parse-stack-next 5.8.1 → 5.8.2

data/lib/parse/query.rb

@@ -638,11 +638,16 @@ module Parse
       #
       # Identical constraints collapse to one.
       def constraint_reduce(clauses)
-        clauses.reduce({}) do |clause, subclause|
+        reduced = clauses.reduce({}) do |clause, subclause|
           subclause_json = subclause.as_json || {}
           subclause_json.each { |key, value| merge_constraint_entry!(clause, key, value) }
           clause
         end
+        # A raw `{ "$regex" => ... }` in a where hash (or under `$not`,
+        # `$elemMatch`, or an OR branch) never passes through the regex
+        # constraint's own check, so every compiled pattern is checked here.
+        Parse::RegexSecurity.validate_where!(reduced)
+        reduced
       end
 
       # Operators whose meaning depends on a partner operator in the same
@@ -2522,10 +2527,9 @@ module Parse
         opts.delete(:session_token)
         opts[:metadata_master] = Parse::Client::METADATA_MASTER_REQUEST
       end
-      # for now, don't cache requests where we disable master_key or provide session token
-      # if opts[:use_master_key] == false || opts[:session_token].present?
-      #   opts[:cache] = false
-      # end
+      # Session reads are kept out of the response cache by the caching
+      # middleware, which sees the effective session whichever way it was
+      # supplied. See Parse::Middleware::Caching.cache_session_requests.
       opts
     end
 

data/lib/parse/stack/tasks.rb

@@ -50,7 +50,7 @@ module Parse
             end
 
             endpoint = ENV["HOOKS_URL"] || ""
-            unless endpoint.starts_with?("http://") || endpoint.starts_with?("https://")
+            unless %w[http https].include?(Parse::Client.url_scheme(endpoint))
               raise "The ENV variable HOOKS_URL must be a <http/s> url : '#{endpoint}'. Ex. https://12345678.ngrok.io/webhooks"
             end
           end

data/lib/parse/stack/version.rb

@@ -6,6 +6,6 @@ module Parse
   # The Parse Server SDK for Ruby
   module Stack
     # The current version.
-    VERSION = "5.8.1"
+    VERSION = "5.8.2"
   end
 end

data/lib/parse/stack.rb

@@ -78,8 +78,12 @@ module Parse
   # marked individually; the block's state is never lifted while they run.
   #
   # This is a guard against accidental master-key use, not an isolation
-  # boundary. Code inside the block can call {Parse.with_master_key}, and
-  # `Parse::MongoDB.find` and `Parse::MongoDB.indexes` take no scope at all.
+  # boundary: code inside the block can call {Parse.with_master_key}.
+  # `Parse::MongoDB.find`, which reads raw documents with no scope, raises
+  # `Parse::ACLScope::ACLRequired` inside the block. `Parse::MongoDB.indexes`
+  # returns index metadata only and stays available. `Parse::MongoDB.collection`
+  # returns the raw driver collection with no scope and is not refused inside
+  # the block, so code that reads through it directly bypasses the block.
   #
   # @yield runs the block with master-key disabled
   # @return [Object] the block's return value

data/lib/parse/vector_search/hybrid.rb

@@ -749,8 +749,11 @@ module Parse
         end
 
         def run_pipeline!(collection_name, pipeline, authorizing_client: nil)
+          agg_opts = {}
+          budget = Parse::PipelineSecurity.regex_time_budget(pipeline)
+          agg_opts[:max_time_ms] = budget if budget
           Parse::MongoDB.collection(collection_name, authorizing_client: authorizing_client)
-                        .aggregate(pipeline).to_a
+                        .aggregate(pipeline, agg_opts).to_a
         end
 
         def assert_clp_find!(collection_name, resolution)

data/lib/parse/vector_search.rb

@@ -721,6 +721,7 @@ module Parse
       # whose stage 0 is `$vectorSearch`.
       def run_pipeline!(collection_name, pipeline, max_time_ms: nil, authorizing_client: nil)
         agg_opts = {}
+        max_time_ms ||= Parse::PipelineSecurity.regex_time_budget(pipeline)
         agg_opts[:max_time_ms] = max_time_ms if max_time_ms
         # Vector search bypasses Parse::MongoDB.aggregate, so the binding
         # guard only sees this read if the authorizing client arrives here.

data/lib/parse/webhooks/payload.rb

@@ -30,7 +30,8 @@ module Parse
                      context: nil }.freeze
       include ::ActiveModel::Serializers::JSON
       # @!attribute [rw] master
-      #   @return [Boolean] whether the master key was used for this request.
+      #   @return [Boolean] the raw `master` claim from the request body. It is
+      #     not authenticated on its own; use {#master?} for any decision.
       # @!attribute [rw] user
       #   @return [Parse::User] the user who performed this request or action.
       # @!attribute [rw] installation_id
@@ -151,10 +152,10 @@ module Parse
           @session_token = top_token unless top_token.empty?
         end
         # Webhook trigger payloads (beforeSave/afterSave/etc.) are delivered by
-        # Parse Server and, when a webhook key is configured (the default; see
-        # Parse::Webhooks.allow_unauthenticated for the opt-out used in tests /
-        # local dev), authenticated by it -- so they are treated as trusted,
-        # server-authoritative state. A handler is meant to receive the full
+        # Parse Server. When the request is authenticated (webhook key or
+        # signature) the object state is server-authoritative; under
+        # Parse::Webhooks.allow_unauthenticated it is whatever the caller sent,
+        # and #master? is false regardless of the body. A handler is meant to receive the full
         # object -- createdAt/updatedAt, ACL, internal fields and all. The only
         # thing stripped here is genuine credential material a handler never
         # legitimately needs to read inline (live session tokens -- captured
@@ -330,7 +331,7 @@ module Parse
       def inspect
         "#<#{self.class.name} trigger=#{@trigger_name.inspect} " \
         "function=#{@function_name.inspect} class=#{parse_class.inspect} " \
-        "id=#{parse_id.inspect} master=#{@master ? true : false} " \
+        "id=#{parse_id.inspect} master=#{master?} " \
         "session_token=#{@session_token ? "[FILTERED]" : "nil"}>"
       end
 
@@ -350,9 +351,39 @@ module Parse
         @function_name.present?
       end
 
-      # true if the master key was used for this request.
+      # Whether the request reached the SDK through authenticated ingress (the
+      # webhook key matched, or a configured HMAC signature verified). Set by
+      # {Parse::Webhooks.call!}. A payload built in-process (local callbacks,
+      # tests) is treated as authenticated.
+      # @return [Boolean]
+      def authenticated?
+        @authenticated != false
+      end
+
+      # @!visibility private
+      # @param value [Boolean]
+      def authenticated=(value)
+        @authenticated = value ? true : false
+      end
+
+      # true if the request body says the master key was used. Parse Server
+      # sends `master` as a JSON boolean, so only `true` counts (a string
+      # `"true"` does not). This is only what the body claims:
+      # under `Parse::Webhooks.allow_unauthenticated` with no signature, any
+      # caller can set it. Diagnostic only: every decision the SDK makes
+      # (field guards, ACL owner adoption, callback dedup) uses {#master?}.
+      # @return [Boolean]
+      def claimed_master?
+        @master == true
+      end
+
+      # true if the master key was used for this request. Only an
+      # authenticated request (webhook key or signature) can claim master; on
+      # unauthenticated ingress this is always false, so field guards, ACL
+      # owner adoption, and handler checks never trust a forged body.
+      # @return [Boolean]
       def master?
-        @master.present?
+        authenticated? && claimed_master?
       end
 
       # true if this payload carried a caller session token -- i.e. the

data/lib/parse/webhooks/registration.rb

@@ -84,12 +84,34 @@ module Parse
         end
       end
 
+      # Check that a webhook endpoint is an http(s) URL (scheme compared
+      # case-insensitively, surrounding whitespace ignored) and return it
+      # stripped. Plain http:// to a host that is not this machine is
+      # allowed but warns: Parse Server sends the webhook key on every call,
+      # so it would travel in cleartext.
+      # @param endpoint [String]
+      # @return [String]
+      # @raise [ArgumentError]
+      # @!visibility private
+      def validate_hooks_endpoint!(endpoint)
+        url = endpoint.to_s.strip
+        scheme = Parse::Client.url_scheme(url)
+        host = Parse::Client.url_host(url)
+        unless %w[http https].include?(scheme) && host.present? && url.match?(%r{\Ahttps?://}i)
+          raise ArgumentError, "The HOOKS_URL must be http/s: '#{endpoint}'"
+        end
+        if scheme == "http" && !Parse::Client.loopback_host?(host)
+          warn "[Parse::Webhooks] SECURITY WARNING: webhook endpoint #{url} uses http://. " \
+               "Parse Server sends the webhook key with every call, so it travels in " \
+               "cleartext. Use an https:// endpoint."
+        end
+        url
+      end
+
       # Registers all webhook functions registered with Parse::Stack with Parse server.
       # @param endpoint [String] a https url that points to the webhook server.
       def register_functions!(endpoint)
-        unless endpoint.present? && (endpoint.starts_with?("http://") || endpoint.starts_with?("https://"))
-          raise ArgumentError, "The HOOKS_URL must be http/s: '#{endpoint}''"
-        end
+        endpoint = validate_hooks_endpoint!(endpoint)
         assert_webhook_url_safe!(endpoint)
         endpoint += "/" unless endpoint.ends_with?("/")
         functionsMap = {}
@@ -114,9 +136,7 @@ module Parse
       # @param endpoint [String] a https url that points to the webhook server.
       # @param include_wildcard [Boolean] Allow wildcard registrations
       def register_triggers!(endpoint, include_wildcard: false)
-        unless endpoint.present? && (endpoint.starts_with?("http://") || endpoint.starts_with?("https://"))
-          raise ArgumentError, "The HOOKS_URL must be http/s: '#{endpoint}''"
-        end
+        endpoint = validate_hooks_endpoint!(endpoint)
         assert_webhook_url_safe!(endpoint)
         endpoint += "/" unless endpoint.ends_with?("/")
         all_triggers = Parse::API::Hooks::TRIGGER_NAMES_LOCAL

data/lib/parse/webhooks/replay_protection.rb

@@ -124,16 +124,26 @@ module Parse
         # works with any Rack request. Replay dedup applies only when
         # `request_id` or an `X-Parse-Webhook-Nonce` header is present.
         def verify!(env, body_str, request_id)
+          check(env, body_str, request_id).first
+        end
+
+        # @!visibility private
+        # Same checks as {.verify!}, also reporting whether a signature was
+        # verified. The signing secret is read once, so the answer always
+        # matches the check that ran.
+        # @return [Array(String, Boolean)] the error message (nil when the
+        #   request passes) and true when it carried a valid signature.
+        def check(env, body_str, request_id)
           secret = signing_secret
           signed_key = nil
           if secret && !secret.empty?
             ts_header = env[HEADER_TIMESTAMP].to_s
             sig_header = env[HEADER_SIGNATURE].to_s
-            return "Missing webhook signature." if ts_header.empty? || sig_header.empty?
-            return "Invalid webhook timestamp." unless ts_header =~ /\A-?\d{1,12}\z/
+            return ["Missing webhook signature.", false] if ts_header.empty? || sig_header.empty?
+            return ["Invalid webhook timestamp.", false] unless ts_header =~ /\A-?\d{1,12}\z/
             ts = ts_header.to_i
             skew = (Time.now.to_i - ts).abs
-            return "Stale webhook timestamp." if skew > signing_max_skew_seconds
+            return ["Stale webhook timestamp.", false] if skew > signing_max_skew_seconds
             # A sender that signs a per-delivery nonce (`ts.nonce.body`) gets a
             # distinct signature for every delivery, so identical bodies sent
             # in the same second are not mistaken for replays. The original
@@ -145,7 +155,7 @@ module Parse
               expected = OpenSSL::HMAC.hexdigest("SHA256", secret, material)
               ActiveSupport::SecurityUtils.secure_compare(expected, sig_header)
             end
-            return "Invalid webhook signature." unless matched
+            return ["Invalid webhook signature.", false] unless matched
             # A signed delivery is deduplicated on its signature, which covers
             # the timestamp and body and cannot be changed without the secret.
             # Keying it on the unsigned nonce would let a captured request be
@@ -157,23 +167,23 @@ module Parse
           if signed_key
             window = [replay_window_seconds, signing_max_skew_seconds * 2].max
             digest = Digest::SHA256.hexdigest(signed_key)
-            return "Webhook replay detected." if cache.seen?(digest, window)
+            return ["Webhook replay detected.", false] if cache.seen?(digest, window)
             cache.record(digest, replay_cache_size)
-            return nil
+            return [nil, true]
           end
 
           # Dedup only when the delivery carries a per-delivery identifier.
           # Keying on the body alone rejects legitimate identical requests.
           nonce = request_id.to_s.strip
           nonce = env[HEADER_NONCE].to_s.strip if nonce.empty?
-          return nil if nonce.empty?
+          return [nil, false] if nonce.empty?
 
           digest = Digest::SHA256.hexdigest("#{nonce}\x1f#{body_str}")
           if cache.seen?(digest, replay_window_seconds)
-            return "Webhook replay detected."
+            return ["Webhook replay detected.", false]
           end
           cache.record(digest, replay_cache_size)
-          nil
+          [nil, false]
         end
       end
 

data/lib/parse/webhooks.rb

@@ -477,7 +477,10 @@ module Parse
                        payload&.raw&.dig("headers", "X-Parse-Request-Id")
           ruby_initiated = request_id&.start_with?("_RB_") || false
           payload.instance_variable_set(:@ruby_initiated, ruby_initiated)
-          trusted_ruby_initiated = ruby_initiated && (payload.master? == true)
+          # `master?` is the authenticated claim: on unauthenticated ingress
+          # it is false, so a forged `_RB_` id plus `"master": true` cannot
+          # suppress model callbacks.
+          trusted_ruby_initiated = ruby_initiated && payload.master?
         else
           trusted_ruby_initiated = false
         end
@@ -673,7 +676,7 @@ module Parse
         # matched route, so read that stamped value rather than recomputing via
         # `ruby_initiated?` -- whose `||=` memoization re-derives on a stamped
         # `false` and could disagree with call_route's header lookup.
-        return if payload.ruby_initiated? && payload.master? == true
+        return if payload.ruby_initiated? && payload.master?
 
         # By the time afterSave fires the object is ALREADY persisted in Parse
         # Server, and Parse Server discards the afterSave response body entirely
@@ -736,7 +739,7 @@ module Parse
         obj = payload.parse_object
         return unless obj.is_a?(Parse::Object)
         return unless route_registered?(:after_delete, payload.parse_class)
-        return if payload.ruby_initiated? && payload.master? == true
+        return if payload.ruby_initiated? && payload.master?
         obj.run_after_delete_callbacks
         nil
       rescue => e
@@ -1421,7 +1424,12 @@ module Parse
         request = Rack::Request.new env
         response = Rack::Response.new
 
+        # Whether this request proved it came from Parse Server: the webhook
+        # key matched, or (below) a configured signature verified. Without
+        # either, the body's `master` flag is only a claim.
+        authenticated = false
         if self.key.present?
+          authenticated = true
           provided_key = request.env[HTTP_PARSE_WEBHOOK].to_s
           unless ActiveSupport::SecurityUtils.secure_compare(self.key, provided_key)
             puts "[Parse::Webhooks] Invalid Parse-Webhook Key received"
@@ -1466,7 +1474,7 @@ module Parse
         # require a fresh HMAC over the body. Done before JSON parsing so
         # a malformed payload can't bypass dedup, and before any handler
         # runs so side effects aren't repeated.
-        replay_error = ReplayProtection.verify!(
+        replay_error, signature_verified = ReplayProtection.check(
           request.env,
           body_str,
           request.env["HTTP_X_PARSE_REQUEST_ID"]
@@ -1475,6 +1483,10 @@ module Parse
           response.write error(replay_error)
           return response.finish
         end
+        # Uses the result of the check that just ran, not a second read of
+        # the signing secret, so a secret changed mid-request cannot mark an
+        # unverified request as authenticated.
+        authenticated ||= signature_verified
 
         # Parse Server registers each trigger at
         # `<endpoint>/<triggerName>/<className>`. For beforeFind/afterFind the
@@ -1487,6 +1499,7 @@ module Parse
         webhook_class = Parse::Webhooks.trigger_class_from_path(request.path)
         begin
           payload = Parse::Webhooks::Payload.new(body_str, webhook_class)
+          payload.authenticated = authenticated
         rescue => e
           warn "Invalid webhook payload format: #{Parse::TerminalSafe.sanitize_line(e.to_s)}"
           response.write error("Invalid payload format. Should be valid JSON.")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parse-stack-next
 version: !ruby/object:Gem::Version
-  version: 5.8.1
+  version: 5.8.2
 platform: ruby
 authors:
 - Adrian Curtin