parse-stack-next 5.8.0 → 5.8.2

data/lib/parse/model/file.rb

@@ -202,7 +202,10 @@ module Parse
       #   Integrators with a CDN in front of Parse files add their CDN host:
       #   `Parse::File.trusted_url_hosts << "cdn.example.com"`. Wildcard
       #   entries via leading "." (e.g. `".cdn.example.com"`) match any
-      #   subdomain.
+      #   subdomain. Entries are compared against the URL's host as written,
+      #   so list internationalized hosts in their punycode (`xn--`) form.
+      #   The port is not part of the match: any port on a trusted host is
+      #   accepted.
       attr_writer :trusted_url_hosts
 
       def trusted_url_hosts
@@ -253,6 +256,20 @@ module Parse
         @untrusted_url_policy ||= :warn
       end
 
+      # @return [Boolean] whether a URL whose file name starts with `tfss-`
+      #   (the legacy Parse hosted-files prefix) is accepted from any host.
+      #   Defaults to `true`, the long-standing contract for apps that serve
+      #   migrated legacy files from their own bucket. The file name alone
+      #   proves nothing about the host, so a writer who can store a File
+      #   value named `tfss-...` can point it anywhere. Set this to `false`
+      #   to require `tfss-` URLs to come from {trusted_url_hosts} like any
+      #   other URL (`files.parsetfss.com` is trusted by default).
+      attr_writer :trust_legacy_tfss_on_any_host
+
+      def trust_legacy_tfss_on_any_host
+        @trust_legacy_tfss_on_any_host.nil? ? true : @trust_legacy_tfss_on_any_host
+      end
+
       # @return [Array<Integer>] Allowed remote ports for URL fetches.
       attr_writer :allowed_remote_ports
 
@@ -776,8 +793,8 @@ module Parse
     # set to true, it will make sure it returns a secure url.
     # @return [String] the url string for the file.
     def url
-      if @url.present? && Parse::File.force_ssl && @url.starts_with?("http://")
-        return @url.sub("http://", "https://")
+      if @url.present? && Parse::File.force_ssl && Parse::Client.url_scheme(@url) == "http"
+        return @url.strip.sub(/\Ahttp:/i, "https:")
       end
       @url
     end
@@ -958,28 +975,63 @@ module Parse
     # - raises {UntrustedHostError} when policy is `:raise`.
     #
     # On `:warn`, the URL is accepted but a single warning per host is
-    # emitted (deduplicated process-wide). Empty / non-string / non-http
-    # values pass through unchanged so callers can clear the field.
+    # emitted (deduplicated process-wide). Empty / non-string values and
+    # relative paths (no scheme) pass through unchanged so callers can
+    # clear the field. Any other scheme (`javascript:`, `data:`, ...) and a
+    # scheme-relative value (`//host`, `\\host`) are checked like an
+    # untrusted host.
+    #
+    # The value is first normalized the way a browser parses it (ASCII tab,
+    # CR, and LF removed anywhere; leading and trailing C0 controls and
+    # spaces stripped). The scheme is then matched case-insensitively,
+    # because browsers resolve `HTTPS://host`, ` https://host`,
+    # `https:host`, `https:\\host`, and `https:///host` to the same
+    # remote host. An http(s) value that is not a well-formed
+    # `scheme://host` URL, does not parse, or has no host is treated as an
+    # untrusted host rather than passed through.
     def self.sanitize_hydrated_url(raw, fallback: nil, name: nil)
       return raw if raw.nil?
       return raw unless raw.is_a?(String) && !raw.empty?
-      return raw unless raw.start_with?("http://") || raw.start_with?("https://")
-
-      uri = begin
-          URI.parse(raw)
-        rescue URI::InvalidURIError
-          return raw  # malformed URL — leave it alone; downstream code already handles
-        end
-      host = uri.host.to_s.downcase
-      return raw if host.empty?
+      candidate = browser_normalized_url(raw)
+      return raw if candidate.empty?
+
+      host = nil
+      if candidate.match?(SCHEME_RELATIVE_PREFIX)
+        # `//host`, `\\host`, `/\host`, and `\/host` are scheme-relative:
+        # browsers resolve them to `host` on the page's scheme.
+        candidate = "https:" + candidate.sub(SCHEME_RELATIVE_PREFIX, "//")
+      elsif !candidate.match?(HTTP_SCHEME_PREFIX)
+        # A relative path ("a.png", "/files/a.png") passes through. Any
+        # other scheme (javascript:, data:, vbscript:, file:, ...) is not a
+        # file URL and is treated as untrusted.
+        return raw unless candidate.match?(URL_SCHEME_PREFIX)
+        return apply_untrusted_url_policy(raw, fallback, "(#{candidate[URL_SCHEME_PREFIX].downcase} URL)")
+      end
 
-      # tfss-prefixed filenames can be served from arbitrary hosts (the
-      # legacy hosted-files contract). Accept those regardless of host.
-      basename = name || File.basename(raw)
-      return raw if basename.to_s.start_with?("tfss-")
+      if candidate.match?(WELL_FORMED_HTTP_URL)
+        host = begin
+            URI.parse(candidate).host.to_s.downcase
+          rescue URI::InvalidURIError
+            nil
+          end
+        host = nil if host && host.empty?
+      end
 
-      return raw if trusted_url_host?(host)
+      if host
+        return raw if trusted_url_host?(host)
+        # tfss-prefixed filenames can be served from arbitrary hosts (the
+        # legacy hosted-files contract) unless the app turned that off.
+        if trust_legacy_tfss_on_any_host
+          basename = name || File.basename(candidate)
+          return raw if basename.to_s.start_with?("tfss-")
+        end
+      end
+      apply_untrusted_url_policy(raw, fallback, host || "(malformed URL)")
+    end
 
+    # Apply {untrusted_url_policy} to a refused URL.
+    # @!visibility private
+    def self.apply_untrusted_url_policy(raw, fallback, host)
       case untrusted_url_policy
       when :raise
         raise UntrustedHostError,
@@ -994,6 +1046,31 @@ module Parse
       end
     end
 
+    # An http or https scheme, any case, at the start of a stripped value.
+    # @!visibility private
+    HTTP_SCHEME_PREFIX = /\Ahttps?:/i
+
+    # Any URL scheme (RFC 3986 `scheme ":"`) at the start of a value.
+    # @!visibility private
+    URL_SCHEME_PREFIX = /\A[a-z][a-z0-9+.\-]*:/i
+
+    # Two leading slashes or backslashes in any mix: a scheme-relative URL.
+    # @!visibility private
+    SCHEME_RELATIVE_PREFIX = %r{\A[/\\][/\\]}
+
+    # The value a browser would parse: ASCII tab, CR, and LF removed
+    # anywhere, then leading and trailing C0 controls and spaces stripped
+    # (WHATWG URL parsing).
+    # @!visibility private
+    def self.browser_normalized_url(value)
+      value.delete("\t\r\n").sub(/\A[\x00-\x20]+/, "").sub(/[\x00-\x20]+\z/, "")
+    end
+
+    # `http://` or `https://` (any case) followed by a host character, so
+    # `https:host`, `https:\\host`, and `https:///host` do not match.
+    # @!visibility private
+    WELL_FORMED_HTTP_URL = %r{\Ahttps?://[^/\\\s]}i
+
     # @!visibility private
     def self.trusted_url_host?(host)
       trusted_url_hosts.any? do |entry|

data/lib/parse/model/object.rb

@@ -1614,8 +1614,54 @@ module Parse
       clear_changes!
     end
 
-    # clears all dirty tracking information
+    # clears all dirty tracking information. Array and relation proxies are
+    # cleared too, so a relation's staged additions and removals are dropped
+    # rather than sent by a later save.
     def clear_changes!
+      clear_proxy_changes!
+      clear_dirty_tracking!
+    end
+
+    # @!visibility private
+    # Instance variable names of the array and relation proxies a class can
+    # hold. Cached per class because {#clear_changes!} runs for every record
+    # built with an id (every query row). The cache is rebuilt when a field
+    # or relation is declared after it was computed.
+    # @return [Array<Symbol>]
+    def self.proxy_change_ivars
+      all_fields = fields
+      all_relations = relations
+      signature = [all_fields.size, all_relations.size]
+      return @_proxy_change_ivars if @_proxy_change_ivars_signature == signature
+      ivars = (all_fields.select { |_, type| type == :array }.keys + all_relations.keys)
+        .uniq.map { |key| :"@#{key}" }.freeze
+      # Assign the list before its signature so a concurrent reader that
+      # sees the new signature also sees the new list.
+      @_proxy_change_ivars = ivars
+      @_proxy_change_ivars_signature = signature
+      ivars
+    end
+
+    # @!visibility private
+    # Clears the dirty state of every array and relation proxy this record
+    # holds, dropping a relation's staged additions and removals.
+    def clear_proxy_changes!
+      ivars = self.class.proxy_change_ivars
+      return if ivars.empty?
+      ivars.each do |ivar|
+        next unless instance_variable_defined?(ivar)
+        proxy = instance_variable_get(ivar)
+        proxy.clear_changes! if proxy.respond_to?(:clear_changes!)
+      end
+    end
+    private :clear_proxy_changes!
+
+    # @!visibility private
+    # Clears the record's own dirty tracking but leaves array and relation
+    # proxies alone. A fetch uses this: it replaces field values from the
+    # server, but a relation's staged additions and removals are not field
+    # values and must survive it (the fetch re-marks the field dirty).
+    def clear_dirty_tracking!
       clear_changes_information
       # Clear the ACL snapshot used for proper acl_was tracking
       @_acl_snapshot_before_change = nil
@@ -1926,6 +1972,11 @@ module Parse
       # so a later edit captures a fresh baseline.
       @acl = Parse::ACL.typecast(snapshot.as_json, self) if snapshot && !@acl.nil?
       @_acl_snapshot_before_change = nil
+      # A relation's staged additions and removals live on its proxy, not in
+      # the attribute ActiveModel restores (after a fetch the restored value
+      # is the proxy with the operations still staged). Drop them so a later
+      # save does not send what was rolled back.
+      clear_proxy_changes!
     end
 
     # Keys that mass assignment never applies to an object: the objectId

data/lib/parse/model/push.rb

@@ -352,7 +352,17 @@ module Parse
         if @channels.is_a?(Array) && @channels.empty? == false
           q.where :channels.in => @channels
         end
-        msg[:where] = q.compile_where unless q.where.empty?
+        unless q.where.empty?
+          compiled = q.compile_rest_where
+          # Constraints that compile to nothing would target every
+          # installation; refuse instead of widening the audience.
+          if compiled.empty?
+            raise ArgumentError,
+                  "The push targeting query has constraints but compiles to no `where`, " \
+                  "which would reach every installation. Check the targeting constraints."
+          end
+          msg[:where] = compiled
+        end
       elsif @channels.is_a?(Array) && @channels.empty? == false
         msg[:channels] = @channels
       end

data/lib/parse/mongodb.rb

@@ -595,6 +595,12 @@ module Parse
       end
 
       # Get a MongoDB collection
+      #
+      # This is raw driver access: reads and writes through the returned
+      # collection apply no ACL, CLP, or protectedFields scope, and it is not
+      # refused inside {Parse.without_master_key}. Use the scoped readers
+      # ({.aggregate}, `results_direct`) for anything a caller's identity
+      # should limit.
       # @param name [String] the collection name
       # @return [Mongo::Collection]
       def collection(name, authorizing_client: nil)
@@ -1481,6 +1487,15 @@ module Parse
                 "They are mutually exclusive."
         end
 
+        if master == true && Parse::ACLScope.master_key_suppressed?
+          # The role graph has no public mode to fall back to, so a master
+          # call inside `Parse.without_master_key` is refused outright.
+          raise Parse::ACLScope::ACLRequired,
+                "Parse::MongoDB.#{method_name}: master: true is dropped inside " \
+                "Parse.without_master_key. Pass `as: <Parse::User|Parse::Pointer>`, " \
+                "or run the call inside Parse.with_master_key."
+        end
+
         if master == true
           return Parse::ACLScope::Resolution.new(
                    mode: :master, permission_strings: nil, user_id: nil, session: nil,
@@ -1750,6 +1765,9 @@ module Parse
         # `scope` are seeded nil so subscribers see a stable key set
         # even on the raise path (where the block exits before either
         # is written).
+        # A caller regex that is not escaped literal text gets a default
+        # server-side time limit when none was given.
+        max_time_ms ||= Parse::PipelineSecurity.regex_time_budget(pipeline)
         instrument_payload = {
           collection: collection_name,
           stage_count: pipeline.is_a?(Array) ? pipeline.size : 0,
@@ -1782,6 +1800,10 @@ module Parse
           # database with this application's permission strings.
           verify_client!(resolution.client)
           payload[:scope] = __scope_label(resolution)
+          # `master: true` inside Parse.without_master_key, downgraded to the
+          # public scope. Lets a subscriber explain a master-key caller that
+          # sees only public rows inside the block.
+          payload[:master_dropped] = true if resolution.respond_to?(:master_dropped?) && resolution.master_dropped?
 
           # Validate BEFORE rewrite so the security denylist is applied to the
           # caller's original pipeline (which an attacker controls), not to
@@ -2168,7 +2190,19 @@ module Parse
       #   $where, $function, or $accumulator at any depth.
       # @raise [Parse::MongoDB::ExecutionTimeout] if the query exceeds max_time_ms
       def find(collection_name, filter = {}, **options)
+        if Parse::ACLScope.master_key_suppressed?
+          # `find` reads raw documents with no ACL scope, which is master
+          # authority. Inside `Parse.without_master_key` that is refused
+          # rather than silently running unscoped.
+          raise Parse::ACLScope::ACLRequired,
+                "Parse::MongoDB.find runs unscoped (master authority) and is refused " \
+                "inside Parse.without_master_key. Use a scoped read (Parse::MongoDB.aggregate " \
+                "with session_token:, or Parse::Query#results_direct), or run the call inside " \
+                "Parse.with_master_key."
+        end
         max_time_ms = options.delete(:max_time_ms)
+        # A regex that is not escaped literal text gets a default time limit.
+        max_time_ms ||= Parse::PipelineSecurity.regex_time_budget(filter)
         # Consumed like the other auth kwargs so it never reaches the driver.
         find_client = options.delete(:client)
         # Metadata-only AS::N payload: collection, presence-of-filter
@@ -2248,7 +2282,9 @@ module Parse
       # Hits the system catalog via the driver's `indexes.list` and returns
       # the raw definitions — distinct from {.list_search_indexes}, which
       # only enumerates Atlas Search indexes. Operator-facing introspection
-      # used by `Parse::Core::Describe`.
+      # used by `Parse::Core::Describe`. Index definitions are metadata, not
+      # row data, so this stays available inside `Parse.without_master_key`
+      # (unlike {.find}, which is refused there).
       #
       # @param collection_name [String] the Parse collection / class name
       # @return [Array<Hash>] each entry includes at least `"name"` and
@@ -2303,7 +2339,12 @@ module Parse
                 "the caller is authorized. Callers without master scope (e.g. agent " \
                 "tools, request handlers) must not invoke this method."
         end
-        results = aggregate(collection_name, [{ "$indexStats" => {} }], master: true)
+        # Index metadata, not rows: keep master mode inside
+        # `Parse.without_master_key`, which only governs row access. The
+        # sentinel elevates scope resolution only; it leaves the block's
+        # fiber state alone, so notification subscribers still see it.
+        results = aggregate(collection_name, [{ "$indexStats" => {} }],
+                            master: Parse::ACLScope::METADATA_MASTER)
         results.each_with_object({}) do |row, h|
           name = row["name"] || row[:name]
           next unless name

data/lib/parse/pipeline_security.rb

@@ -983,35 +983,38 @@ module Parse
               )
             end
           end
-          # Cap caller-supplied regex pattern length. Catches the two
-          # shapes Mongo accepts: the find-form `{ field: { $regex: "..." } }`
-          # (key == "$regex", value a String), and the aggregation-form
-          # `{ $regexMatch: { input: ..., regex: "..." } }` (key ==
-          # "$regexMatch"/"$regexFind"/"$regexFindAll", value a Hash with
-          # a "regex"/"pattern" String inside). Stops a multi-KB pattern
-          # from reaching MongoDB regardless of where in the pipeline it
-          # appears.
-          if key_str == "$regex" && value.is_a?(String) && value.bytesize > MAX_REGEX_PATTERN_LENGTH
-            raise Error.new(
-              "SECURITY: $regex pattern exceeds #{MAX_REGEX_PATTERN_LENGTH} bytes " \
-              "(got #{value.bytesize}). Long caller-supplied regex patterns are a " \
-              "ReDoS vector; refuse caller-supplied regexes longer than this cap.",
-              stage: stage_idx,
-              operator: "$regex",
-              reason: :regex_pattern_too_long,
-            )
+          # Caller-supplied regex patterns. Catches the two shapes Mongo
+          # accepts: the find-form `{ field: { $regex: "..." } }` (key ==
+          # "$regex", value a String or a Regexp) and the aggregation-form
+          # `{ $regexMatch: { input: ..., regex: "...", options: "..." } }`.
+          # Each pattern goes through Parse::RegexSecurity (length cap plus
+          # the nested-quantifier and backtracking shapes), and `$options`
+          # through its flag allowlist, wherever it appears in the pipeline.
+          if key_str == "$regex"
+            check_regex_pattern!(value, operator: "$regex", stage_idx: stage_idx)
+          elsif key_str == "$options" && (node.key?("$regex") || node.key?(:$regex))
+            check_regex_options!(value, operator: "$options", stage_idx: stage_idx)
           end
           if %w[$regexMatch $regexFind $regexFindAll].include?(key_str) && value.is_a?(Hash)
             pat = value["regex"] || value[:regex] || value["pattern"] || value[:pattern]
-            if pat.is_a?(String) && pat.bytesize > MAX_REGEX_PATTERN_LENGTH
+            # The pattern must be a literal the walker can check: a String
+            # that is not a field path or variable, a Regexp, or a BSON
+            # regex. An expression object (`$literal`, `$concat`) or a
+            # `"$field"` reference would build the pattern at query time,
+            # out of reach of the check, possibly from stored data.
+            unless regex_literal_operand?(pat)
               raise Error.new(
-                "SECURITY: #{key_str} regex pattern exceeds #{MAX_REGEX_PATTERN_LENGTH} bytes " \
-                "(got #{pat.bytesize}). Refuse caller-supplied regexes longer than this cap.",
+                "SECURITY: #{key_str} 'regex' must be a literal pattern (a String that is " \
+                "not a field path or variable, a Regexp, or a BSON regex). Patterns built " \
+                "from expressions or document fields cannot be checked for ReDoS.",
                 stage: stage_idx,
                 operator: key_str,
-                reason: :regex_pattern_too_long,
+                reason: :regex_not_literal,
               )
             end
+            check_regex_pattern!(pat, operator: key_str, stage_idx: stage_idx)
+            opts = value["options"] || value[:options]
+            check_regex_options!(opts, operator: key_str, stage_idx: stage_idx) unless opts.nil?
           end
           child_inside_expr = inside_expr || key_str == "$expr"
           if child_inside_expr && FORENSIC_OPERATORS.include?(key_str)
@@ -1061,11 +1064,144 @@ module Parse
             reason: :denied_field_ref_in_expr,
           )
         end
+      when Regexp
+        # A Regexp value is a regex match in a MongoDB filter.
+        check_regex_pattern!(node, operator: "$regex", stage_idx: stage_idx)
+      else
+        if defined?(BSON::Regexp::Raw) && node.is_a?(BSON::Regexp::Raw)
+          check_regex_pattern!(node, operator: "$regex", stage_idx: stage_idx)
+          check_regex_options!(node.options, operator: "$options", stage_idx: stage_idx) if node.options.is_a?(String) && !node.options.empty?
+        end
       end
       # Other primitives (Integer, etc.) are always safe.
       nil
     end
 
     private_class_method :walk_for_denied!
+
+    # @!visibility private
+    # Run a caller-supplied regex pattern (String, Regexp, or
+    # BSON::Regexp::Raw) through Parse::RegexSecurity with this module's
+    # length cap. Non-pattern values are left to MongoDB to reject.
+    def check_regex_pattern!(pattern, operator:, stage_idx:)
+      source = if pattern.is_a?(String) then pattern
+        elsif pattern.is_a?(Regexp) then pattern.source
+        elsif defined?(BSON::Regexp::Raw) && pattern.is_a?(BSON::Regexp::Raw) then pattern.pattern.to_s
+        end
+      return if source.nil?
+      # Escaped literal text cannot backtrack, and escaping can double its
+      # length, so it gets a larger cap than an arbitrary pattern.
+      cap = Parse::RegexSecurity.literal_pattern?(source) ? (2 * MAX_REGEX_PATTERN_LENGTH) + 4 : MAX_REGEX_PATTERN_LENGTH
+      if source.bytesize > cap
+        raise Error.new(
+          "SECURITY: #{operator} regex pattern exceeds #{cap} bytes " \
+          "(got #{source.bytesize}). Long caller-supplied regex patterns are a " \
+          "ReDoS vector; refuse caller-supplied regexes longer than this cap.",
+          stage: stage_idx,
+          operator: operator,
+          reason: :regex_pattern_too_long,
+        )
+      end
+      Parse::RegexSecurity.validate!(pattern.is_a?(Regexp) ? pattern : source, max_length: MAX_REGEX_PATTERN_LENGTH)
+    rescue ArgumentError => e
+      raise Error.new(
+        "SECURITY: #{operator} #{e.message}",
+        stage: stage_idx,
+        operator: operator,
+        reason: :regex_unsafe,
+      )
+    end
+
+    private_class_method :check_regex_pattern!
+
+    # @!visibility private
+    # Whether a `$regexMatch` / `$regexFind` / `$regexFindAll` `regex`
+    # operand is a literal pattern rather than an expression.
+    def regex_literal_operand?(pattern)
+      return !pattern.start_with?("$") if pattern.is_a?(String)
+      return true if pattern.is_a?(Regexp)
+      defined?(BSON::Regexp::Raw) && pattern.is_a?(BSON::Regexp::Raw)
+    end
+
+    private_class_method :regex_literal_operand?
+
+    # @!visibility private
+    def check_regex_options!(options, operator:, stage_idx:)
+      Parse::RegexSecurity.validate_options!(options)
+    rescue ArgumentError => e
+      raise Error.new(
+        "SECURITY: #{operator} #{e.message}",
+        stage: stage_idx,
+        operator: operator,
+        reason: :regex_options_unsupported,
+      )
+    end
+
+    private_class_method :check_regex_options!
+
+    # Server-side time limit, in milliseconds, applied to a mongo-direct
+    # read whose filter or pipeline carries a regex that is not escaped
+    # literal text, when the caller gave no `max_time_ms`. The pattern
+    # checker refuses the shapes known to backtrack catastrophically; this
+    # bounds the rest. Set {default_regex_max_time_ms} to nil to disable.
+    DEFAULT_REGEX_MAX_TIME_MS = 5_000
+
+    class << self
+      # @!attribute [rw] default_regex_max_time_ms
+      #   Time limit (ms) for mongo-direct reads that carry a non-literal
+      #   regex and no explicit `max_time_ms`. Defaults to
+      #   {DEFAULT_REGEX_MAX_TIME_MS}; nil disables it.
+      #   @return [Integer, nil]
+      attr_writer :default_regex_max_time_ms
+
+      def default_regex_max_time_ms
+        defined?(@default_regex_max_time_ms) ? @default_regex_max_time_ms : DEFAULT_REGEX_MAX_TIME_MS
+      end
+
+      # The time limit to apply to a read of `node` (a filter or pipeline):
+      # {default_regex_max_time_ms} when it carries a regex that is not
+      # escaped literal text, otherwise nil.
+      # @param node [Object]
+      # @return [Integer, nil]
+      def regex_time_budget(node)
+        budget = default_regex_max_time_ms
+        return nil if budget.nil?
+        nonliteral_regex?(node, 0) ? budget : nil
+      end
+
+      private
+
+      def nonliteral_regex?(node, depth)
+        return false if depth > 64
+        case node
+        when Hash
+          node.any? do |key, value|
+            key_str = key.to_s
+            if key_str == "$regex"
+              nonliteral_pattern?(value)
+            elsif %w[$regexMatch $regexFind $regexFindAll].include?(key_str) && value.is_a?(Hash)
+              nonliteral_pattern?(value["regex"] || value[:regex]) || nonliteral_regex?(value, depth + 1)
+            else
+              nonliteral_regex?(value, depth + 1)
+            end
+          end
+        when Array
+          node.any? { |item| nonliteral_regex?(item, depth + 1) }
+        when Regexp
+          nonliteral_pattern?(node)
+        else
+          defined?(BSON::Regexp::Raw) && node.is_a?(BSON::Regexp::Raw) && nonliteral_pattern?(node)
+        end
+      end
+
+      def nonliteral_pattern?(pattern)
+        source = if pattern.is_a?(String) then pattern
+          elsif pattern.is_a?(Regexp) then pattern.source
+          elsif defined?(BSON::Regexp::Raw) && pattern.is_a?(BSON::Regexp::Raw) then pattern.pattern.to_s
+          end
+        return false if source.nil?
+        !Parse::RegexSecurity.literal_pattern?(source)
+      end
+    end
   end
 end

data/lib/parse/query/constraint.rb

@@ -151,7 +151,7 @@ module Parse
         # d = d.pointer if d.is_a?(Parse::Object) #simplified query object
         #  d = d.compile
         if d.is_a?(Parse::Query)
-          compiled = d.compile(encode: false, includeClassName: true)
+          compiled = d.compile_subquery
           # compiled["className"] = d.table
           d = compiled
         end