parse-stack-next 5.8.3 → 5.8.4

data/lib/parse/stack.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require_relative "stack/version"
+require_relative "stack/rack_advisory"
 require_relative "terminal_safe"
 require_relative "client"
 require_relative "query"
@@ -17,6 +18,8 @@ require_relative "schema/search_index_migrator"
 require_relative "lookup_rewriter"
 require_relative "console"
 
+Parse::Stack::RackAdvisory.check!
+
 module Parse
   class Error < StandardError; end
 
@@ -80,11 +83,17 @@ module Parse
   # This is a guard against accidental master-key use, not an isolation
   # boundary: code inside the block can call {Parse.with_master_key}.
   # `Parse::MongoDB.find`, which reads raw documents with no scope, raises
-  # `Parse::ACLScope::ACLRequired` inside the block. `Parse::MongoDB.indexes`
+  # `Parse::ACLScope::ACLRequired` inside the block, and inside a
+  # {Parse.with_session} block unless a {Parse.with_master_key} block is
+  # nested inside the session block. `Parse::MongoDB.indexes`
   # returns index metadata only and stays available. `Parse::MongoDB.collection`
   # returns the raw driver collection with no scope and is not refused inside
   # the block, so code that reads through it directly bypasses the block.
   #
+  # The state is restored on exit and is inherited by Threads and Fibers
+  # created inside the block; see "Ambient identity lifetime" on
+  # {Parse.with_session} and {Parse.without_ambient_identity}.
+  #
   # @yield runs the block with master-key disabled
   # @return [Object] the block's return value
   # @example
@@ -107,16 +116,30 @@ module Parse
   # inside a session-scoped block. If no master key is configured on the
   # client, this is a no-op — the helper does not synthesise one.
   #
+  # The state is restored on exit and is inherited by Threads and Fibers
+  # created inside the block; see "Ambient identity lifetime" on
+  # {Parse.with_session} and {Parse.without_ambient_identity}.
+  #
   # @yield runs the block with master-key enabled (if configured)
   # @return [Object] the block's return value
   def self.with_master_key
     previous = Fiber[MASTER_KEY_STATE_KEY]
+    previous_innermost = Fiber[INNERMOST_AUTH_BLOCK_KEY]
     Fiber[MASTER_KEY_STATE_KEY] = :enabled
+    Fiber[INNERMOST_AUTH_BLOCK_KEY] = :master
     yield
   ensure
     Fiber[MASTER_KEY_STATE_KEY] = previous
+    Fiber[INNERMOST_AUTH_BLOCK_KEY] = previous_innermost
   end
 
+  # Fiber-local key naming the innermost of {.with_master_key} (`:master`)
+  # and {.with_session} (`:session`) blocks the current fiber is inside.
+  # `Parse::MongoDB.find` consults it to allow a master read only when the
+  # master block was entered inside the session block.
+  # @!visibility private
+  INNERMOST_AUTH_BLOCK_KEY = :__parse_innermost_auth_block__
+
   # @return [Boolean] true if the current fiber is inside a
   #   {.without_master_key} block. Consulted by the authentication
   #   middleware in addition to the per-request disable header.
@@ -147,9 +170,42 @@ module Parse
   #
   # Fiber-local, not thread-local: concurrent fibers (and threads, since
   # each thread starts with its own root fiber) do not share state.
-  # Survives Faraday retries — the token lives for the lifetime of the
+  # Survives Faraday retries. The token lives for the lifetime of the
   # block, not just the first HTTP attempt.
   #
+  # == Ambient identity lifetime
+  #
+  # The ambient identity (this session token, the master-key state set by
+  # {.with_master_key} and {.without_master_key}, and the innermost-block
+  # marker) follows these rules:
+  #
+  # * It lasts for the block on the current fiber. On exit the previous
+  #   values are restored, whether the block returns, raises, or is left
+  #   with `break`/`throw`.
+  # * Threads and Fibers created inside the block inherit it for their
+  #   whole lifetime. This is Ruby's fiber-storage semantics: a new Thread
+  #   or Fiber starts with a copy of the creating fiber's storage, and that
+  #   copy is not cleared when the creating block exits. The inheritance is
+  #   intended for short-lived work done on behalf of the same user, such
+  #   as a parallel fetch that is joined before the block returns.
+  # * Long-lived workers and pooled threads (job processors, schedulers,
+  #   connection readers, thread pools created lazily on first use) should
+  #   not be created inside a session block. When that cannot be arranged,
+  #   start the worker body with {.without_ambient_identity}, which runs it
+  #   with all three values cleared. Assigning `Fiber[...] = nil` on the
+  #   storage keys is not public API.
+  # * A reused request thread (Puma, Sidekiq, a thread pool) does not keep
+  #   identity between units of work, because each block restores the
+  #   value it found on entry. A job that runs outside any block sees no
+  #   ambient token even if the previous job on the same thread ran inside
+  #   one.
+  #
+  # The SDK's LiveQuery background threads (socket reader, reconnect,
+  # health ping, event dispatch) start under {.without_ambient_identity},
+  # so LiveQuery callbacks do not run with a session inherited from the
+  # code that first opened the connection. LiveQuery authorization comes
+  # from the client and subscription configuration.
+  #
   # An explicit `session_token:` kwarg on any call still wins over the
   # ambient. An explicit `use_master_key: true` skips the ambient and
   # sends the master key (if configured).
@@ -171,6 +227,7 @@ module Parse
     # Capture BEFORE any raise so the `ensure` always restores the real
     # previous ambient (never clobbers an enclosing with_session).
     previous = Fiber[SESSION_TOKEN_STATE_KEY]
+    previous_innermost = Fiber[INNERMOST_AUTH_BLOCK_KEY]
     # SEC-02: a present-but-blank (empty or whitespace) token is an unusable
     # credential. The prior behavior stored a whitespace token as the ambient
     # (only an exactly-empty string was treated as absent), and the request
@@ -187,9 +244,56 @@ module Parse
     # "no ambient", which the request layer resolves to the master key on a
     # master-keyed client: the opposite of the documented anonymous block.
     Fiber[SESSION_TOKEN_STATE_KEY] = resolved.nil? ? ANONYMOUS_SESSION : resolved
+    Fiber[INNERMOST_AUTH_BLOCK_KEY] = :session
     yield
   ensure
     Fiber[SESSION_TOKEN_STATE_KEY] = previous
+    Fiber[INNERMOST_AUTH_BLOCK_KEY] = previous_innermost
+  end
+
+  # Run `block` with no ambient identity on the current fiber: the
+  # {.with_session} token, the {.with_master_key} / {.without_master_key}
+  # state, and the innermost-block marker are all cleared, and restored on
+  # exit (including on exception).
+  #
+  # Use it at the start of a long-lived worker, so a thread that happens to
+  # be created inside a session block does not run every later job as that
+  # user (see "Ambient identity lifetime" on {.with_session}).
+  #
+  # Cleared means "no ambient", not anonymous: requests inside the block
+  # authenticate as the client is configured, which on a client with a
+  # master key means the master key. Wrap a unit of work in
+  # {.with_session} or {.without_master_key} inside the worker to scope it.
+  #
+  # Pass `keep_restrictions: true` to drop the inherited identity without
+  # gaining authority: when the surrounding code was restricted (inside
+  # {.with_session}, an anonymous session, or {.without_master_key}), the
+  # block runs with no session token and the master key suppressed, as in
+  # {.without_master_key}. Only an unrestricted caller's block runs with no
+  # ambient state. The SDK starts its LiveQuery callback threads this way.
+  #
+  # @param keep_restrictions [Boolean] never lift a restriction the caller had
+  # @yield runs the block with no ambient session token or master-key state
+  # @return [Object] the block's return value
+  # @example start a background worker
+  #   Thread.new do
+  #     Parse.without_ambient_identity do
+  #       loop { process(queue.pop) }
+  #     end
+  #   end
+  def self.without_ambient_identity(keep_restrictions: false)
+    previous_token = Fiber[SESSION_TOKEN_STATE_KEY]
+    previous_master = Fiber[MASTER_KEY_STATE_KEY]
+    previous_innermost = Fiber[INNERMOST_AUTH_BLOCK_KEY]
+    restricted = !previous_token.nil? || previous_master == :disabled
+    Fiber[SESSION_TOKEN_STATE_KEY] = nil
+    Fiber[MASTER_KEY_STATE_KEY] = keep_restrictions && restricted ? :disabled : nil
+    Fiber[INNERMOST_AUTH_BLOCK_KEY] = nil
+    yield
+  ensure
+    Fiber[SESSION_TOKEN_STATE_KEY] = previous_token
+    Fiber[MASTER_KEY_STATE_KEY] = previous_master
+    Fiber[INNERMOST_AUTH_BLOCK_KEY] = previous_innermost
   end
 
   # Fiber-state sentinel installed by `Parse.with_session(nil)`. The request

data/lib/parse/two_factor_auth/user_extension.rb

@@ -48,6 +48,8 @@ module Parse
         # @example
         #   user = Parse::User.login_with_mfa("john", "password123", "123456")
         def login_with_mfa(username, password, mfa_token)
+          # Validate only: the login body sends the username exactly as given.
+          mfa_username!(username)
           raise MFA::RequiredError, "MFA token is required" if mfa_token.blank?
 
           # `client.login_with_mfa` always goes out without the master key
@@ -74,19 +76,36 @@ module Parse
         # This queries the user's authData.mfa status using the afterFind hook
         # which returns { status: "enabled" } or { status: "disabled" }.
         #
-        # @param username [String] The username to check
+        # @param username [String] The username to check. Must be a String.
+        #   A Hash here would reach the query as an operator (for example
+        #   `{"$regex" => "^a"}`) and probe usernames, so anything else is refused.
         # @return [Boolean] True if MFA is required
+        # @raise [ArgumentError] if username is not a String or is blank
         #
         # @example
         #   if Parse::User.mfa_required?("john")
         #     # Show MFA input field
         #   end
         def mfa_required?(username)
+          username = mfa_username!(username)
           user = where(username: username).first
           return false unless user
 
           user.mfa_enabled?
         end
+
+        private
+
+        # Coerce an MFA helper's username argument to a non-blank String.
+        # @raise [ArgumentError] on a non-String or blank value.
+        def mfa_username!(username)
+          unless username.is_a?(String)
+            raise ArgumentError, "username must be a String, got #{username.class}"
+          end
+          stripped = username.strip
+          raise ArgumentError, "username must not be blank" if stripped.empty?
+          stripped
+        end
       end
 
       # Check if MFA is enabled for this user.
@@ -271,6 +290,15 @@ module Parse
       # This requires a valid current MFA token (TOTP or recovery code)
       # to verify the user's identity before disabling MFA.
       #
+      # The code check is performed by this SDK method, not by Parse Server.
+      # The SDK first submits the code to confirm it is accepted, then sends
+      # a separate `authData: { mfa: nil }` update. Parse Server accepts that
+      # second update from any holder of the session token, with or without
+      # the first step, so this method is not an enforcement boundary.
+      # Protect MFA removal server-side, for example with a `beforeSave`
+      # trigger on `_User` or a Cloud Code function that requires a fresh code
+      # verified on the server. See {Parse::MFA} for the enforcement boundary.
+      #
       # @param current_token [String] Current TOTP code or recovery code
       # @return [Boolean] True if disabled successfully
       # @raise [Parse::MFA::VerificationError] If token is invalid
@@ -296,8 +324,9 @@ module Parse
         #      code is the deliberate confirmation gate for turning MFA off.)
         #   2. Disable MFA by unlinking the provider with `{ mfa: nil }`.
         #
-        # This keeps self-disable gated on a valid current code even though the
-        # server offers no dedicated TOTP self-disable endpoint.
+        # Step 1 is a check made by this SDK method only. Parse Server does
+        # not link the two requests, so a session-token holder can send step 2
+        # directly; server-side protection is required (see YARD above).
         verify = client.update_user(id, { authData: { mfa: { old: current_token } } },
                                     session_token: session_token)
         # Classify the two-step response POSITIVELY instead of treating
@@ -352,8 +381,15 @@ module Parse
       # support; when given, the operator must belong to the role (or any
       # of its child roles) or `ForbiddenError` is raised.
       #
-      # @param authorized_by [Parse::User, Parse::Pointer] the operator
-      #   performing the override. Required.
+      # `authorized_by:` must be the authenticated operator, resolved from the
+      # caller's own verified session (for example the current admin user of
+      # the request after authentication). Never build it from an id or
+      # pointer supplied in the request body or parameters; the role check
+      # would then validate whichever user the requester names.
+      #
+      # @param authorized_by [Parse::User, Parse::Pointer] the authenticated
+      #   operator performing the override. Required. Never an id taken
+      #   from the request.
       # @param admin_role [Parse::Role, String, nil] role (or role name)
       #   that `authorized_by` must belong to. Library-enforced. Either
       #   this or `allow_unverified: true` is REQUIRED (fail-closed).

data/lib/parse/two_factor_auth.rb

@@ -52,6 +52,20 @@ module Parse
   # @example Login with MFA
   #   user = Parse::User.login_with_mfa("username", "password", "123456")
   #
+  # == Enforcement Boundary
+  #
+  # {MFA.verify}, {MFA.verify_timestamp} and the SDK's self-disable flow
+  # ({Parse::User#disable_mfa!}) are client-side checks. They are not the
+  # enforcement boundary. Parse Server's MFA adapter enforces MFA at login,
+  # and that is the boundary.
+  #
+  # Disabling MFA is an ordinary user update (`authData: { mfa: nil }`).
+  # Anyone holding the user's session token can send that REST update
+  # directly without going through the SDK. Protect it server-side, for
+  # example with a `beforeSave` trigger on `_User` or a Cloud Code function
+  # that refuses to clear `authData.mfa` unless a fresh code was verified on
+  # the server for that request.
+  #
   # @see https://github.com/parse-community/parse-server/blob/master/src/Adapters/Auth/mfa.js
   #
   module MFA
@@ -181,21 +195,72 @@ module Parse
 
       # Verify a TOTP code locally (for testing/validation before sending to server).
       #
+      # A code stays valid for its whole time step plus one step of drift on
+      # each side, so without `after:` the same code verifies repeatedly for
+      # roughly 90 seconds. That is fine for checking a code before sending it
+      # to Parse Server, which tracks reuse itself. An application that uses
+      # this method as its own second factor must store the timestamp of the
+      # last accepted code per user (see {verify_timestamp}) and pass it back
+      # as `after:` on the next attempt, or a captured code can be replayed.
+      #
+      # Reading the stored timestamp, calling this method, and then writing
+      # the new timestamp is not enough on its own: two concurrent requests
+      # with the same code can both read the old value and both succeed.
+      # Update the stored value atomically, as a compare-and-set keyed on the
+      # previous timestamp (a conditional update that only matches when the
+      # stored value still equals the one passed as `after:`), or record each
+      # accepted step under a database unique constraint on user and time
+      # step. Treat the code as accepted only when that write succeeds.
+      #
+      # This method is a client-side check. Parse Server's MFA adapter, which
+      # enforces MFA at login, is the enforcement boundary (see {Parse::MFA}).
+      #
       # @param secret [String] Base32-encoded secret
       # @param code [String] The 6-digit code to verify
+      # @param after [Integer, Time, nil] reject codes from this time step and
+      #   earlier. Pass the value returned by {verify_timestamp} for the last
+      #   accepted code. nil (the default) applies no replay check.
       # @return [Boolean] True if valid
       #
       # @example
       #   if Parse::MFA.verify(secret, "123456")
       #     puts "Code is valid!"
       #   end
-      def verify(secret, code)
-        return false if secret.blank? || code.blank?
+      #
+      # @example Rejecting reuse
+      #   ok = Parse::MFA.verify(secret, code, after: user_record.mfa_last_used_at)
+      def verify(secret, code, after: nil)
+        !verify_timestamp(secret, code, after: after).nil?
+      end
+
+      # Verify a TOTP code and return the start of the matching time step.
+      #
+      # Store the returned value after a successful login and pass it as
+      # `after:` on the next call to {verify} or {verify_timestamp}; codes from
+      # that step or earlier are then refused. The store must be atomic
+      # (compare-and-set on the previous value, or a unique constraint on user
+      # and time step) so concurrent requests with the same code cannot both
+      # succeed. See {verify}.
+      #
+      # @param secret [String] Base32-encoded secret
+      # @param code [String] The 6-digit code to verify
+      # @param after [Integer, Time, nil] reject codes from this time step and earlier
+      # @return [Integer, nil] Unix timestamp of the matching step, or nil when
+      #   the code is invalid or was already used
+      #
+      # @example
+      #   ts = Parse::MFA.verify_timestamp(secret, code, after: last_used_at)
+      #   if ts
+      #     last_used_at = ts # persist per user
+      #   end
+      def verify_timestamp(secret, code, after: nil)
+        return nil if secret.blank? || code.blank?
 
         ensure_rotp!
+        after = normalize_after(after)
         drift_seconds = config[:period]
-        totp_instance = totp(secret)
-        totp_instance.verify(code.to_s, drift_behind: drift_seconds, drift_ahead: drift_seconds).present?
+        totp(secret).verify(code.to_s, drift_behind: drift_seconds,
+                                       drift_ahead: drift_seconds, after: after)
       end
 
       # Get the current TOTP code (for testing/debugging).
@@ -309,6 +374,18 @@ module Parse
 
       private
 
+      # ROTP compares `after` by time step; accept Integer, Time or DateTime.
+      def normalize_after(after)
+        case after
+        when nil then nil
+        when Integer then after
+        when Time then after.to_i
+        when DateTime, Date then after.to_time.to_i
+        else
+          raise ArgumentError, "after: must be an Integer timestamp or Time, got #{after.class}"
+        end
+      end
+
       def ensure_rotp!
         raise DependencyError.new("rotp") unless rotp_available?
       end

data/lib/parse/vector_search/hybrid.rb

@@ -488,6 +488,7 @@ module Parse
           pointer_fields = resolve_pointer_fields!(collection_name, resolution)
           protected_fields = Parse::CLPScope.protected_fields_for(
             collection_name, resolution.permission_strings,
+            client: Parse::MongoDB.clp_client_for(resolution), strict: true,
           )
           # Unconditional: `Parse::AtlasSearch` may already be partially
           # defined by a submodule (session, protected_paths) without the
@@ -495,6 +496,13 @@ module Parse
           require_relative "../atlas_search"
           Parse::AtlasSearch.send(:assert_search_fields_allowed!,
                                   Array(lex[:fields]).map(&:to_s), protected_fields, resolution)
+          # The lexical branch is built here, not by AtlasSearch.search, so
+          # apply its internal-field refusal to the same stage.
+          Parse::AtlasSearch::ProtectedPaths.assert_no_internal_paths!(
+            stage: lexical_search_stage(lex, oversample).first,
+            collection_name: collection_name, resolution: resolution,
+            method_name: "Parse::VectorSearch::Hybrid.search", what: "$search path",
+          )
           Parse::VectorSearch.validate_query_vector!(vec[:query_vector])
           Parse::PipelineSecurity.validate_filter!(vec[:vector_filter]) if vec[:vector_filter]
           Parse::PipelineSecurity.validate_filter!(vec[:filter]) if vec[:filter]
@@ -761,6 +769,7 @@ module Parse
           # user, and role grants first; then pointerFields / readUserFields).
           # Raises Parse::CLPScope::Denied when the scope cannot find at all.
           Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                              client: Parse::MongoDB.clp_client_for(resolution),
                                               label: "hybrid-search")
           nil
         end
@@ -772,6 +781,7 @@ module Parse
           # permits? / pointer_fields_for pair missed readUserFields entirely
           # and over-restricted a public grant that also listed pointerFields.
           Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                              client: Parse::MongoDB.clp_client_for(resolution),
                                               label: "hybrid-search")
         end
 
@@ -824,6 +834,17 @@ module Parse
           hash.each_with_object({}) { |(k, v), out| out[k.to_sym] = v }
         end
       end
+
+      # One Parse::CLPScope schema snapshot per hybrid search, shared by the
+      # native path's CLP gate and protectedFields lookups and by the
+      # client path's lexical and vector branches.
+      class << self
+        alias_method :search_without_schema_snapshot, :search
+        # @!visibility private
+        def search(*args, **kwargs, &block)
+          Parse::CLPScope.with_snapshot { search_without_schema_snapshot(*args, **kwargs, &block) }
+        end
+      end
     end
   end
 end

data/lib/parse/vector_search.rb

@@ -313,6 +313,7 @@ module Parse
         pointer_fields = resolve_pointer_fields!(collection_name, resolution)
         protected_fields = Parse::CLPScope.protected_fields_for(
           collection_name, resolution.permission_strings,
+          client: Parse::MongoDB.clp_client_for(resolution), strict: true,
         )
         assert_protected_fields_untouched!(collection_name, path, filter, vector_filter,
                                            protected_fields, resolution)
@@ -549,6 +550,7 @@ module Parse
         # user, and role grants first; then pointerFields / readUserFields).
         # Raises Parse::CLPScope::Denied when the scope cannot find at all.
         Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                            client: Parse::MongoDB.clp_client_for(resolution),
                                             label: "VectorSearch")
         nil
       end
@@ -593,6 +595,7 @@ module Parse
         # permits? / pointer_fields_for pair missed readUserFields entirely
         # and over-restricted a public grant that also listed pointerFields.
         Parse::CLPScope.row_constraint_for!(collection_name, :find, resolution,
+                                            client: Parse::MongoDB.clp_client_for(resolution),
                                             label: "VectorSearch")
       end
 
@@ -734,6 +737,18 @@ module Parse
     end
 
     @default_index = nil
+
+    # Each public entry point resolves the class schema once: the CLP gate,
+    # pointerFields check, and protectedFields lookups inside one call share
+    # a single Parse::CLPScope snapshot, so a cache expiry between them
+    # cannot change the decision.
+    class << self
+      alias_method :search_without_schema_snapshot, :search
+      # @!visibility private
+      def search(*args, **kwargs, &block)
+        Parse::CLPScope.with_snapshot { search_without_schema_snapshot(*args, **kwargs, &block) }
+      end
+    end
   end
 end
 

data/lib/parse/webhooks/replay_protection.rb

@@ -136,7 +136,11 @@ module Parse
         def check(env, body_str, request_id)
           secret = signing_secret
           signed_key = nil
-          if secret && !secret.empty?
+          # A whitespace-only secret is treated as absent, matching how the
+          # webhook key is checked with `present?`. An HMAC keyed with a few
+          # spaces is no secret at all, so it must not count as configured.
+          secret = nil if secret.nil? || secret.to_s.strip.empty?
+          if secret
             ts_header = env[HEADER_TIMESTAMP].to_s
             sig_header = env[HEADER_SIGNATURE].to_s
             return ["Missing webhook signature.", false] if ts_header.empty? || sig_header.empty?

data/lib/parse/webhooks.rb

@@ -154,6 +154,8 @@ module Parse
     HTTP_PARSE_APPLICATION_ID = "HTTP_X_PARSE_APPLICATION_ID"
     # The content type that needs to be sent back to Parse server.
     CONTENT_TYPE = "application/json"
+    # The largest webhook request body accepted, in bytes (1 MB).
+    MAX_BODY_BYTES = 1_048_576
 
     # The Parse Webhook Key to be used for authenticating webhook requests.
     # See {Parse::Webhooks.key} on setting this value.
@@ -1341,7 +1343,11 @@ module Parse
       end
 
       def key
-        @key ||= ENV["PARSE_SERVER_WEBHOOK_KEY"] || ENV["PARSE_WEBHOOK_KEY"]
+        # `presence` so an empty or whitespace-only PARSE_SERVER_WEBHOOK_KEY
+        # (common in container env files that declare every variable) does
+        # not hide a configured PARSE_WEBHOOK_KEY. Both blank leaves the key
+        # nil, which the endpoint treats as unconfigured and refuses.
+        @key ||= ENV["PARSE_SERVER_WEBHOOK_KEY"].presence || ENV["PARSE_WEBHOOK_KEY"].presence
       end
 
       # When no webhook key is configured, the endpoint refuses requests by
@@ -1463,12 +1469,26 @@ module Parse
           return response.finish
         end
 
+        # Refuse an oversize payload before buffering it. A declared
+        # Content-Length over the limit is rejected without reading the body,
+        # and the read itself is capped at one byte past the limit, so a body
+        # that omits or understates its length still cannot make this process
+        # buffer more than the limit plus one byte.
+        declared_length = request.env["CONTENT_LENGTH"].to_s.strip
+        if declared_length.match?(/\A\d+\z/) && declared_length.to_i > MAX_BODY_BYTES
+          response.write error("Payload too large.")
+          return response.finish
+        end
         request.body.rewind
-        body_str = request.body.read
-        if body_str.bytesize > 1_048_576
+        body_str = request.body.read(MAX_BODY_BYTES + 1).to_s
+        if body_str.bytesize > MAX_BODY_BYTES
           response.write error("Payload too large.")
           return response.finish
         end
+        # `read(length)` returns binary (ASCII-8BIT) data. Retag it as UTF-8
+        # so the signature material and JSON parsing see the same string the
+        # unbounded `read` returned before.
+        body_str.force_encoding(Encoding::UTF_8)
 
         # NEW-EXT-4: reject in-window replays and (when configured)
         # require a fresh HMAC over the body. Done before JSON parsing so
@@ -1537,7 +1557,6 @@ module Parse
         end
 
         begin
-          result = true
           if payload.function? && payload.function_name.present?
             # An unknown function must fail. Answering success would tell the
             # caller that a function ran when nothing did.

data/parse-stack-next.gemspec

@@ -50,11 +50,16 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency "activemodel", [">= 6.1", "< 9"]
   spec.add_runtime_dependency "activesupport", [">= 6.1", "< 9"]
   spec.add_runtime_dependency "parallel", [">= 1.6", "< 3"]
-  spec.add_runtime_dependency "faraday", "~> 2.0"
+  spec.add_runtime_dependency "faraday", [">= 2.14.3", "< 3"]
   spec.add_runtime_dependency "faraday-net_http_persistent", "~> 2.0"
   spec.add_runtime_dependency "moneta", "< 2"
   spec.add_runtime_dependency "connection_pool", ">= 2.2", "< 4"
-  spec.add_runtime_dependency "rack", ">= 2.0.6", "< 4"
+  # Rack's 2026-04 advisories are fixed per branch: 2.2.23, 3.1.21, and
+  # 3.2.6 (the 3.0 line has no fixed release). RubyGems limits a dependency's
+  # requirement string to 255 characters, too short to exclude each vulnerable
+  # 3.x release by name, so the floor covers the 2.2 line and
+  # Parse::Stack::RackAdvisory warns at load time on a vulnerable 3.x release.
+  spec.add_runtime_dependency "rack", ">= 2.2.23", "< 4"
   spec.add_runtime_dependency "csv", "~> 3.3"
   spec.add_runtime_dependency "ostruct", "~> 0.6"
 
@@ -70,14 +75,16 @@ Gem::Specification.new do |spec|
   # Optional dependency for direct MongoDB queries and Atlas Search
   # Required for: Parse::MongoDB, Parse::AtlasSearch, mongo_direct query methods
   # Users can add this to their Gemfile for direct MongoDB access:
-  #   gem 'mongo', '~> 2.18'
-  # Use mongo 2.26 or newer against MongoDB 9.0 servers.
+  #   gem 'mongo', '>= 2.26', '< 3'
+  # mongo 2.26.0 or newer is recommended: it fixes CVE-2026-88030 and is
+  # required against MongoDB 9.0 servers.
   # Note: The gem is loaded at runtime only when MongoDB features are used
 
   # Optional dependency for GraphQL schema type generation
   # Required for: Parse::GraphQL::TypeGenerator
   # Users can add this to their Gemfile for graphql-ruby type generation:
-  #   gem 'graphql', '~> 2.0'
+  #   gem 'graphql', '>= 2.6.9', '< 3'
+  # graphql 2.6.9 or newer is recommended (GHSA-j7xr-4g94-r9h3, GHSA-rmxg-5p3r-j6hh).
   # Note: The gem is loaded at runtime only when `require "parse/graphql"` is called.
   spec.add_development_dependency "graphql", "~> 2.0"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: parse-stack-next
 version: !ruby/object:Gem::Version
-  version: 5.8.3
+  version: 5.8.4
 platform: ruby
 authors:
 - Adrian Curtin
@@ -75,16 +75,22 @@ dependencies:
   name: faraday
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 2.14.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 2.14.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: faraday-net_http_persistent
   requirement: !ruby/object:Gem::Requirement
@@ -139,7 +145,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.6
+        version: 2.2.23
     - - "<"
       - !ruby/object:Gem::Version
         version: '4'
@@ -149,7 +155,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.6
+        version: 2.2.23
     - - "<"
       - !ruby/object:Gem::Version
         version: '4'
@@ -427,6 +433,7 @@ files:
 - lib/parse/stack/generators/templates/model_user.rb
 - lib/parse/stack/generators/templates/parse.rb
 - lib/parse/stack/generators/templates/webhooks.rb
+- lib/parse/stack/rack_advisory.rb
 - lib/parse/stack/railtie.rb
 - lib/parse/stack/tasks.rb
 - lib/parse/stack/version.rb