parse-stack-next 5.8.0 → 5.8.2

data/lib/parse/client/request.rb

@@ -41,6 +41,65 @@ module Parse
     # Used to correlate batching requests with their responses.
     attr_accessor :tag
 
+    # @!visibility private
+    # The client this request belongs to, when it was built for a specific
+    # one (an object's class client). A {Parse::BatchOperation} sends a
+    # request through this client, so a write built for a session-bound
+    # client is never batched through another client's credentials. nil
+    # means the batch's own client.
+    attr_accessor :client
+
+    # @!visibility private
+    # The credentials this request names explicitly, resolved the way
+    # {Parse::Client#request} resolves them for a single request: the
+    # `session_token:` option, else an `X-Parse-Session-Token` header; and
+    # the `use_master_key:` option; and `suppress_master_key: true` when the
+    # master-key suppression header is set. A key is absent when the request
+    # does not name it, so ambient context (`Parse.with_session`,
+    # `client_mode`, a bound client token) still applies.
+    #
+    # A `session_token:` option that is present but resolves to no token (a
+    # user object without one, or a blank string) is returned as `""`, so a
+    # batch fails closed the same way a single request does: no master key
+    # and no ambient or bound token. `use_master_key:` is returned only when
+    # it is exactly `true` or `false`; {Parse::Client#request} treats any
+    # other value as not set, and so does a batch.
+    # @return [Hash] with optional `:session_token` (String),
+    #   `:use_master_key` (Boolean), and `:suppress_master_key` (true) keys.
+    def explicit_authority
+      o = opts.is_a?(Hash) ? opts : {}
+      result = {}
+      token = Parse::BatchOperation.resolve_session_option(o, :session_token)
+      if token.nil?
+        header_token = self.class.header_value(headers, Parse::Protocol::SESSION_TOKEN)
+        if header_token.is_a?(String)
+          token = header_token.strip.empty? ? "" : header_token
+        end
+      end
+      result[:session_token] = token unless token.nil?
+      master = o[:use_master_key]
+      result[:use_master_key] = master if master == true || master == false
+      # The suppression header wins over `use_master_key: true` in the
+      # authentication middleware, so a batch must carry it as a header
+      # rather than fold it into `use_master_key:` (which would also change
+      # how the ambient and bound session tokens apply).
+      if self.class.header_value(headers, Parse::Middleware::Authentication::DISABLE_MASTER_KEY).present?
+        result[:suppress_master_key] = true
+      end
+      result
+    end
+
+    # @!visibility private
+    # Case-insensitive header lookup.
+    # @return [Object, nil]
+    def self.header_value(headers, name)
+      return nil unless headers.is_a?(Hash)
+      return headers[name] if headers.key?(name)
+      wanted = name.to_s.downcase
+      headers.each { |k, v| return v if k.to_s.downcase == wanted }
+      nil
+    end
+
     # @!attribute [rw] request_id
     #   @return [String] unique identifier for this request to enable idempotency
     attr_accessor :request_id

data/lib/parse/client/response.rb

@@ -264,19 +264,77 @@ module Parse
       self
     end
 
+    # A summary that never prints result values: login, signup, and
+    # `users/me` responses carry a live `sessionToken` (and sometimes
+    # `authData`), and any other row can carry private data, so inspect
+    # shows only the shape of the result.
     # @!visibility private
     def inspect
       if error?
-        "#<#{self.class} @code=#{code} @error='#{error}'>"
+        "#<#{self.class} @code=#{code} @error='#{safe_error_text}' @http_status=#{http_status.inspect}>"
       else
-        "#<#{self.class} @result='#{@result}'>"
+        "#<#{self.class} @http_status=#{http_status.inspect} @result=#{result_summary}>"
       end
     end
 
-    # @return [String] JSON encoded object, or an error string.
+    # @return [String] JSON encoded object, or an error string. Credential
+    #   fields (`sessionToken`, `password`, `authData`, MFA recovery codes
+    #   and secrets, keys) are replaced with a placeholder, and credential
+    #   text inside string values (`password=x`, `X-Parse-Master-Key: mk`)
+    #   is filtered too, so printing the response with `to_s` or `inspect`
+    #   does not leak a live session token. The error form has its text redacted and control characters
+    #   escaped. `#result`, `#to_json`, and `#as_json` return the raw values
+    #   by design; do not log those.
     def to_s
-      return "[E-#{@code}] #{@request} : #{@error} (#{@http_status})" if error?
-      @result.to_json
+      if error?
+        return "[E-#{@code}] #{safe_request_text} : #{safe_error_text} (#{@http_status})"
+      end
+      result = redacted_result
+      return Parse::Middleware::BodyBuilder.redact_patterns(result) if result.is_a?(String)
+      # Text patterns run on string values before encoding, never on the
+      # encoded JSON, so escaped quotes cannot defeat them or corrupt it.
+      Parse::Middleware::BodyBuilder.redact_string_values!(result).to_json
+    end
+
+    private
+
+    # Maximum error text length kept in `to_s` / `inspect`.
+    SAFE_ERROR_TEXT_LENGTH = 1_000
+
+    # The server's error text with credentials redacted, truncated, and
+    # control characters escaped, matching what the client logs.
+    def safe_error_text
+      text = Parse::Middleware::BodyBuilder.redact(@error.to_s)[0, SAFE_ERROR_TEXT_LENGTH]
+      Parse::TerminalSafe.sanitize_line(text)
+    rescue StandardError
+      "[unprintable error]"
+    end
+
+    # The request line (method and path, including any query string) with
+    # credentials redacted and control characters escaped.
+    def safe_request_text
+      Parse::TerminalSafe.sanitize_line(Parse::Middleware::BodyBuilder.redact(@request.to_s))
+    rescue StandardError
+      "[unprintable request]"
+    end
+
+    # Class and size of the result, without its values.
+    def result_summary
+      case @result
+      when Array then "Array(#{@result.size})"
+      when Hash then "Hash(#{@result.size} keys)"
+      when nil then "nil"
+      else @result.class.name
+      end
+    end
+
+    # A deep copy of the result with credential fields replaced.
+    def redacted_result
+      return @result unless @result.is_a?(Hash) || @result.is_a?(Array)
+      copy = JSON.parse(@result.to_json)
+      Parse::Middleware::BodyBuilder.scrub_sensitive!(copy)
+    rescue StandardError
+      "[unprintable result]"
     end
   end
 end

data/lib/parse/client.rb

@@ -283,6 +283,14 @@ module Parse
     DEFAULT_RETRIES = 2
     # The wait time in seconds between retries
     RETRY_DELAY = 1.5
+    # SDK-internal value for the `metadata_master:` request option. A request
+    # that passes it together with `use_master_key: true` reads metadata (a
+    # class schema, the role graph) and keeps the master key inside
+    # {Parse.without_master_key}. Only this exact object turns it on.
+    # @!visibility private
+    METADATA_MASTER_REQUEST = Object.new.tap do |o|
+      def o.inspect = "#<Parse::Client::METADATA_MASTER_REQUEST>"
+    end.freeze
 
     # An error when a general response error occurs when communicating with Parse server.
     class ResponseError < Parse::Error; end
@@ -411,6 +419,39 @@ module Parse
       "session_token=#{@session_token ? "[FILTERED]" : "nil"}>"
     end
 
+    # Redacted JSON form. ActiveSupport's default `as_json` serializes every
+    # instance variable, so a client in a JSON log or error-tracker context
+    # (or inside an object that serializes it, such as a {Parse::Agent})
+    # would emit the master key, REST key, and bound session token.
+    # @return [Hash]
+    def as_json(*)
+      {
+        "server_url" => @server_url,
+        "app_id" => @application_id,
+        "master_key" => @master_key ? "[FILTERED]" : nil,
+        "session_token" => @session_token ? "[FILTERED]" : nil,
+      }
+    end
+
+    # @return [String] the redacted {#as_json} summary as JSON.
+    def to_json(*args)
+      as_json.to_json(*args)
+    end
+
+    # YAML (Psych) serializes instance variables too; emit the redacted
+    # summary instead.
+    def encode_with(coder)
+      as_json.each { |k, v| coder[k] = v }
+    end
+
+    # A client holds the master key, REST key, and session tokens, so it is
+    # never marshaled (Rails.cache, DRb, or a job payload would store them in
+    # the clear). Store the configuration and build a new client instead.
+    # @raise [TypeError]
+    def marshal_dump
+      raise TypeError, "Parse::Client cannot be marshaled"
+    end
+
     # A NEW non-master {Parse::Client} that mirrors THIS client's connection
     # settings (`server_url` / `application_id` / `api_key`) but carries no
     # master key and binds `session_token`, so it acts on the server as that
@@ -637,6 +678,12 @@ module Parse
     #    middleware. The default value is 3 seconds. If :expires is set to 0,
     #    caching will be disabled. You can always clear the current state of the
     #    cache using the clear_cache! method on your Parse::Client instance.
+    # @option opts [Boolean] :cache_session_requests Whether this client's
+    #    response cache stores and serves reads made with a session token.
+    #    Overrides {Parse::Middleware::Caching.cache_session_requests} in
+    #    either direction; omit it to use that class default (off). Only
+    #    `true` enables it. With it on, a revoked session keeps reading its
+    #    cached rows until the entry expires.
     # @option opts [String] :cache_namespace Optional prefix applied to every
     #    cache key. Useful when two Parse apps share one Redis instance and
     #    would otherwise collide on identical paths (e.g.
@@ -696,7 +743,9 @@ module Parse
       @allow_faraday_proxy = opts.fetch(:allow_faraday_proxy, false)
 
       # Security check for HTTP usage (except localhost/127.0.0.1 for development)
-      if @server_url&.start_with?("http://") && !@server_url.match?(%r{^http://(localhost|127\.0\.0\.1)(:|/)})
+      # The scheme and host come from URI parsing, so `HTTP://` and leading
+      # whitespace are treated as plain http, not as a secure URL.
+      if self.class.url_scheme(@server_url) == "http" && !self.class.loopback_host?(self.class.url_host(@server_url))
         if @require_https
           raise ArgumentError, "[Parse::Client] HTTPS required but server URL uses HTTP: #{@server_url}. " \
                                "Set require_https: false or use an HTTPS URL."
@@ -757,7 +806,7 @@ module Parse
       # scheme; without this guard a caller passing
       #   faraday: { ssl: { verify: false }, proxy: "http://attacker" }
       # would neuter TLS verification on an HTTPS connection.
-      validate_faraday_opts!(opts[:faraday])
+      opts[:faraday] = validate_faraday_opts!(opts[:faraday])
       opts[:faraday].merge!(:url => @server_url)
       @conn = Faraday.new(opts[:faraday]) do |conn|
         # Apply timeouts before any user-supplied middleware sees a request.
@@ -929,6 +978,10 @@ module Parse
               # old workers still read the legacy shape, so invalidation has to
               # hit both until every old worker is drained.
               delete_legacy_variants: opts.fetch(:cache_delete_legacy_variants, true),
+              # Per-client override of
+              # Parse::Middleware::Caching.cache_session_requests; omitted
+              # means the class default applies.
+              **(opts.key?(:cache_session_requests) ? { cache_session_requests: opts[:cache_session_requests] } : {}),
             }
 
             # Inform about opt-in cache behavior
@@ -978,19 +1031,27 @@ module Parse
     #   controlled MITM unless explicitly allowlisted
     #
     # @api private
+    # @return [Hash] the options as a Hash, so a `Faraday::ConnectionOptions`
+    #   (or anything else responding to `to_hash`) is checked and used in the
+    #   same form; any other value raises.
     def validate_faraday_opts!(faraday_opts)
-      return unless faraday_opts.is_a?(Hash)
-
-      ssl = faraday_opts[:ssl] || faraday_opts["ssl"]
-      if ssl.is_a?(Hash)
-        verify = ssl.key?(:verify) ? ssl[:verify] : ssl["verify"]
-        if verify == false && @server_url.to_s.start_with?("https://")
+      faraday_opts = {} if faraday_opts.nil?
+      unless faraday_opts.is_a?(Hash)
+        unless faraday_opts.respond_to?(:to_hash)
           raise ArgumentError,
-            "[Parse::Client] Refusing to disable TLS certificate verification " \
-            "(opts[:faraday][:ssl][:verify] = false) on an HTTPS server URL. " \
-            "Fix the server certificate or downgrade the URL to http:// " \
-            "(with require_https: false) for explicit local testing."
+                "[Parse::Client] opts[:faraday] must be a Hash or Faraday::ConnectionOptions " \
+                "(got #{faraday_opts.class})."
         end
+        faraday_opts = faraday_opts.to_hash
+      end
+
+      ssl = faraday_opts[:ssl] || faraday_opts["ssl"]
+      if self.class.url_scheme(@server_url) == "https" && (setting = tls_verification_disabled(ssl))
+        raise ArgumentError,
+          "[Parse::Client] Refusing to disable TLS certificate verification " \
+          "(opts[:faraday][:ssl] #{setting}) on an HTTPS server URL. " \
+          "Fix the server certificate or downgrade the URL to http:// " \
+          "(with require_https: false) for explicit local testing."
       end
 
       proxy = faraday_opts[:proxy] || faraday_opts["proxy"]
@@ -1010,15 +1071,82 @@ module Parse
       # `proxy: nil` is the Faraday-documented way to disable
       # env-proxy autodiscovery.
       faraday_opts[:proxy] = nil unless @allow_faraday_proxy
+      faraday_opts
     end
 
     private :validate_faraday_opts!
 
-    # Hosts considered "loopback" for the cleartext-ws:// guard in
-    # {#configure_live_query}. Mirrors
-    # {Parse::LiveQuery::Client::LOOPBACK_HOSTS} so the explicit-URL
-    # path and the derived-URL path agree on what counts as local.
-    LIVE_QUERY_LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1 [::1] 0.0.0.0].freeze
+    # Which TLS setting in a Faraday `ssl:` option (a Hash or a
+    # `Faraday::SSLOptions`) turns certificate or hostname verification off,
+    # or nil when none does: `verify: false`, `verify_mode: VERIFY_NONE`, or
+    # `verify_hostname: false`.
+    # @api private
+    def tls_verification_disabled(ssl)
+      read = lambda do |key|
+        if ssl.is_a?(Hash)
+          ssl.key?(key) ? ssl[key] : ssl[key.to_s]
+        elsif ssl.respond_to?(key)
+          ssl.public_send(key)
+        end
+      end
+      return nil if ssl.nil?
+      return "verify: false" if read.call(:verify) == false
+      if defined?(OpenSSL::SSL::VERIFY_NONE) && read.call(:verify_mode) == OpenSSL::SSL::VERIFY_NONE
+        return "verify_mode: VERIFY_NONE"
+      end
+      return "verify_hostname: false" if read.call(:verify_hostname) == false
+      nil
+    end
+    private :tls_verification_disabled
+
+    # Whether a URL host is this machine: `localhost`, any `127.0.0.0/8`
+    # address, `::1`, or `0.0.0.0` (a connect to the unspecified address
+    # reaches the local host on Linux and macOS). Used by the http:// server
+    # warning and the LiveQuery cleartext guards so they agree.
+    # @param host [String, nil]
+    # @return [Boolean]
+    # @api private
+    #
+    # Addresses are parsed with IPAddr, so a malformed one such as
+    # `127.999.1.1` (which a resolver would look up by name) is not loopback.
+    # `localhost.` with a trailing dot is not either: some resolvers skip
+    # `/etc/hosts` for the fully qualified form. `0.0.0.0` stays local for
+    # client URLs only (it is a bind address everywhere else).
+    def self.loopback_host?(host)
+      h = host.to_s.strip.downcase.delete_prefix("[").delete_suffix("]")
+      return false if h.empty?
+      return true if h == "localhost" || h == "0.0.0.0"
+      return false unless h.match?(/\A[0-9a-f:.]+\z/)
+      require "ipaddr"
+      IPAddr.new(h).loopback?
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      false
+    end
+
+    # The lowercased scheme of a URL String, or nil when it does not parse.
+    # Leading and trailing whitespace is ignored. Scheme checks go through
+    # this instead of a case-sensitive prefix match, which let `HTTP://` and
+    # `WS://` past the plaintext guards.
+    # @param url [String, nil]
+    # @return [String, nil]
+    # @api private
+    def self.url_scheme(url)
+      return nil if url.nil?
+      URI.parse(url.to_s.strip).scheme&.downcase
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # The lowercased host of a URL String, or nil when it does not parse.
+    # @param url [String, nil]
+    # @return [String, nil]
+    # @api private
+    def self.url_host(url)
+      return nil if url.nil?
+      URI.parse(url.to_s.strip).host&.downcase
+    rescue URI::InvalidURIError
+      nil
+    end
 
     # Configure LiveQuery with the given options
     # @param opts [Hash] configuration options
@@ -1041,7 +1169,7 @@ module Parse
       # `live_query: { url: "ws://prod-host" }` or
       # `live_query_url: "ws://prod-host"` bypassed it — the master key
       # and any session token would ride the connect frame in cleartext.
-      validate_live_query_url!(resolved_url, allow_insecure: live_query_opts[:allow_insecure])
+      resolved_url = validate_live_query_url!(resolved_url, allow_insecure: live_query_opts[:allow_insecure])
 
       # Warn (don't raise) on `live_query: { ... }` keys that are not
       # `Parse::LiveQuery::Configuration` setters. The block form would
@@ -1071,20 +1199,14 @@ module Parse
       end
     end
 
+    # Validate an explicit LiveQuery URL at configure time with the same
+    # rules {Parse::LiveQuery::Client} applies, and return the URL to use
+    # (`http://` and `https://` are mapped to `ws://` and `wss://`).
+    # @return [String, nil]
     # @api private
     def validate_live_query_url!(url, allow_insecure:)
-      return unless url.is_a?(String) && url.start_with?("ws://")
-
-      host = URI.parse(url).host.to_s rescue ""
-      return if LIVE_QUERY_LOOPBACK_HOSTS.include?(host)
-      return if allow_insecure
-
-      raise ArgumentError,
-        "[Parse::Client] Refusing explicit insecure LiveQuery URL #{url.inspect}. " \
-        "The connect frame carries the master key and any session token in " \
-        "plaintext on this socket. Use wss:// for routable hosts, or pass " \
-        "`live_query: { allow_insecure: true }` to opt into cleartext for " \
-        "local development on a non-loopback address."
+      return url unless url.is_a?(String)
+      Parse::LiveQuery::Client.normalize_url(url, allow_insecure: allow_insecure)
     end
 
     # @api private
@@ -1319,7 +1441,10 @@ module Parse
           body ||= _request.body
           headers.merge! _request.headers
         else
-          _request = Parse::Request.new(method, uri, body: body, headers: headers, opts: opts)
+          # The metadata-master sentinel stays off the stored request: a
+          # caller replaying `response.request` later must not inherit it.
+          _request = Parse::Request.new(method, uri, body: body, headers: headers,
+                                                     opts: opts.except(:metadata_master))
           # Request copies the headers it is given, so carry its request id
           # back onto the outgoing headers.
           headers.merge!(_request.headers)
@@ -1348,6 +1473,14 @@ module Parse
         #      never sent unless the caller explicitly passed `use_master_key: true`
         explicit_master = opts.key?(:use_master_key)
 
+        # SDK metadata reads (class schemas, the role graph) keep the master
+        # key inside `Parse.without_master_key`. Only the internal sentinel
+        # turns this on; a `true` or any other value from a caller does not.
+        # The marker goes on a per-attempt copy of the headers handed to the
+        # connection (below), never on `headers` or the stored request, so a
+        # retry, `response.request`, or an error reporter never carries it.
+        metadata_master = opts[:metadata_master].equal?(METADATA_MASTER_REQUEST) && opts[:use_master_key] == true
+
         if opts[:use_master_key] == false
           headers[Parse::Middleware::Authentication::DISABLE_MASTER_KEY] = "true"
         elsif Parse.client_mode && opts[:use_master_key] != true
@@ -1364,7 +1497,9 @@ module Parse
         # `with_session(token_b)` resolved user B, and the identity cache
         # then mapped token A (or a garbage token) to user B for its TTL.
         if raw_token.nil?
-          header_token = headers[Parse::Protocol::SESSION_TOKEN]
+          # Same lookup a batch uses for each request's own credentials
+          # (Parse::Request#explicit_authority).
+          header_token = Parse::Request.header_value(headers, Parse::Protocol::SESSION_TOKEN)
           raw_token = header_token if header_token.is_a?(String)
         end
         # SEC-02:an EXPLICITLY-supplied session_token that is a blank /
@@ -1417,7 +1552,12 @@ module Parse
         params = (method == :get ? query : body) || {}
         # if the path does not start with the '/1/' prefix, then add it to be nice.
         # actually send the request and return the body
-        response_env = @conn.send(method, uri, params, headers)
+        send_headers = headers
+        if metadata_master
+          send_headers = headers.merge(Parse::Middleware::Authentication::METADATA_MASTER =>
+                                         Parse::Middleware::Authentication::METADATA_MASTER_TOKEN)
+        end
+        response_env = @conn.send(method, uri, params, send_headers)
         response = response_env.body
         response.request = _request
 

data/lib/parse/clp_scope.rb

@@ -86,7 +86,14 @@ module Parse
     # at request rate.
     NEGATIVE_TTL = 5
 
+    # How long a schema fetch that failed inside `Parse.without_master_key`
+    # is remembered. Kept apart from the shared cache and consulted only
+    # inside the block, so it never denies another caller's reads; it only
+    # stops a down server from being refetched on every read in the block.
+    SUPPRESSED_NEGATIVE_TTL = 2
+
     @cache = {}
+    @suppressed_failures = {}
     @cache_mutex = Mutex.new
     @cache_ttl = POSITIVE_TTL
 
@@ -490,7 +497,10 @@ module Parse
       end
 
       def reset_cache!
-        @cache_mutex.synchronize { @cache.clear }
+        @cache_mutex.synchronize do
+          @cache.clear
+          @suppressed_failures.clear
+        end
         # Also drop the unresolvable-class warned-once registry so
         # tests that assert on `warn` emission for a class don't get
         # silenced by an earlier test's call.
@@ -599,6 +609,12 @@ module Parse
         cached = @cache_mutex.synchronize { @cache[key] }
         return cached if cached && !stale?(cached)
 
+        suppressed = Parse.respond_to?(:master_key_disabled?) && Parse.master_key_disabled?
+        if suppressed
+          failed_at = @cache_mutex.synchronize { @suppressed_failures[key] }
+          return unresolvable_entry if failed_at && monotonic_now - failed_at < SUPPRESSED_NEGATIVE_TTL
+        end
+
         entry = if resolved_client.nil?
             # No client configured (Parse.setup never called, etc.) —
             # treat as unresolvable so we fail closed instead of
@@ -620,7 +636,17 @@ module Parse
             end
           end
 
-        @cache_mutex.synchronize { @cache[key] = entry }
+        # A failure inside `Parse.without_master_key` is not put in the
+        # shared cache. The request keeps the master key there, but a custom
+        # schema source may not, and a negative entry is shared by every
+        # caller of this class for {NEGATIVE_TTL}: one block must not deny
+        # every other request's scoped reads. It is remembered briefly in a
+        # separate table read only inside the block.
+        if entry.kind == :unresolvable && suppressed
+          @cache_mutex.synchronize { @suppressed_failures[key] = monotonic_now }
+        else
+          @cache_mutex.synchronize { @cache[key] = entry }
+        end
         entry
       end
 
@@ -637,6 +663,13 @@ module Parse
       # and the client-bound session token. A client that holds no master key
       # still cannot read schemas, which stays fail-closed.
       #
+      # The schema is metadata, so the request also carries the SDK's
+      # metadata marker: it keeps the master key inside
+      # `Parse.without_master_key`, which strips it from every other request
+      # in the block. Without it the fetch was refused there and the
+      # `:unresolvable` entry denied every scoped read of the class, for all
+      # callers, until it expired.
+      #
       # Objects that only implement `#schema` (test doubles, custom schema
       # sources installed via {.schema_client}), and clients whose `#schema`
       # was overridden on the instance, keep the old call.
@@ -649,7 +682,8 @@ module Parse
         if resolved_client.is_a?(Parse::Client) && stock_schema
           safe = Parse::API::PathSegment.identifier!(class_key, kind: "class name")
           resolved_client.request(:get, "schemas/#{safe}",
-                                  opts: { cache: false, use_master_key: true })
+                                  opts: { cache: false, use_master_key: true,
+                                          metadata_master: Parse::Client::METADATA_MASTER_REQUEST })
         else
           resolved_client.schema(class_key)
         end