change the default value of the `Parse.Query.limit()` constraint ([#8152](#8152)) ([0388956](0388956)) * add support for MongoDB 6 ([#8242](#8242)) ([aba0081](aba0081)) * add support for Postgres 15 ([#8215](#8215)) ([2feb6c4](2feb6c4)) * liveQuery support for unsorted distance queries ([#8221](#8221)) ([0f763da](0f763da))

parseplatformorg · 2022-10-29T20:07:23Z

🎉 This change has been released in version 5.4.0-beta.1

# [5.4.0-alpha.1](5.3.0...5.4.0-alpha.1) (2022-10-31) ### Bug Fixes * authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([#8187](#8187)) ([8c8ec71](8c8ec71)) * brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([#8146](#8146)) [skip release] ([4c0c7c7](4c0c7c7)) * certificate in Apple Game Center auth adapter not validated [skip release] ([#8058](#8058)) ([75af9a2](75af9a2)) * graphQL query ignores condition `equalTo` with value `false` ([#8032](#8032)) ([7f5a15d](7f5a15d)) * internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([#8121](#8121)) ([c16f529](c16f529)) * invalid file request not properly handled [skip release] ([#8062](#8062)) ([4c9e956](4c9e956)) * liveQuery with `containedIn` not working when object field is an array ([#8128](#8128)) ([1d9605b](1d9605b)) * protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8076](#8076)) ([9fd4516](9fd4516)) * push notifications `badge` doesn't update with Installation beforeSave trigger ([#8162](#8162)) ([3c75c2b](3c75c2b)) * query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([#8167](#8167)) ([e424137](e424137)) * relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([#8203](#8203)) ([28f0d26](28f0d26)) * security upgrade undici from 5.6.0 to 5.8.0 ([#8108](#8108)) ([4aa016b](4aa016b)) * server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([#8238](#8238)) ([c03908f](c03908f)) * session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([#8180](#8180)) ([37fed30](37fed30)) * sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([#8157](#8157)) ([3b775a1](3b775a1)) * updating object includes unchanged keys in client response for certain key types ([#8159](#8159)) ([37af1d7](37af1d7)) ### Features * add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([#8244](#8244)) ([9f11115](9f11115)) * add option to change the default value of the `Parse.Query.limit()` constraint ([#8152](#8152)) ([0388956](0388956)) * add support for MongoDB 6 ([#8242](#8242)) ([aba0081](aba0081)) * add support for Postgres 15 ([#8215](#8215)) ([2feb6c4](2feb6c4)) * liveQuery support for unsorted distance queries ([#8221](#8221)) ([0f763da](0f763da))

parseplatformorg · 2022-10-31T14:43:48Z

🎉 This change has been released in version 5.4.0-alpha.1

# [5.4.0](5.3.3...5.4.0) (2022-11-19) ### Bug Fixes * authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([#8187](#8187)) ([8c8ec71](8c8ec71)) * brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([#8146](#8146)) [skip release] ([4c0c7c7](4c0c7c7)) * certificate in Apple Game Center auth adapter not validated [skip release] ([#8058](#8058)) ([75af9a2](75af9a2)) * graphQL query ignores condition `equalTo` with value `false` ([#8032](#8032)) ([7f5a15d](7f5a15d)) * internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([#8121](#8121)) ([c16f529](c16f529)) * invalid file request not properly handled [skip release] ([#8062](#8062)) ([4c9e956](4c9e956)) * liveQuery with `containedIn` not working when object field is an array ([#8128](#8128)) ([1d9605b](1d9605b)) * protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([#8076](#8076)) ([9fd4516](9fd4516)) * push notifications `badge` doesn't update with Installation beforeSave trigger ([#8162](#8162)) ([3c75c2b](3c75c2b)) * query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([#8167](#8167)) ([e424137](e424137)) * relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([#8203](#8203)) ([28f0d26](28f0d26)) * security upgrade undici from 5.6.0 to 5.8.0 ([#8108](#8108)) ([4aa016b](4aa016b)) * server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([#8238](#8238)) ([c03908f](c03908f)) * session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([#8180](#8180)) ([37fed30](37fed30)) * sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([#8157](#8157)) ([3b775a1](3b775a1)) * updating object includes unchanged keys in client response for certain key types ([#8159](#8159)) ([37af1d7](37af1d7)) ### Features * add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([#8244](#8244)) ([9f11115](9f11115)) * add option to change the default value of the `Parse.Query.limit()` constraint ([#8152](#8152)) ([0388956](0388956)) * add support for MongoDB 6 ([#8242](#8242)) ([aba0081](aba0081)) * add support for Postgres 15 ([#8215](#8215)) ([2feb6c4](2feb6c4)) * liveQuery support for unsorted distance queries ([#8221](#8221)) ([0f763da](0f763da))

parseplatformorg · 2022-11-19T03:43:56Z

🎉 This change has been released in version 5.4.0

parseplatformorg · 2022-11-19T11:49:29Z

🎉 This change has been released in version 5.4.0

* authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration `appIds` is set as a string (e.g. `abc`) instead of an array of strings (e.g. `["abc"]`) ([GHSA-r657-33vp-gp22](GHSA-r657-33vp-gp22)) [skip release] ([parse-community#8187](parse-community#8187)) ([8c8ec71](parse-community@8c8ec71)) * brute force guessing of user sensitive data via search patterns (GHSA-2m6g-crv8-p3c6) ([parse-community#8146](parse-community#8146)) [skip release] ([4c0c7c7](parse-community@4c0c7c7)) * certificate in Apple Game Center auth adapter not validated [skip release] ([parse-community#8058](parse-community#8058)) ([75af9a2](parse-community@75af9a2)) * graphQL query ignores condition `equalTo` with value `false` ([parse-community#8032](parse-community#8032)) ([7f5a15d](parse-community@7f5a15d)) * internal indices for classes `_Idempotency` and `_Role` are not protected in defined schema ([parse-community#8121](parse-community#8121)) ([c16f529](parse-community@c16f529)) * invalid file request not properly handled [skip release] ([parse-community#8062](parse-community#8062)) ([4c9e956](parse-community@4c9e956)) * liveQuery with `containedIn` not working when object field is an array ([parse-community#8128](parse-community#8128)) ([1d9605b](parse-community@1d9605b)) * protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] ([parse-community#8076](parse-community#8076)) ([9fd4516](parse-community@9fd4516)) * push notifications `badge` doesn't update with Installation beforeSave trigger ([parse-community#8162](parse-community#8162)) ([3c75c2b](parse-community@3c75c2b)) * query aggregation pipeline cannot handle value of type `Date` when `directAccess: true` ([parse-community#8167](parse-community#8167)) ([e424137](parse-community@e424137)) * relation constraints in compound queries `Parse.Query.or`, `Parse.Query.and` not working ([parse-community#8203](parse-community#8203)) ([28f0d26](parse-community@28f0d26)) * security upgrade undici from 5.6.0 to 5.8.0 ([parse-community#8108](parse-community#8108)) ([4aa016b](parse-community@4aa016b)) * server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](GHSA-h423-w6qv-2wj3)) [skip release] ([parse-community#8238](parse-community#8238)) ([c03908f](parse-community@c03908f)) * session object properties can be updated by foreign user; this fixes a security vulnerability in which a foreign user can write to the session object of another user if the session object ID is known; the fix prevents writing to foreign session objects ([GHSA-6w4q-23cf-j9jp](GHSA-6w4q-23cf-j9jp)) [skip release] ([parse-community#8180](parse-community#8180)) ([37fed30](parse-community@37fed30)) * sorting by non-existing value throws `INVALID_SERVER_ERROR` on Postgres ([parse-community#8157](parse-community#8157)) ([3b775a1](parse-community@3b775a1)) * updating object includes unchanged keys in client response for certain key types ([parse-community#8159](parse-community#8159)) ([37af1d7](parse-community@37af1d7)) * add convenience access to Parse Server configuration in Cloud Code via `Parse.Server` ([parse-community#8244](parse-community#8244)) ([9f11115](parse-community@9f11115)) * add option to change the default value of the `Parse.Query.limit()` constraint ([parse-community#8152](parse-community#8152)) ([0388956](parse-community@0388956)) * add support for MongoDB 6 ([parse-community#8242](parse-community#8242)) ([aba0081](parse-community@aba0081)) * add support for Postgres 15 ([parse-community#8215](parse-community#8215)) ([2feb6c4](parse-community@2feb6c4)) * liveQuery support for unsorted distance queries ([parse-community#8221](parse-community#8221)) ([0f763da](parse-community@0f763da))

dblythy added 6 commits January 28, 2021 08:21

Update README.md

e2e9ba2

Update README.md

5bf154f

Update README.md

44047b2

Merge branch 'master' into patch-4

cb3bb42

Update README.md

ed32317

Update RestWrite.js

00d2319

dblythy changed the title ~~fix: don't response shouldn't include equal objects~~ fix: response shouldn't include equal objects Sep 10, 2022

dblythy mentioned this pull request Sep 10, 2022

Package-lock out of sync parse-community/Parse-SDK-JS#1515

Closed

4 tasks

dblythy mentioned this pull request Sep 10, 2022

fix: fix locfile parse-community/Parse-SDK-JS#1542

Closed

2 tasks

mtrezza requested changes Sep 11, 2022

View reviewed changes

src/RestWrite.js Outdated Show resolved Hide resolved

Update RestWrite.js

47e195f

mtrezza previously approved these changes Sep 11, 2022

View reviewed changes

Merge branch 'alpha' into patch-4

b540852

dblythy changed the title ~~fix: response shouldn't include equal objects~~ fix: write response shouldn't include unchanged keys Sep 12, 2022

dblythy requested a review from a team September 14, 2022 00:29

mtrezza changed the title ~~fix: write response shouldn't include unchanged keys~~ fix: updating object includes unchanged keys in client response for certain key types Sep 14, 2022

Merge branch 'patch-4' of https://github.com/dblythy/parse-server int…

3052060

…o patch-4

mtrezza removed the request for review from a team September 14, 2022 12:07

enforce keys

2160c34

dblythy dismissed mtrezza’s stale review via 2160c34 September 14, 2022 12:53

dblythy added 3 commits September 15, 2022 10:53

Update RestWrite.js

e83584d

Update RestWrite.js

debdff5

Merge branch 'alpha' into patch-4

cd82c90

dblythy requested a review from mtrezza September 15, 2022 01:29

mtrezza reviewed Sep 15, 2022

View reviewed changes

spec/RestQuery.spec.js Show resolved Hide resolved

mtrezza approved these changes Sep 16, 2022

View reviewed changes

mtrezza added 3 commits September 16, 2022 20:54

Merge branch 'alpha' into patch-4

1fa9724

Merge branch 'alpha' into patch-4

4f6a4c2

Merge branch 'alpha' into patch-4

a0fa4bf

mtrezza merged commit 37af1d7 into parse-community:alpha Sep 17, 2022

parseplatformorg added the state:released-alpha Released as alpha version label Sep 17, 2022

dblythy deleted the patch-4 branch September 17, 2022 17:26

parseplatformorg added the state:released-beta Released as beta version label Oct 29, 2022

parseplatformorg added the state:released Released as stable version label Nov 19, 2022

parseplatformorg added the state:released-5.x.x Released as LTS version label Nov 19, 2022

dblythy mentioned this pull request Jan 15, 2023

After Save User is not returning fields that I need #8387

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: updating object includes unchanged keys in client response for certain key types #8159

fix: updating object includes unchanged keys in client response for certain key types #8159

dblythy commented Sep 10, 2022 •

edited

parse-github-assistant bot commented Sep 10, 2022 •

edited

codecov bot commented Sep 10, 2022 •

edited

mtrezza left a comment •

edited

dblythy commented Sep 12, 2022

mtrezza commented Sep 12, 2022

mtrezza commented Sep 12, 2022

mtrezza commented Sep 14, 2022

dblythy commented Sep 14, 2022

mtrezza commented Sep 14, 2022 •

edited

dblythy commented Sep 14, 2022 •

edited

mtrezza commented Sep 14, 2022

mtrezza commented Sep 14, 2022

dblythy commented Sep 15, 2022 •

edited

mtrezza commented Sep 15, 2022

dblythy commented Sep 15, 2022

mtrezza left a comment •

edited

parseplatformorg commented Sep 17, 2022

parseplatformorg commented Oct 29, 2022

parseplatformorg commented Oct 31, 2022

parseplatformorg commented Nov 19, 2022

parseplatformorg commented Nov 19, 2022

fix: updating object includes unchanged keys in client response for certain key types #8159

fix: updating object includes unchanged keys in client response for certain key types #8159

Conversation

dblythy commented Sep 10, 2022 • edited

New Pull Request Checklist

Issue Description

Approach

TODOs before merging

parse-github-assistant bot commented Sep 10, 2022 • edited

Thanks for opening this pull request!

codecov bot commented Sep 10, 2022 • edited

Codecov Report

mtrezza left a comment • edited

Choose a reason for hiding this comment

dblythy commented Sep 12, 2022

mtrezza commented Sep 12, 2022

mtrezza commented Sep 12, 2022

mtrezza commented Sep 14, 2022

dblythy commented Sep 14, 2022

mtrezza commented Sep 14, 2022 • edited

dblythy commented Sep 14, 2022 • edited

mtrezza commented Sep 14, 2022

mtrezza commented Sep 14, 2022

dblythy commented Sep 15, 2022 • edited

mtrezza commented Sep 15, 2022

dblythy commented Sep 15, 2022

mtrezza left a comment • edited

Choose a reason for hiding this comment

parseplatformorg commented Sep 17, 2022

parseplatformorg commented Oct 29, 2022

parseplatformorg commented Oct 31, 2022

parseplatformorg commented Nov 19, 2022

parseplatformorg commented Nov 19, 2022

dblythy commented Sep 10, 2022 •

edited

parse-github-assistant bot commented Sep 10, 2022 •

edited

codecov bot commented Sep 10, 2022 •

edited

mtrezza left a comment •

edited

mtrezza commented Sep 14, 2022 •

edited

dblythy commented Sep 14, 2022 •

edited

dblythy commented Sep 15, 2022 •

edited

mtrezza left a comment •

edited