parse-stack-next 5.7.6 → 5.8.1

data/lib/parse/webhooks/payload.rb

@@ -557,13 +557,56 @@ module Parse
         # object from @object/@original).
         return @parse_object if defined?(@parse_object) && !@parse_object.nil?
         @parse_object = build_parse_object
+        # On a beforeSave create, note when the handler assigns an ACL. The
+        # model's dirty tracking ignores an assignment equal to the default
+        # stamp (`obj.acl = Parse::ACL.new` under a `{}` default), and the
+        # reply must still treat it as the handler's explicit choice.
+        if before_save? && @original.blank? && @parse_object.is_a?(Parse::Object)
+          @parse_object.extend(HandlerAclAssignment)
+        end
+        @parse_object
+      end
+
+      # Marks an object whose handler assigned its ACL. Used only on the
+      # object a beforeSave create handler receives.
+      # @!visibility private
+      module HandlerAclAssignment
+        def acl=(value)
+          @_webhook_handler_acl_assigned = true
+          super
+        end
+
+        # Mass assignment (`attributes=`, `apply_attributes!`) sets the ACL
+        # through these setters rather than `acl=`: `acl` by its Ruby name,
+        # `ACL` (an alias bound at class definition) by its remote name.
+        def acl_set_attribute!(*args, **kwargs, &block)
+          @_webhook_handler_acl_assigned = true
+          super
+        end
+
+        def ACL_set_attribute!(*args, **kwargs, &block)
+          @_webhook_handler_acl_assigned = true
+          super
+        end
+
+        # Forget assignments made before the handler ran (the field-guard
+        # pre-step reverts a client ACL through `acl=`).
+        # @!visibility private
+        def reset_webhook_handler_acl_assigned!
+          @_webhook_handler_acl_assigned = false
+        end
+
+        # @return [Boolean] whether the handler assigned the ACL.
+        def webhook_handler_acl_assigned?
+          @_webhook_handler_acl_assigned == true
+        end
       end
 
       # @!visibility private
       # Returns `true` when `@object`/`@original` contain a className that
-      # disagrees with the trigger's expected class. Used to skip building
-      # a typed object when the payload was clearly forged or routed
-      # incorrectly.
+      # disagrees with the trigger's expected class (the class from the
+      # webhook URL path). The Rack app refuses such a request before any
+      # handler runs, since the payload was forged or routed incorrectly.
       def payload_class_mismatch?
         expected = parse_class
         return false if expected.nil?
@@ -573,6 +616,44 @@ module Parse
         end
       end
 
+      # @!visibility private
+      # The memoized {#parse_object} if one was built during this request
+      # (by a handler or the field-guard step), else nil. Never builds one.
+      # @return [Parse::Object, nil]
+      def memoized_parse_object
+        defined?(@parse_object) ? @parse_object : nil
+      end
+
+      # @!visibility private
+      # A new, unmemoized build of the trigger object, as the client's write
+      # describes it (no handler edits, no field-guard reverts). The beforeSave
+      # reply diffs the handler's object against this.
+      # @return [Parse::Object, nil]
+      def unmemoized_parse_object
+        return nil unless object?
+        build_parse_object
+      rescue StandardError
+        # Comparison baseline only: an unbuildable payload (e.g. a class with
+        # no registered model) leaves every dirty field counted as changed.
+        nil
+      end
+
+      # @!visibility private
+      # The `object` hash exactly as Parse Server sent it, before credential
+      # and vector scrubbing. Used only to rebuild the client's write for a
+      # beforeSave reply; never logged or exposed through {#as_json}.
+      # @return [Hash, nil]
+      def raw_object
+        @raw.is_a?(Hash) ? @raw[:object] : nil
+      end
+
+      # @!visibility private
+      # The `original` hash exactly as Parse Server sent it (see {#raw_object}).
+      # @return [Hash, nil]
+      def raw_original
+        @raw.is_a?(Hash) ? @raw[:original] : nil
+      end
+
       # Force a fresh build, discarding any memoized parse_object. Used by the
       # webhook framework after mutating @object / @update so a subsequent
       # parse_object call picks up the modified payload state.
@@ -678,11 +759,20 @@ module Parse
       # a specific message. When used inside of a registered cloud code webhook
       # function or trigger, will halt processing and return the proper error response
       # code back to the Parse server.
+      # @example
+      #   error!("title is required")
+      #   error!("duplicate slug", code: 137) # see note on code
       # @param msg [String] the error message to send back.
+      # @param code [Integer, nil] an optional Parse error code, written to the
+      #   error body as `"code"` and available as
+      #   {Parse::Webhooks::ResponseError#code}. Parse Server's HTTP webhook
+      #   adapter (as of 9.10) still reports webhook errors to the client as
+      #   code 141; the code reaches in-process callers such as
+      #   {Parse::Webhooks.run_function}.
       # @raise Parse::Webhooks::ResponseError
       # @return [Parse::Webhooks::ResponseError] the raised exception
-      def error!(msg = "")
-        raise Parse::Webhooks::ResponseError, msg
+      def error!(msg = "", code: nil)
+        raise Parse::Webhooks::ResponseError.new(msg, code: code)
       end
 
       # Register a block to run **after** this webhook's response has been sent
@@ -729,10 +819,50 @@ module Parse
         @deferred_callbacks ||= []
       end
 
+      # The query of a beforeFind (or LiveQuery beforeSubscribe) trigger as a
+      # {Parse::Query}.
+      #
+      # Parse Server sends the query in its REST JSON form: the constraints sit
+      # under `where`, next to `limit`, `skip`, `order` (a comma-separated
+      # string, `-` for descending), `keys` and `include`. Only the `where`
+      # entries become constraints, and they are added verbatim, so a field
+      # that happens to be named like a query option (`limit`, `order`,
+      # `key`) is still a field constraint. A top-level `$or` is kept; other
+      # top-level operators are left out of the returned query (the raw form
+      # is always available as {#query}).
       # @return [Parse::Query] the Parse query for a beforeFind trigger.
       def parse_query
         return nil unless parse_class.present? && @query.is_a?(Hash)
-        Parse::Query.new parse_class, @query
+        spec = @query.with_indifferent_access
+        q = Parse::Query.new(parse_class)
+        where = spec[:where]
+        if where.is_a?(Hash)
+          constraints = where.filter_map do |field, value|
+            field = field.to_s
+            if field == "$or"
+              Parse::Constraint::CompoundQueryConstraint.new(:or, Array.wrap(value))
+            elsif field.start_with?("$")
+              # Other top-level operators ($and, $nor, $relatedTo) have no
+              # field-constraint form here; they stay visible in #query.
+              nil
+            else
+              Parse::Constraint.create(field, value)
+            end
+          end
+          q.add_constraints(constraints)
+        end
+        q.limit(spec[:limit].to_i) if spec[:limit].is_a?(Numeric) && spec[:limit].to_i >= 0
+        q.skip(spec[:skip].to_i) if spec[:skip].is_a?(Numeric) && spec[:skip].to_i > 0
+        split = ->(v) { v.is_a?(Array) ? v.map(&:to_s) : v.to_s.split(",").map(&:strip).reject(&:empty?) }
+        order = split.call(spec[:order]).map do |f|
+          f.start_with?("-") ? Parse::Order.new(f[1..].to_sym, :desc) : Parse::Order.new(f.to_sym, :asc)
+        end
+        q.order(order) if order.any?
+        keys = split.call(spec[:keys])
+        q.keys(keys) if keys.any?
+        includes = split.call(spec[:include])
+        q.includes(includes) if includes.any?
+        q
       end
 
       # Returns true if this webhook was triggered by a Ruby Parse Stack request.

data/lib/parse/webhooks/replay_protection.rb

@@ -19,13 +19,19 @@ module Parse
     #
     # This module adds two layers on top of the existing static-key check:
     #
-    # 1. **Always-on body+request-id dedup.** A bounded LRU records a
-    #    SHA-256 of `(request_id || "")` joined with the request body. A
-    #    duplicate seen within `replay_window_seconds` is rejected with
-    #    `"Webhook replay detected."`. Cooperation with Parse Server is not
-    #    required; this protects against in-window replays only, but those
-    #    are the cheapest attack to mount (proxy retries, captured fast
-    #    loops, retransmits).
+    # 1. **Nonce-keyed dedup.** When a delivery carries a per-delivery
+    #    identifier (an `X-Parse-Request-Id` or `X-Parse-Webhook-Nonce`
+    #    header), a bounded LRU records a SHA-256 of that identifier joined
+    #    with the request body. A duplicate seen within
+    #    `replay_window_seconds` is rejected with
+    #    `"Webhook replay detected."`.
+    #
+    #    Parse Server sends neither header on its webhook deliveries, so for
+    #    a stock deployment this layer is inactive. It deliberately does NOT
+    #    fall back to the body alone: two legitimate calls with identical
+    #    bodies (the same function called twice with the same params, the
+    #    same find run twice) are indistinguishable from a replay by body,
+    #    and rejecting them breaks correct traffic.
     #
     # 2. **Opt-in HMAC freshness verification.** When a `signing_secret` is
     #    configured (programmatically or via
@@ -37,20 +43,22 @@ module Parse
     #      bytes `"#{timestamp}.#{body}"` keyed with the signing secret.
     #
     #    Requests outside `signing_max_skew_seconds` (default 300) or with
-    #    an invalid signature are rejected. Once enabled, this gives full
-    #    binding between the body and the time of delivery and closes the
-    #    replay window beyond the freshness skew.
+    #    an invalid signature are rejected. This bounds a replay to the skew
+    #    window; adding an `X-Parse-Webhook-Nonce` header as well closes that
+    #    window through layer 1.
     #
-    # Operators wanting layer 2 must arrange for Parse Server to add these
-    # headers. Parse Server does not natively sign webhook deliveries, so
-    # this is typically done with a thin Cloud Code wrapper or an egress
-    # proxy. Until enabled, layer 1 still applies.
+    # Operators wanting either layer must arrange for these headers to be
+    # added. Parse Server does not natively sign webhook deliveries or tag
+    # them with a nonce, so this is typically done with a thin Cloud Code
+    # wrapper or an egress proxy.
     module ReplayProtection
       # @!visibility private
       HEADER_TIMESTAMP = "HTTP_X_PARSE_WEBHOOK_TIMESTAMP"
       # @!visibility private
       HEADER_SIGNATURE = "HTTP_X_PARSE_WEBHOOK_SIGNATURE"
       # @!visibility private
+      HEADER_NONCE = "HTTP_X_PARSE_WEBHOOK_NONCE"
+      # @!visibility private
       DEFAULT_REPLAY_WINDOW = 300
       # @!visibility private
       DEFAULT_REPLAY_CACHE_SIZE = 10_000
@@ -76,7 +84,7 @@ module Parse
           @signing_max_skew_seconds || DEFAULT_MAX_SKEW
         end
 
-        # How long a `(request_id, body)` digest stays in the dedup cache.
+        # How long a `(nonce, body)` digest stays in the dedup cache.
         # Duplicates seen within this window are rejected.
         def replay_window_seconds
           @replay_window_seconds || DEFAULT_REPLAY_WINDOW
@@ -113,9 +121,11 @@ module Parse
         # Returns nil when the request passes both replay and signature
         # checks; otherwise returns a short error string suitable for the
         # webhook error response. The headers come from `env` so this
-        # works with any Rack request.
+        # works with any Rack request. Replay dedup applies only when
+        # `request_id` or an `X-Parse-Webhook-Nonce` header is present.
         def verify!(env, body_str, request_id)
           secret = signing_secret
+          signed_key = nil
           if secret && !secret.empty?
             ts_header = env[HEADER_TIMESTAMP].to_s
             sig_header = env[HEADER_SIGNATURE].to_s
@@ -124,13 +134,41 @@ module Parse
             ts = ts_header.to_i
             skew = (Time.now.to_i - ts).abs
             return "Stale webhook timestamp." if skew > signing_max_skew_seconds
-            expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{ts}.#{body_str}")
-            unless ActiveSupport::SecurityUtils.secure_compare(expected, sig_header)
-              return "Invalid webhook signature."
+            # A sender that signs a per-delivery nonce (`ts.nonce.body`) gets a
+            # distinct signature for every delivery, so identical bodies sent
+            # in the same second are not mistaken for replays. The original
+            # `ts.body` form is still accepted.
+            delivery_nonce = env[HEADER_NONCE].to_s.strip
+            candidates = ["#{ts}.#{body_str}"]
+            candidates.unshift("#{ts}.#{delivery_nonce}.#{body_str}") unless delivery_nonce.empty?
+            matched = candidates.any? do |material|
+              expected = OpenSSL::HMAC.hexdigest("SHA256", secret, material)
+              ActiveSupport::SecurityUtils.secure_compare(expected, sig_header)
             end
+            return "Invalid webhook signature." unless matched
+            # A signed delivery is deduplicated on its signature, which covers
+            # the timestamp and body and cannot be changed without the secret.
+            # Keying it on the unsigned nonce would let a captured request be
+            # replayed within the timestamp window by altering or dropping
+            # that header.
+            signed_key = "sig\x1f#{sig_header}"
           end
 
-          digest = Digest::SHA256.hexdigest("#{request_id}\x1f#{body_str}")
+          if signed_key
+            window = [replay_window_seconds, signing_max_skew_seconds * 2].max
+            digest = Digest::SHA256.hexdigest(signed_key)
+            return "Webhook replay detected." if cache.seen?(digest, window)
+            cache.record(digest, replay_cache_size)
+            return nil
+          end
+
+          # Dedup only when the delivery carries a per-delivery identifier.
+          # Keying on the body alone rejects legitimate identical requests.
+          nonce = request_id.to_s.strip
+          nonce = env[HEADER_NONCE].to_s.strip if nonce.empty?
+          return nil if nonce.empty?
+
+          digest = Digest::SHA256.hexdigest("#{nonce}\x1f#{body_str}")
           if cache.seen?(digest, replay_window_seconds)
             return "Webhook replay detected."
           end