parse-stack-next 5.8.1 → 5.8.2

data/lib/parse/model/file.rb

@@ -202,7 +202,10 @@ module Parse
       #   Integrators with a CDN in front of Parse files add their CDN host:
       #   `Parse::File.trusted_url_hosts << "cdn.example.com"`. Wildcard
       #   entries via leading "." (e.g. `".cdn.example.com"`) match any
-      #   subdomain.
+      #   subdomain. Entries are compared against the URL's host as written,
+      #   so list internationalized hosts in their punycode (`xn--`) form.
+      #   The port is not part of the match: any port on a trusted host is
+      #   accepted.
       attr_writer :trusted_url_hosts
 
       def trusted_url_hosts
@@ -253,6 +256,20 @@ module Parse
         @untrusted_url_policy ||= :warn
       end
 
+      # @return [Boolean] whether a URL whose file name starts with `tfss-`
+      #   (the legacy Parse hosted-files prefix) is accepted from any host.
+      #   Defaults to `true`, the long-standing contract for apps that serve
+      #   migrated legacy files from their own bucket. The file name alone
+      #   proves nothing about the host, so a writer who can store a File
+      #   value named `tfss-...` can point it anywhere. Set this to `false`
+      #   to require `tfss-` URLs to come from {trusted_url_hosts} like any
+      #   other URL (`files.parsetfss.com` is trusted by default).
+      attr_writer :trust_legacy_tfss_on_any_host
+
+      def trust_legacy_tfss_on_any_host
+        @trust_legacy_tfss_on_any_host.nil? ? true : @trust_legacy_tfss_on_any_host
+      end
+
       # @return [Array<Integer>] Allowed remote ports for URL fetches.
       attr_writer :allowed_remote_ports
 
@@ -776,8 +793,8 @@ module Parse
     # set to true, it will make sure it returns a secure url.
     # @return [String] the url string for the file.
     def url
-      if @url.present? && Parse::File.force_ssl && @url.starts_with?("http://")
-        return @url.sub("http://", "https://")
+      if @url.present? && Parse::File.force_ssl && Parse::Client.url_scheme(@url) == "http"
+        return @url.strip.sub(/\Ahttp:/i, "https:")
       end
       @url
     end
@@ -958,28 +975,63 @@ module Parse
     # - raises {UntrustedHostError} when policy is `:raise`.
     #
     # On `:warn`, the URL is accepted but a single warning per host is
-    # emitted (deduplicated process-wide). Empty / non-string / non-http
-    # values pass through unchanged so callers can clear the field.
+    # emitted (deduplicated process-wide). Empty / non-string values and
+    # relative paths (no scheme) pass through unchanged so callers can
+    # clear the field. Any other scheme (`javascript:`, `data:`, ...) and a
+    # scheme-relative value (`//host`, `\\host`) are checked like an
+    # untrusted host.
+    #
+    # The value is first normalized the way a browser parses it (ASCII tab,
+    # CR, and LF removed anywhere; leading and trailing C0 controls and
+    # spaces stripped). The scheme is then matched case-insensitively,
+    # because browsers resolve `HTTPS://host`, ` https://host`,
+    # `https:host`, `https:\\host`, and `https:///host` to the same
+    # remote host. An http(s) value that is not a well-formed
+    # `scheme://host` URL, does not parse, or has no host is treated as an
+    # untrusted host rather than passed through.
     def self.sanitize_hydrated_url(raw, fallback: nil, name: nil)
       return raw if raw.nil?
       return raw unless raw.is_a?(String) && !raw.empty?
-      return raw unless raw.start_with?("http://") || raw.start_with?("https://")
-
-      uri = begin
-          URI.parse(raw)
-        rescue URI::InvalidURIError
-          return raw  # malformed URL — leave it alone; downstream code already handles
-        end
-      host = uri.host.to_s.downcase
-      return raw if host.empty?
+      candidate = browser_normalized_url(raw)
+      return raw if candidate.empty?
+
+      host = nil
+      if candidate.match?(SCHEME_RELATIVE_PREFIX)
+        # `//host`, `\\host`, `/\host`, and `\/host` are scheme-relative:
+        # browsers resolve them to `host` on the page's scheme.
+        candidate = "https:" + candidate.sub(SCHEME_RELATIVE_PREFIX, "//")
+      elsif !candidate.match?(HTTP_SCHEME_PREFIX)
+        # A relative path ("a.png", "/files/a.png") passes through. Any
+        # other scheme (javascript:, data:, vbscript:, file:, ...) is not a
+        # file URL and is treated as untrusted.
+        return raw unless candidate.match?(URL_SCHEME_PREFIX)
+        return apply_untrusted_url_policy(raw, fallback, "(#{candidate[URL_SCHEME_PREFIX].downcase} URL)")
+      end
 
-      # tfss-prefixed filenames can be served from arbitrary hosts (the
-      # legacy hosted-files contract). Accept those regardless of host.
-      basename = name || File.basename(raw)
-      return raw if basename.to_s.start_with?("tfss-")
+      if candidate.match?(WELL_FORMED_HTTP_URL)
+        host = begin
+            URI.parse(candidate).host.to_s.downcase
+          rescue URI::InvalidURIError
+            nil
+          end
+        host = nil if host && host.empty?
+      end
 
-      return raw if trusted_url_host?(host)
+      if host
+        return raw if trusted_url_host?(host)
+        # tfss-prefixed filenames can be served from arbitrary hosts (the
+        # legacy hosted-files contract) unless the app turned that off.
+        if trust_legacy_tfss_on_any_host
+          basename = name || File.basename(candidate)
+          return raw if basename.to_s.start_with?("tfss-")
+        end
+      end
+      apply_untrusted_url_policy(raw, fallback, host || "(malformed URL)")
+    end
 
+    # Apply {untrusted_url_policy} to a refused URL.
+    # @!visibility private
+    def self.apply_untrusted_url_policy(raw, fallback, host)
       case untrusted_url_policy
       when :raise
         raise UntrustedHostError,
@@ -994,6 +1046,31 @@ module Parse
       end
     end
 
+    # An http or https scheme, any case, at the start of a stripped value.
+    # @!visibility private
+    HTTP_SCHEME_PREFIX = /\Ahttps?:/i
+
+    # Any URL scheme (RFC 3986 `scheme ":"`) at the start of a value.
+    # @!visibility private
+    URL_SCHEME_PREFIX = /\A[a-z][a-z0-9+.\-]*:/i
+
+    # Two leading slashes or backslashes in any mix: a scheme-relative URL.
+    # @!visibility private
+    SCHEME_RELATIVE_PREFIX = %r{\A[/\\][/\\]}
+
+    # The value a browser would parse: ASCII tab, CR, and LF removed
+    # anywhere, then leading and trailing C0 controls and spaces stripped
+    # (WHATWG URL parsing).
+    # @!visibility private
+    def self.browser_normalized_url(value)
+      value.delete("\t\r\n").sub(/\A[\x00-\x20]+/, "").sub(/[\x00-\x20]+\z/, "")
+    end
+
+    # `http://` or `https://` (any case) followed by a host character, so
+    # `https:host`, `https:\\host`, and `https:///host` do not match.
+    # @!visibility private
+    WELL_FORMED_HTTP_URL = %r{\Ahttps?://[^/\\\s]}i
+
     # @!visibility private
     def self.trusted_url_host?(host)
       trusted_url_hosts.any? do |entry|

data/lib/parse/mongodb.rb

@@ -595,6 +595,12 @@ module Parse
       end
 
       # Get a MongoDB collection
+      #
+      # This is raw driver access: reads and writes through the returned
+      # collection apply no ACL, CLP, or protectedFields scope, and it is not
+      # refused inside {Parse.without_master_key}. Use the scoped readers
+      # ({.aggregate}, `results_direct`) for anything a caller's identity
+      # should limit.
       # @param name [String] the collection name
       # @return [Mongo::Collection]
       def collection(name, authorizing_client: nil)
@@ -1759,6 +1765,9 @@ module Parse
         # `scope` are seeded nil so subscribers see a stable key set
         # even on the raise path (where the block exits before either
         # is written).
+        # A caller regex that is not escaped literal text gets a default
+        # server-side time limit when none was given.
+        max_time_ms ||= Parse::PipelineSecurity.regex_time_budget(pipeline)
         instrument_payload = {
           collection: collection_name,
           stage_count: pipeline.is_a?(Array) ? pipeline.size : 0,
@@ -2181,7 +2190,19 @@ module Parse
       #   $where, $function, or $accumulator at any depth.
       # @raise [Parse::MongoDB::ExecutionTimeout] if the query exceeds max_time_ms
       def find(collection_name, filter = {}, **options)
+        if Parse::ACLScope.master_key_suppressed?
+          # `find` reads raw documents with no ACL scope, which is master
+          # authority. Inside `Parse.without_master_key` that is refused
+          # rather than silently running unscoped.
+          raise Parse::ACLScope::ACLRequired,
+                "Parse::MongoDB.find runs unscoped (master authority) and is refused " \
+                "inside Parse.without_master_key. Use a scoped read (Parse::MongoDB.aggregate " \
+                "with session_token:, or Parse::Query#results_direct), or run the call inside " \
+                "Parse.with_master_key."
+        end
         max_time_ms = options.delete(:max_time_ms)
+        # A regex that is not escaped literal text gets a default time limit.
+        max_time_ms ||= Parse::PipelineSecurity.regex_time_budget(filter)
         # Consumed like the other auth kwargs so it never reaches the driver.
         find_client = options.delete(:client)
         # Metadata-only AS::N payload: collection, presence-of-filter
@@ -2261,7 +2282,9 @@ module Parse
       # Hits the system catalog via the driver's `indexes.list` and returns
       # the raw definitions — distinct from {.list_search_indexes}, which
       # only enumerates Atlas Search indexes. Operator-facing introspection
-      # used by `Parse::Core::Describe`.
+      # used by `Parse::Core::Describe`. Index definitions are metadata, not
+      # row data, so this stays available inside `Parse.without_master_key`
+      # (unlike {.find}, which is refused there).
       #
       # @param collection_name [String] the Parse collection / class name
       # @return [Array<Hash>] each entry includes at least `"name"` and

data/lib/parse/pipeline_security.rb

@@ -983,35 +983,38 @@ module Parse
               )
             end
           end
-          # Cap caller-supplied regex pattern length. Catches the two
-          # shapes Mongo accepts: the find-form `{ field: { $regex: "..." } }`
-          # (key == "$regex", value a String), and the aggregation-form
-          # `{ $regexMatch: { input: ..., regex: "..." } }` (key ==
-          # "$regexMatch"/"$regexFind"/"$regexFindAll", value a Hash with
-          # a "regex"/"pattern" String inside). Stops a multi-KB pattern
-          # from reaching MongoDB regardless of where in the pipeline it
-          # appears.
-          if key_str == "$regex" && value.is_a?(String) && value.bytesize > MAX_REGEX_PATTERN_LENGTH
-            raise Error.new(
-              "SECURITY: $regex pattern exceeds #{MAX_REGEX_PATTERN_LENGTH} bytes " \
-              "(got #{value.bytesize}). Long caller-supplied regex patterns are a " \
-              "ReDoS vector; refuse caller-supplied regexes longer than this cap.",
-              stage: stage_idx,
-              operator: "$regex",
-              reason: :regex_pattern_too_long,
-            )
+          # Caller-supplied regex patterns. Catches the two shapes Mongo
+          # accepts: the find-form `{ field: { $regex: "..." } }` (key ==
+          # "$regex", value a String or a Regexp) and the aggregation-form
+          # `{ $regexMatch: { input: ..., regex: "...", options: "..." } }`.
+          # Each pattern goes through Parse::RegexSecurity (length cap plus
+          # the nested-quantifier and backtracking shapes), and `$options`
+          # through its flag allowlist, wherever it appears in the pipeline.
+          if key_str == "$regex"
+            check_regex_pattern!(value, operator: "$regex", stage_idx: stage_idx)
+          elsif key_str == "$options" && (node.key?("$regex") || node.key?(:$regex))
+            check_regex_options!(value, operator: "$options", stage_idx: stage_idx)
           end
           if %w[$regexMatch $regexFind $regexFindAll].include?(key_str) && value.is_a?(Hash)
             pat = value["regex"] || value[:regex] || value["pattern"] || value[:pattern]
-            if pat.is_a?(String) && pat.bytesize > MAX_REGEX_PATTERN_LENGTH
+            # The pattern must be a literal the walker can check: a String
+            # that is not a field path or variable, a Regexp, or a BSON
+            # regex. An expression object (`$literal`, `$concat`) or a
+            # `"$field"` reference would build the pattern at query time,
+            # out of reach of the check, possibly from stored data.
+            unless regex_literal_operand?(pat)
               raise Error.new(
-                "SECURITY: #{key_str} regex pattern exceeds #{MAX_REGEX_PATTERN_LENGTH} bytes " \
-                "(got #{pat.bytesize}). Refuse caller-supplied regexes longer than this cap.",
+                "SECURITY: #{key_str} 'regex' must be a literal pattern (a String that is " \
+                "not a field path or variable, a Regexp, or a BSON regex). Patterns built " \
+                "from expressions or document fields cannot be checked for ReDoS.",
                 stage: stage_idx,
                 operator: key_str,
-                reason: :regex_pattern_too_long,
+                reason: :regex_not_literal,
               )
             end
+            check_regex_pattern!(pat, operator: key_str, stage_idx: stage_idx)
+            opts = value["options"] || value[:options]
+            check_regex_options!(opts, operator: key_str, stage_idx: stage_idx) unless opts.nil?
           end
           child_inside_expr = inside_expr || key_str == "$expr"
           if child_inside_expr && FORENSIC_OPERATORS.include?(key_str)
@@ -1061,11 +1064,144 @@ module Parse
             reason: :denied_field_ref_in_expr,
           )
         end
+      when Regexp
+        # A Regexp value is a regex match in a MongoDB filter.
+        check_regex_pattern!(node, operator: "$regex", stage_idx: stage_idx)
+      else
+        if defined?(BSON::Regexp::Raw) && node.is_a?(BSON::Regexp::Raw)
+          check_regex_pattern!(node, operator: "$regex", stage_idx: stage_idx)
+          check_regex_options!(node.options, operator: "$options", stage_idx: stage_idx) if node.options.is_a?(String) && !node.options.empty?
+        end
       end
       # Other primitives (Integer, etc.) are always safe.
       nil
     end
 
     private_class_method :walk_for_denied!
+
+    # @!visibility private
+    # Run a caller-supplied regex pattern (String, Regexp, or
+    # BSON::Regexp::Raw) through Parse::RegexSecurity with this module's
+    # length cap. Non-pattern values are left to MongoDB to reject.
+    def check_regex_pattern!(pattern, operator:, stage_idx:)
+      source = if pattern.is_a?(String) then pattern
+        elsif pattern.is_a?(Regexp) then pattern.source
+        elsif defined?(BSON::Regexp::Raw) && pattern.is_a?(BSON::Regexp::Raw) then pattern.pattern.to_s
+        end
+      return if source.nil?
+      # Escaped literal text cannot backtrack, and escaping can double its
+      # length, so it gets a larger cap than an arbitrary pattern.
+      cap = Parse::RegexSecurity.literal_pattern?(source) ? (2 * MAX_REGEX_PATTERN_LENGTH) + 4 : MAX_REGEX_PATTERN_LENGTH
+      if source.bytesize > cap
+        raise Error.new(
+          "SECURITY: #{operator} regex pattern exceeds #{cap} bytes " \
+          "(got #{source.bytesize}). Long caller-supplied regex patterns are a " \
+          "ReDoS vector; refuse caller-supplied regexes longer than this cap.",
+          stage: stage_idx,
+          operator: operator,
+          reason: :regex_pattern_too_long,
+        )
+      end
+      Parse::RegexSecurity.validate!(pattern.is_a?(Regexp) ? pattern : source, max_length: MAX_REGEX_PATTERN_LENGTH)
+    rescue ArgumentError => e
+      raise Error.new(
+        "SECURITY: #{operator} #{e.message}",
+        stage: stage_idx,
+        operator: operator,
+        reason: :regex_unsafe,
+      )
+    end
+
+    private_class_method :check_regex_pattern!
+
+    # @!visibility private
+    # Whether a `$regexMatch` / `$regexFind` / `$regexFindAll` `regex`
+    # operand is a literal pattern rather than an expression.
+    def regex_literal_operand?(pattern)
+      return !pattern.start_with?("$") if pattern.is_a?(String)
+      return true if pattern.is_a?(Regexp)
+      defined?(BSON::Regexp::Raw) && pattern.is_a?(BSON::Regexp::Raw)
+    end
+
+    private_class_method :regex_literal_operand?
+
+    # @!visibility private
+    def check_regex_options!(options, operator:, stage_idx:)
+      Parse::RegexSecurity.validate_options!(options)
+    rescue ArgumentError => e
+      raise Error.new(
+        "SECURITY: #{operator} #{e.message}",
+        stage: stage_idx,
+        operator: operator,
+        reason: :regex_options_unsupported,
+      )
+    end
+
+    private_class_method :check_regex_options!
+
+    # Server-side time limit, in milliseconds, applied to a mongo-direct
+    # read whose filter or pipeline carries a regex that is not escaped
+    # literal text, when the caller gave no `max_time_ms`. The pattern
+    # checker refuses the shapes known to backtrack catastrophically; this
+    # bounds the rest. Set {default_regex_max_time_ms} to nil to disable.
+    DEFAULT_REGEX_MAX_TIME_MS = 5_000
+
+    class << self
+      # @!attribute [rw] default_regex_max_time_ms
+      #   Time limit (ms) for mongo-direct reads that carry a non-literal
+      #   regex and no explicit `max_time_ms`. Defaults to
+      #   {DEFAULT_REGEX_MAX_TIME_MS}; nil disables it.
+      #   @return [Integer, nil]
+      attr_writer :default_regex_max_time_ms
+
+      def default_regex_max_time_ms
+        defined?(@default_regex_max_time_ms) ? @default_regex_max_time_ms : DEFAULT_REGEX_MAX_TIME_MS
+      end
+
+      # The time limit to apply to a read of `node` (a filter or pipeline):
+      # {default_regex_max_time_ms} when it carries a regex that is not
+      # escaped literal text, otherwise nil.
+      # @param node [Object]
+      # @return [Integer, nil]
+      def regex_time_budget(node)
+        budget = default_regex_max_time_ms
+        return nil if budget.nil?
+        nonliteral_regex?(node, 0) ? budget : nil
+      end
+
+      private
+
+      def nonliteral_regex?(node, depth)
+        return false if depth > 64
+        case node
+        when Hash
+          node.any? do |key, value|
+            key_str = key.to_s
+            if key_str == "$regex"
+              nonliteral_pattern?(value)
+            elsif %w[$regexMatch $regexFind $regexFindAll].include?(key_str) && value.is_a?(Hash)
+              nonliteral_pattern?(value["regex"] || value[:regex]) || nonliteral_regex?(value, depth + 1)
+            else
+              nonliteral_regex?(value, depth + 1)
+            end
+          end
+        when Array
+          node.any? { |item| nonliteral_regex?(item, depth + 1) }
+        when Regexp
+          nonliteral_pattern?(node)
+        else
+          defined?(BSON::Regexp::Raw) && node.is_a?(BSON::Regexp::Raw) && nonliteral_pattern?(node)
+        end
+      end
+
+      def nonliteral_pattern?(pattern)
+        source = if pattern.is_a?(String) then pattern
+          elsif pattern.is_a?(Regexp) then pattern.source
+          elsif defined?(BSON::Regexp::Raw) && pattern.is_a?(BSON::Regexp::Raw) then pattern.pattern.to_s
+          end
+        return false if source.nil?
+        !Parse::RegexSecurity.literal_pattern?(source)
+      end
+    end
   end
 end