parse-stack-next 5.7.1 → 5.7.3

data/lib/parse/terminal_safe.rb

@@ -0,0 +1,138 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+module Parse
+  # Neutralizes terminal control sequences in untrusted text before it is
+  # written to a terminal, a log record, or an IRB `inspect` line.
+  #
+  # Parse Server returns whatever a tenant stored. Any string that originates
+  # in the database, in a server error message, or in an LLM answer is
+  # attacker-influenced, and a raw ESC byte in that string is not inert once it
+  # reaches a TTY. It can clear the screen, rewrite lines the operator has
+  # already read, retitle the window, or (via OSC 52) write the attacker's
+  # payload into the system clipboard so the operator's next paste runs it.
+  # Bidirectional overrides are the same class of problem: they reorder a line
+  # so what the operator reads is not what the bytes say.
+  #
+  # This module is the SDK's single answer to that. It escapes rather than
+  # deletes, so the offending bytes stay visible in the output (rendered as
+  # `\e`, `\u202E`, and friends) and an operator can still see that
+  # something tried.
+  #
+  # It sanitizes *rendering*, never storage. `result.text`, `object.title`, and
+  # the parsed response body keep their exact bytes. Only the human-readable
+  # form built for a terminal or a log line runs through here.
+  #
+  # @example Rendering an untrusted value
+  #   puts Parse::TerminalSafe.sanitize(post.title)
+  #
+  # @example A single-line log record. Newlines are escaped too, so a stored
+  #   value cannot forge a second log entry.
+  #   logger.warn "#{status} - #{Parse::TerminalSafe.sanitize_line(error)}"
+  module TerminalSafe
+    extend self
+
+    # Codepoint ranges neutralized on every call:
+    #
+    # - 0x00-0x08, 0x0B-0x1F: C0 controls except TAB (0x09) and LF (0x0A).
+    #   This is where ESC (0x1B, the CSI/OSC/DCS introducer), BEL (0x07, the
+    #   OSC string terminator), CR (0x0D, overwrite-the-line), and BS (0x08,
+    #   erase-the-previous-character) live.
+    # - 0x7F: DEL.
+    # - 0x80-0x9F: C1 controls, the 8-bit forms of the same introducers
+    #   (0x9B is CSI, 0x9D is OSC, 0x90 is DCS).
+    # - 0x061C: Arabic letter mark, an implicit bidirectional control that
+    #   reorders a line exactly like the explicit marks below.
+    # - 0x200B-0x200F: zero-width space, non-joiner, joiner, LRM, RLM.
+    # - 0x2028-0x2029: line and paragraph separator. Widely treated as a line
+    #   break by terminals, editors, and log readers, so leaving them intact
+    #   would reintroduce the forged-record problem that escaping LF solves.
+    #   A legitimate line break is LF, which is preserved.
+    # - 0x202A-0x202E: bidirectional embedding and override.
+    # - 0x2060-0x2064: word joiner and the invisible math operators.
+    # - 0x2066-0x2069: the bidirectional isolates.
+    # - 0xFEFF: zero-width no-break space (a BOM appearing mid-string).
+    #
+    # TAB and LF are deliberately absent: both are ordinary formatting in
+    # multi-line output. {#sanitize_line} escapes LF as well.
+    UNSAFE_RANGES = [
+      0x00..0x08, 0x0B..0x1F, 0x7F..0x9F,
+      0x061C..0x061C,
+      0x200B..0x200F, 0x2028..0x2029, 0x202A..0x202E,
+      0x2060..0x2064, 0x2066..0x2069,
+      0xFEFF..0xFEFF,
+    ].freeze
+
+    # Built from codepoints rather than written as literal escapes so the
+    # source of this file stays free of the very bytes it defends against.
+    def self.build_pattern(ranges)
+      body = ranges.map { |r| format("\\u{%04X}-\\u{%04X}", r.first, r.last) }.join
+      Regexp.new("[#{body}]")
+    end
+    private_class_method :build_pattern
+
+    UNSAFE_RE = build_pattern(UNSAFE_RANGES)
+
+    # The same set plus LF, for output that must occupy exactly one line.
+    UNSAFE_LINE_RE = build_pattern(UNSAFE_RANGES + [0x0A..0x0A])
+
+    # Readable escapes for the controls an operator is most likely to see.
+    # Everything else falls back to `\xNN` or `\uNNNN`.
+    NAMED_ESCAPES = {
+      "\0" => "\\0",
+      "\a" => "\\a",
+      "\b" => "\\b",
+      "\n" => "\\n",
+      "\v" => "\\v",
+      "\f" => "\\f",
+      "\r" => "\\r",
+      "\e" => "\\e",
+    }.freeze
+
+    # Escape terminal control sequences in `str`, preserving newlines and tabs.
+    #
+    # @param str [String, #to_s, nil] untrusted text.
+    # @return [String] the same text with control characters escaped. Non-UTF-8
+    #   and invalid-encoding input is coerced to UTF-8 first, so this never
+    #   raises on a binary response body.
+    def sanitize(str)
+      escape(str, UNSAFE_RE)
+    end
+
+    # Escape terminal control sequences and newlines, so untrusted text cannot
+    # forge additional lines. Use for anything written as a single log record
+    # or a single console line.
+    #
+    # @param str [String, #to_s, nil] untrusted text.
+    # @return [String]
+    def sanitize_line(str)
+      escape(str, UNSAFE_LINE_RE)
+    end
+
+    private
+
+    def escape(str, pattern)
+      s = coerce(str)
+      return s unless s.match?(pattern)
+      s.gsub(pattern) { |ch| escape_char(ch) }
+    end
+
+    # Force the input to valid UTF-8 without raising. A response body read off
+    # the wire can be ASCII-8BIT, and a truncated multi-byte sequence is not
+    # valid UTF-8. Either would make `match?` raise ArgumentError, which is
+    # exactly the wrong outcome for a defensive sanitizer.
+    def coerce(str)
+      s = str.is_a?(String) ? str : str.to_s
+      s = s.dup.force_encoding(Encoding::UTF_8) unless s.encoding == Encoding::UTF_8
+      s = s.scrub("�") unless s.valid_encoding?
+      s
+    end
+
+    def escape_char(ch)
+      named = NAMED_ESCAPES[ch]
+      return named if named
+      cp = ch.ord
+      cp <= 0xFF ? format("\\x%02X", cp) : format("\\u%04X", cp)
+    end
+  end
+end

data/lib/parse/webhooks.rb

@@ -11,6 +11,7 @@ require "active_model/serializers/json"
 require "rack"
 require "ostruct"
 require_relative "client"
+require_relative "terminal_safe"
 # Note: Do not require "stack" here - this file is loaded from stack.rb
 # and adding that require would create a circular dependency.
 require_relative "model/object"
@@ -326,7 +327,10 @@ module Parse
       # @param error [StandardError] the raised error.
       # @return [void]
       def report_handler_error(type, error)
-        warn "[Parse::Webhooks] #{type} handler raised #{error.class}: #{error.message}; " \
+        # The handler's message is application-authored but routinely quotes the
+        # payload that triggered it, which is caller-controlled.
+        warn "[Parse::Webhooks] #{type} handler raised #{error.class}: " \
+             "#{Parse::TerminalSafe.sanitize_line(error.message)}; " \
              "continuing with the remaining handlers " \
              "(Parse::Webhooks.abort_after_callbacks_on_error is false)"
         return unless defined?(ActiveSupport::Notifications)
@@ -444,7 +448,6 @@ module Parse
           payload.instance_variable_set(:@ruby_initiated, ruby_initiated)
           trusted_ruby_initiated = ruby_initiated && (payload.master? == true)
         else
-          ruby_initiated = false
           trusted_ruby_initiated = false
         end
 
@@ -672,9 +675,9 @@ module Parse
         # record contents/tokens, and the rest of this file routes log output
         # through the same redactor.
         warn "[Parse::Webhooks] afterSave #{phase} callback raised for " \
-             "#{obj.class}##{obj.id} -- the object is already persisted; " \
-             "logging and continuing: #{e.class}: " \
-             "#{Parse::Middleware::BodyBuilder.redact(e.message)}"
+             "#{obj.class}##{Parse::TerminalSafe.sanitize_line(obj.id)} -- the object is " \
+             "already persisted; logging and continuing: #{e.class}: " \
+             "#{Parse::TerminalSafe.sanitize_line(Parse::Middleware::BodyBuilder.redact(e.message))}"
         nil
       end
 
@@ -854,20 +857,29 @@ module Parse
         begin
           payload = Parse::Webhooks::Payload.new(body_str, webhook_class)
         rescue => e
-          warn "Invalid webhook payload format: #{e}"
+          warn "Invalid webhook payload format: #{Parse::TerminalSafe.sanitize_line(e.to_s)}"
           response.write error("Invalid payload format. Should be valid JSON.")
           return response.finish
         end
 
         if self.logging.present?
+          # Everything interpolated below arrives in the webhook request body:
+          # the trigger/function names, the object id, and the whole payload are
+          # caller-controlled, and these lines go to the app server's console.
+          # Escape control sequences so a stored value cannot drive the terminal
+          # of whoever is tailing the log.
           if payload.trigger?
-            puts "[Webhooks::Request] --> #{payload.trigger_name} #{payload.parse_class}:#{payload.parse_id}"
+            puts "[Webhooks::Request] --> #{Parse::TerminalSafe.sanitize_line(payload.trigger_name)} " \
+                 "#{Parse::TerminalSafe.sanitize_line(payload.parse_class)}:" \
+                 "#{Parse::TerminalSafe.sanitize_line(payload.parse_id)}"
           elsif payload.function?
-            puts "[ParseWebhooks Request] --> Function #{payload.function_name}"
+            puts "[ParseWebhooks Request] --> Function #{Parse::TerminalSafe.sanitize_line(payload.function_name)}"
           end
           if self.logging == :debug
             puts "[Webhooks::Payload] ----------------------------"
-            puts Parse::Middleware::BodyBuilder.redact(payload.as_json.to_json)
+            puts Parse::TerminalSafe.sanitize(
+              Parse::Middleware::BodyBuilder.redact(payload.as_json.to_json)
+            )
             puts "----------------------------------------------------\n"
           end
         end
@@ -892,14 +904,14 @@ module Parse
           else
             if self.logging.present?
               puts "[Webhooks] --> Could not find mapping route for " \
-                "#{Parse::Middleware::BodyBuilder.redact(payload.to_json)}"
+                "#{Parse::TerminalSafe.sanitize_line(Parse::Middleware::BodyBuilder.redact(payload.to_json))}"
             end
           end
 
           result = true if result.nil?
           if self.logging.present?
             puts "[Webhooks::Response] ----------------------------"
-            puts success(result)
+            puts Parse::TerminalSafe.sanitize(success(result))
             puts "----------------------------------------------------\n"
           end
           response.write success(result)
@@ -910,9 +922,13 @@ module Parse
           return response.finish
         rescue Parse::Webhooks::ResponseError, ActiveModel::ValidationError => e
           if payload.trigger?
-            puts "[Webhooks::ResponseError] >> #{payload.trigger_name} #{payload.parse_class}:#{payload.parse_id}: #{e}"
+            puts "[Webhooks::ResponseError] >> #{Parse::TerminalSafe.sanitize_line(payload.trigger_name)} " \
+                 "#{Parse::TerminalSafe.sanitize_line(payload.parse_class)}:" \
+                 "#{Parse::TerminalSafe.sanitize_line(payload.parse_id)}: " \
+                 "#{Parse::TerminalSafe.sanitize_line(e.to_s)}"
           elsif payload.function?
-            puts "[Webhooks::ResponseError] >> #{payload.function_name}: #{e}"
+            puts "[Webhooks::ResponseError] >> #{Parse::TerminalSafe.sanitize_line(payload.function_name)}: " \
+                 "#{Parse::TerminalSafe.sanitize_line(e.to_s)}"
           end
           response.write error(e.to_s)
           return response.finish

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parse-stack-next
 version: !ruby/object:Gem::Version
-  version: 5.7.1
+  version: 5.7.3
 platform: ruby
 authors:
 - Adrian Curtin
@@ -422,6 +422,7 @@ files:
 - lib/parse/stack/railtie.rb
 - lib/parse/stack/tasks.rb
 - lib/parse/stack/version.rb
+- lib/parse/terminal_safe.rb
 - lib/parse/two_factor_auth.rb
 - lib/parse/two_factor_auth/user_extension.rb
 - lib/parse/vector_search.rb