vulnerabilities.spec.js

const http = require('http');
const express = require('express');
const fetch = (...args) => import('node-fetch').then(({ default: fetch }) => fetch(...args));
const ws = require('ws');
const request = require('../lib/request');
const Config = require('../lib/Config');
const { ParseGraphQLServer } = require('../lib/GraphQL/ParseGraphQLServer');

describe('Vulnerabilities', () => {
  describe('(GHSA-8xq9-g7ch-35hg) Custom object ID allows to acquire role privilege', () => {
    beforeAll(async () => {
      await reconfigureServer({ allowCustomObjectId: true });
      Parse.allowCustomObjectId = true;
    });

    afterAll(async () => {
      await reconfigureServer({ allowCustomObjectId: false });
      Parse.allowCustomObjectId = false;
    });

    it('denies user creation with poisoned object ID', async () => {
      const logger = require('../lib/logger').default;
      const loggerErrorSpy = spyOn(logger, 'error').and.callThrough();
      loggerErrorSpy.calls.reset();
      await expectAsync(
        new Parse.User({ id: 'role:a', username: 'a', password: '123' }).save()
      ).toBeRejectedWith(new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied'));
      expect(loggerErrorSpy).toHaveBeenCalledWith('Sanitized error:', jasmine.stringContaining("Invalid object ID."));
    });

    describe('existing sessions for users with poisoned object ID', () => {
      /** @type {Parse.User} */
      let poisonedUser;
      /** @type {Parse.User} */
      let innocentUser;

      beforeAll(async () => {
        const parseServer = await global.reconfigureServer();
        const databaseController = parseServer.config.databaseController;
        [poisonedUser, innocentUser] = await Promise.all(
          ['role:abc', 'abc'].map(async id => {
            // Create the users directly on the db to bypass the user creation check
            await databaseController.create('_User', { objectId: id });
            // Use the master key to create a session for them to bypass the session check
            return Parse.User.loginAs(id);
          })
        );
      });

      it('refuses session token of user with poisoned object ID', async () => {
        await expectAsync(
          new Parse.Query(Parse.User).find({ sessionToken: poisonedUser.getSessionToken() })
        ).toBeRejectedWith(new Parse.Error(Parse.Error.INTERNAL_SERVER_ERROR, 'Invalid object ID.'));
        await new Parse.Query(Parse.User).find({ sessionToken: innocentUser.getSessionToken() });
      });

    });

    describe('legacy session upgrade for user with poisoned object ID', () => {
      // Legacy session tokens (_session_token on _User) are a MongoDB-only legacy feature
      it_only_db('mongo')('refuses legacy session upgrade for user with poisoned object ID', async () => {
        const parseServer = await global.reconfigureServer();
        const databaseController = parseServer.config.databaseController;
        const poisonedId = 'role:legacy';
        const legacyToken = 'legacy-poisoned-token';
        // Create user with poisoned ID and legacy session token directly in DB
        await databaseController.create('_User', {
          objectId: poisonedId,
          _session_token: legacyToken,
        });
        await expectAsync(
          request({
            method: 'POST',
            url: 'http://localhost:8378/1/upgradeToRevocableSession',
            headers: {
              'Content-Type': 'application/json',
              'X-Parse-Application-Id': 'test',
              'X-Parse-REST-API-Key': 'rest',
              'X-Parse-Session-Token': legacyToken,
            },
            body: JSON.stringify({}),
          })
        ).toBeRejected();
      });
    });
  });

  describe('Object prototype pollution', () => {
    it('denies object prototype to be polluted with keyword "constructor"', async () => {
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const response = await request({
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/PP',
        body: JSON.stringify({
          obj: {
            constructor: {
              prototype: {
                dummy: 0,
              },
            },
          },
        }),
      }).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe('Prohibited keyword in request data: {"key":"constructor"}.');
      expect(Object.prototype.dummy).toBeUndefined();
    });

    it('denies object prototype to be polluted with keypath string "constructor"', async () => {
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const objResponse = await request({
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/PP',
        body: JSON.stringify({
          obj: {},
        }),
      }).catch(e => e);
      const pollResponse = await request({
        headers: headers,
        method: 'PUT',
        url: `http://localhost:8378/1/classes/PP/${objResponse.data.objectId}`,
        body: JSON.stringify({
          'obj.constructor.prototype.dummy': {
            __op: 'Increment',
            amount: 1,
          },
        }),
      }).catch(e => e);
      expect(Object.prototype.dummy).toBeUndefined();
      expect(pollResponse.status).toBe(400);
      const text = JSON.parse(pollResponse.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe('Prohibited keyword in request data: {"key":"constructor"}.');
      expect(Object.prototype.dummy).toBeUndefined();
    });

    it('denies object prototype to be polluted with keyword "__proto__"', async () => {
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const response = await request({
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/PP',
        body: JSON.stringify({ 'obj.__proto__.dummy': 0 }),
      }).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe('Prohibited keyword in request data: {"key":"__proto__"}.');
      expect(Object.prototype.dummy).toBeUndefined();
    });
  });

  describe('(GHSA-5j86-7r7m-p8h6) Cloud function name prototype chain bypass', () => {
    const headers = {
      'Content-Type': 'application/json',
      'X-Parse-Application-Id': 'test',
      'X-Parse-REST-API-Key': 'rest',
    };

    it('rejects "constructor" as cloud function name', async () => {
      const response = await request({
        headers,
        method: 'POST',
        url: 'http://localhost:8378/1/functions/constructor',
        body: JSON.stringify({}),
      }).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.SCRIPT_FAILED);
      expect(text.error).toContain('Invalid function');
    });

    it('rejects "toString" as cloud function name', async () => {
      const response = await request({
        headers,
        method: 'POST',
        url: 'http://localhost:8378/1/functions/toString',
        body: JSON.stringify({}),
      }).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.SCRIPT_FAILED);
      expect(text.error).toContain('Invalid function');
    });

    it('rejects "valueOf" as cloud function name', async () => {
      const response = await request({
        headers,
        method: 'POST',
        url: 'http://localhost:8378/1/functions/valueOf',
        body: JSON.stringify({}),
      }).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.SCRIPT_FAILED);
      expect(text.error).toContain('Invalid function');
    });

    it('rejects "hasOwnProperty" as cloud function name', async () => {
      const response = await request({
        headers,
        method: 'POST',
        url: 'http://localhost:8378/1/functions/hasOwnProperty',
        body: JSON.stringify({}),
      }).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.SCRIPT_FAILED);
      expect(text.error).toContain('Invalid function');
    });

    it('rejects "__proto__.toString" as cloud function name', async () => {
      const response = await request({
        headers,
        method: 'POST',
        url: 'http://localhost:8378/1/functions/__proto__.toString',
        body: JSON.stringify({}),
      }).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.SCRIPT_FAILED);
      expect(text.error).toContain('Invalid function');
    });

    it('still executes a legitimately defined cloud function', async () => {
      Parse.Cloud.define('legitimateFunction', () => 'hello');
      const response = await request({
        headers,
        method: 'POST',
        url: 'http://localhost:8378/1/functions/legitimateFunction',
        body: JSON.stringify({}),
      });
      expect(response.status).toBe(200);
      expect(JSON.parse(response.text).result).toBe('hello');
    });
  });

  describe('(GHSA-3v4q-4q9g-x83q) Prototype pollution via application ID in trigger store', () => {
    const prototypeProperties = ['constructor', 'toString', 'valueOf', 'hasOwnProperty', '__proto__'];

    for (const prop of prototypeProperties) {
      it(`rejects "${prop}" as application ID in cloud function call`, async () => {
        const response = await request({
          headers: {
            'Content-Type': 'application/json',
            'X-Parse-Application-Id': prop,
            'X-Parse-REST-API-Key': 'rest',
          },
          method: 'POST',
          url: 'http://localhost:8378/1/functions/testFunction',
          body: JSON.stringify({}),
        }).catch(e => e);
        expect(response.status).toBe(403);
      });

      it(`rejects "${prop}" as application ID with arbitrary API key in cloud function call`, async () => {
        const response = await request({
          headers: {
            'Content-Type': 'application/json',
            'X-Parse-Application-Id': prop,
            'X-Parse-REST-API-Key': 'ANY_KEY',
          },
          method: 'POST',
          url: 'http://localhost:8378/1/functions/testFunction',
          body: JSON.stringify({}),
        }).catch(e => e);
        expect(response.status).toBe(403);
      });

      it(`rejects "${prop}" as application ID in class query`, async () => {
        const response = await request({
          headers: {
            'Content-Type': 'application/json',
            'X-Parse-Application-Id': prop,
            'X-Parse-REST-API-Key': 'rest',
          },
          method: 'GET',
          url: 'http://localhost:8378/1/classes/TestClass',
        }).catch(e => e);
        expect(response.status).toBe(403);
      });
    }
  });

  describe('Request denylist', () => {
    describe('(GHSA-q342-9w2p-57fp) Denylist bypass via sibling nested objects', () => {
      it('denies _bsontype:Code after a sibling nested object', async () => {
        const headers = {
          'Content-Type': 'application/json',
          'X-Parse-Application-Id': 'test',
          'X-Parse-REST-API-Key': 'rest',
        };
        const response = await request({
          headers,
          method: 'POST',
          url: 'http://localhost:8378/1/classes/Bypass',
          body: JSON.stringify({
            obj: {
              metadata: {},
              _bsontype: 'Code',
              code: 'malicious',
            },
          }),
        }).catch(e => e);
        expect(response.status).toBe(400);
        const text = JSON.parse(response.text);
        expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
        expect(text.error).toBe(
          'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
        );
      });

      it('denies _bsontype:Code after a sibling nested array', async () => {
        const headers = {
          'Content-Type': 'application/json',
          'X-Parse-Application-Id': 'test',
          'X-Parse-REST-API-Key': 'rest',
        };
        const response = await request({
          headers,
          method: 'POST',
          url: 'http://localhost:8378/1/classes/Bypass',
          body: JSON.stringify({
            obj: {
              tags: ['safe'],
              _bsontype: 'Code',
              code: 'malicious',
            },
          }),
        }).catch(e => e);
        expect(response.status).toBe(400);
        const text = JSON.parse(response.text);
        expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
        expect(text.error).toBe(
          'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
        );
      });

      it('denies __proto__ after a sibling nested object', async () => {
        // Cannot test via HTTP because deepcopy() strips __proto__ before the denylist
        // check runs. Test objectContainsKeyValue directly with a JSON.parse'd object
        // that preserves __proto__ as an own property.
        const Utils = require('../lib/Utils');
        const data = JSON.parse('{"profile": {"name": "alice"}, "__proto__": {"isAdmin": true}}');
        expect(Utils.objectContainsKeyValue(data, '__proto__', undefined)).toBe(true);
      });

      it('denies constructor after a sibling nested object', async () => {
        const headers = {
          'Content-Type': 'application/json',
          'X-Parse-Application-Id': 'test',
          'X-Parse-REST-API-Key': 'rest',
        };
        const response = await request({
          headers,
          method: 'POST',
          url: 'http://localhost:8378/1/classes/Bypass',
          body: JSON.stringify({
            obj: {
              data: {},
              constructor: { prototype: { polluted: true } },
            },
          }),
        }).catch(e => e);
        expect(response.status).toBe(400);
        const text = JSON.parse(response.text);
        expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
        expect(text.error).toBe(
          'Prohibited keyword in request data: {"key":"constructor"}.'
        );
      });

      it('denies _bsontype:Code nested inside a second sibling object', async () => {
        const headers = {
          'Content-Type': 'application/json',
          'X-Parse-Application-Id': 'test',
          'X-Parse-REST-API-Key': 'rest',
        };
        const response = await request({
          headers,
          method: 'POST',
          url: 'http://localhost:8378/1/classes/Bypass',
          body: JSON.stringify({
            field1: { safe: true },
            field2: { _bsontype: 'Code', code: 'malicious' },
          }),
        }).catch(e => e);
        expect(response.status).toBe(400);
        const text = JSON.parse(response.text);
        expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
        expect(text.error).toBe(
          'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
        );
      });

      it('handles circular references without infinite loop', () => {
        const Utils = require('../lib/Utils');
        const obj = { name: 'test', nested: { value: 1 } };
        obj.nested.self = obj;
        expect(Utils.objectContainsKeyValue(obj, 'nonexistent', undefined)).toBe(false);
      });

      it('denies _bsontype:Code in file metadata after a sibling nested object', async () => {
        const str = 'Hello World!';
        const data = [];
        for (let i = 0; i < str.length; i++) {
          data.push(str.charCodeAt(i));
        }
        const file = new Parse.File('hello.txt', data, 'text/plain');
        file.addMetadata('nested', { safe: true });
        file.addMetadata('_bsontype', 'Code');
        file.addMetadata('code', 'malicious');
        await expectAsync(file.save()).toBeRejectedWith(
          new Parse.Error(
            Parse.Error.INVALID_KEY_NAME,
            'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
          )
        );
      });
    });

    it('denies BSON type code data in write request by default', async () => {
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const params = {
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/RCE',
        body: JSON.stringify({
          obj: {
            _bsontype: 'Code',
            code: 'delete Object.prototype.evalFunctions',
          },
        }),
      };
      const response = await request(params).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe(
        'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
      );
    });

    it('denies expanding existing object with polluted keys', async () => {
      const obj = await new Parse.Object('RCE', { a: { foo: [] } }).save();
      await reconfigureServer({
        requestKeywordDenylist: ['foo'],
      });
      obj.addUnique('a.foo', 'abc');
      await expectAsync(obj.save()).toBeRejectedWith(
        new Parse.Error(Parse.Error.INVALID_KEY_NAME, `Prohibited keyword in request data: "foo".`)
      );
    });

    it('denies creating a cloud trigger with polluted data', async () => {
      Parse.Cloud.beforeSave('TestObject', ({ object }) => {
        object.set('obj', {
          constructor: {
            prototype: {
              dummy: 0,
            },
          },
        });
      });
      // The new Parse SDK handles prototype pollution prevention in .set()
      // so no error is thrown, but the object prototype should not be polluted
      await new Parse.Object('TestObject').save();
      expect(Object.prototype.dummy).toBeUndefined();
    });

    it('denies creating global config with polluted data', async () => {
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-Master-Key': 'test',
      };
      const params = {
        method: 'PUT',
        url: 'http://localhost:8378/1/config',
        json: true,
        body: {
          params: {
            welcomeMesssage: 'Welcome to Parse',
            foo: { _bsontype: 'Code', code: 'shell' },
          },
        },
        headers,
      };
      const response = await request(params).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe(
        'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
      );
    });

    it('denies direct database write wih prohibited keys', async () => {
      const Config = require('../lib/Config');
      const config = Config.get(Parse.applicationId);
      const user = {
        objectId: '1234567890',
        username: 'hello',
        password: 'pass',
        _session_token: 'abc',
        foo: { _bsontype: 'Code', code: 'shell' },
      };
      await expectAsync(config.database.create('_User', user)).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.INVALID_KEY_NAME,
          'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
        )
      );
    });

    it('denies direct database update wih prohibited keys', async () => {
      const Config = require('../lib/Config');
      const config = Config.get(Parse.applicationId);
      const user = {
        objectId: '1234567890',
        username: 'hello',
        password: 'pass',
        _session_token: 'abc',
        foo: { _bsontype: 'Code', code: 'shell' },
      };
      await expectAsync(
        config.database.update('_User', { _id: user.objectId }, user)
      ).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.INVALID_KEY_NAME,
          'Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.'
        )
      );
    });

    it_id('e8b5f1e1-8326-4c70-b5f4-1e8678dfff8d')(it)('denies creating a hook with polluted data', async () => {
      const express = require('express');
      const port = 34567;
      const hookServerURL = 'http://localhost:' + port;
      const app = express();
      app.use(express.json({ type: '*/*' }));
      const server = await new Promise(resolve => {
        const res = app.listen(port, undefined, () => resolve(res));
      });
      app.post('/BeforeSave', function (req, res) {
        const object = Parse.Object.fromJSON(req.body.object);
        object.set('hello', 'world');
        object.set('obj', {
          constructor: {
            prototype: {
              dummy: 0,
            },
          },
        });
        res.json({ success: object });
      });
      await Parse.Hooks.createTrigger('TestObject', 'beforeSave', hookServerURL + '/BeforeSave');
      // The new Parse SDK handles prototype pollution prevention in .set()
      // so no error is thrown, but the object prototype should not be polluted
      await new Parse.Object('TestObject').save();
      expect(Object.prototype.dummy).toBeUndefined();
      await new Promise(resolve => server.close(resolve));
    });

    it('denies write request with custom denylist of key/value', async () => {
      await reconfigureServer({
        requestKeywordDenylist: [{ key: 'a[K]ey', value: 'aValue[123]*' }],
      });
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const params = {
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/RCE',
        body: JSON.stringify({
          obj: {
            aKey: 'aValue321',
            code: 'delete Object.prototype.evalFunctions',
          },
        }),
      };
      const response = await request(params).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe(
        'Prohibited keyword in request data: {"key":"a[K]ey","value":"aValue[123]*"}.'
      );
    });

    it('denies write request with custom denylist of nested key/value', async () => {
      await reconfigureServer({
        requestKeywordDenylist: [{ key: 'a[K]ey', value: 'aValue[123]*' }],
      });
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const params = {
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/RCE',
        body: JSON.stringify({
          obj: {
            nested: {
              aKey: 'aValue321',
              code: 'delete Object.prototype.evalFunctions',
            },
          },
        }),
      };
      const response = await request(params).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe(
        'Prohibited keyword in request data: {"key":"a[K]ey","value":"aValue[123]*"}.'
      );
    });

    it('denies write request with custom denylist of key/value in array', async () => {
      await reconfigureServer({
        requestKeywordDenylist: [{ key: 'a[K]ey', value: 'aValue[123]*' }],
      });
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const params = {
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/RCE',
        body: JSON.stringify({
          obj: [
            {
              aKey: 'aValue321',
              code: 'delete Object.prototype.evalFunctions',
            },
          ],
        }),
      };
      const response = await request(params).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe(
        'Prohibited keyword in request data: {"key":"a[K]ey","value":"aValue[123]*"}.'
      );
    });

    it('denies write request with custom denylist of key', async () => {
      await reconfigureServer({
        requestKeywordDenylist: [{ key: 'a[K]ey' }],
      });
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const params = {
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/RCE',
        body: JSON.stringify({
          obj: {
            aKey: 'aValue321',
            code: 'delete Object.prototype.evalFunctions',
          },
        }),
      };
      const response = await request(params).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe('Prohibited keyword in request data: {"key":"a[K]ey"}.');
    });

    it('denies write request with custom denylist of value', async () => {
      await reconfigureServer({
        requestKeywordDenylist: [{ value: 'aValue[123]*' }],
      });
      const headers = {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      };
      const params = {
        headers: headers,
        method: 'POST',
        url: 'http://localhost:8378/1/classes/RCE',
        body: JSON.stringify({
          obj: {
            aKey: 'aValue321',
            code: 'delete Object.prototype.evalFunctions',
          },
        }),
      };
      const response = await request(params).catch(e => e);
      expect(response.status).toBe(400);
      const text = JSON.parse(response.text);
      expect(text.code).toBe(Parse.Error.INVALID_KEY_NAME);
      expect(text.error).toBe('Prohibited keyword in request data: {"value":"aValue[123]*"}.');
    });

    it('denies BSON type code data in file metadata', async () => {
      const str = 'Hello World!';
      const data = [];
      for (let i = 0; i < str.length; i++) {
        data.push(str.charCodeAt(i));
      }
      const file = new Parse.File('hello.txt', data, 'text/plain');
      file.addMetadata('obj', {
        _bsontype: 'Code',
        code: 'delete Object.prototype.evalFunctions',
      });
      await expectAsync(file.save()).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.INVALID_KEY_NAME,
          `Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.`
        )
      );
    });

    it('denies BSON type code data in file tags', async () => {
      const str = 'Hello World!';
      const data = [];
      for (let i = 0; i < str.length; i++) {
        data.push(str.charCodeAt(i));
      }
      const file = new Parse.File('hello.txt', data, 'text/plain');
      file.addTag('obj', {
        _bsontype: 'Code',
        code: 'delete Object.prototype.evalFunctions',
      });
      await expectAsync(file.save()).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.INVALID_KEY_NAME,
          `Prohibited keyword in request data: {"key":"_bsontype","value":"Code"}.`
        )
      );
    });
  });

  describe('Ignore non-matches', () => {
    it('ignores write request that contains only fraction of denied keyword', async () => {
      await reconfigureServer({
        requestKeywordDenylist: [{ key: 'abc' }],
      });
      // Initially saving an object executes the keyword detection in RestWrite.js
      const obj = new TestObject({ a: { b: { c: 0 } } });
      await expectAsync(obj.save()).toBeResolved();
      // Modifying a nested key executes the keyword detection in DatabaseController.js
      obj.increment('a.b.c');
      await expectAsync(obj.save()).toBeResolved();
    });
  });
});

describe('Malformed $regex information disclosure', () => {
  it('should not leak database error internals for invalid regex pattern in class query', async () => {
    const logger = require('../lib/logger').default;
    const loggerErrorSpy = spyOn(logger, 'error').and.callThrough();
    const obj = new Parse.Object('TestObject');
    await obj.save({ field: 'value' });

    try {
      await request({
        method: 'GET',
        url: `http://localhost:8378/1/classes/TestObject`,
        headers: {
          'Content-Type': 'application/json',
          'X-Parse-Application-Id': 'test',
          'X-Parse-REST-API-Key': 'rest',
        },
        qs: {
          where: JSON.stringify({ field: { $regex: '[abc' } }),
        },
      });
      fail('Request should have failed');
    } catch (e) {
      expect(e.data.code).toBe(Parse.Error.INTERNAL_SERVER_ERROR);
      expect(e.data.error).toBe('An internal server error occurred');
      expect(typeof e.data.error).toBe('string');
      expect(JSON.stringify(e.data)).not.toContain('errmsg');
      expect(JSON.stringify(e.data)).not.toContain('codeName');
      expect(JSON.stringify(e.data)).not.toContain('errorResponse');
      expect(loggerErrorSpy).toHaveBeenCalledWith(
        'Sanitized error:',
        jasmine.stringMatching(/[Rr]egular expression/i)
      );
    }
  });

  it('should not leak database error internals for invalid regex pattern in role query', async () => {
    const logger = require('../lib/logger').default;
    const loggerErrorSpy = spyOn(logger, 'error').and.callThrough();
    const role = new Parse.Role('testrole', new Parse.ACL());
    await role.save(null, { useMasterKey: true });
    try {
      await request({
        method: 'GET',
        url: `http://localhost:8378/1/roles`,
        headers: {
          'Content-Type': 'application/json',
          'X-Parse-Application-Id': 'test',
          'X-Parse-REST-API-Key': 'rest',
        },
        qs: {
          where: JSON.stringify({ name: { $regex: '[abc' } }),
        },
      });
      fail('Request should have failed');
    } catch (e) {
      expect(e.data.code).toBe(Parse.Error.INTERNAL_SERVER_ERROR);
      expect(e.data.error).toBe('An internal server error occurred');
      expect(typeof e.data.error).toBe('string');
      expect(JSON.stringify(e.data)).not.toContain('errmsg');
      expect(JSON.stringify(e.data)).not.toContain('codeName');
      expect(JSON.stringify(e.data)).not.toContain('errorResponse');
      expect(loggerErrorSpy).toHaveBeenCalledWith(
        'Sanitized error:',
        jasmine.stringMatching(/[Rr]egular expression/i)
      );
    }
  });
});

describe('Postgres regex sanitizater', () => {
  it('sanitizes the regex correctly to prevent Injection', async () => {
    const user = new Parse.User();
    user.set('username', 'username');
    user.set('password', 'password');
    user.set('email', 'email@example.com');
    await user.signUp();

    const response = await request({
      method: 'GET',
      url:
        "http://localhost:8378/1/classes/_User?where[username][$regex]=A'B'%3BSELECT+PG_SLEEP(3)%3B--",
      headers: {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      },
    });

    expect(response.status).toBe(200);
    expect(response.data.results).toEqual(jasmine.any(Array));
    expect(response.data.results.length).toBe(0);
  });
});

describe('(GHSA-mf3j-86qx-cq5j) ReDoS via $regex in LiveQuery subscription', () => {
  it('does not block event loop with catastrophic backtracking regex in LiveQuery', async () => {
    await reconfigureServer({
      liveQuery: { classNames: ['TestObject'] },
      startLiveQueryServer: true,
    });
    const client = new Parse.LiveQueryClient({
      applicationId: 'test',
      serverURL: 'ws://localhost:1337',
      javascriptKey: 'test',
    });
    client.open();
    const query = new Parse.Query('TestObject');
    // Set a catastrophic backtracking regex pattern directly
    query._addCondition('field', '$regex', '(a+)+b');
    const subscription = await client.subscribe(query);
    // Create an object that would trigger regex evaluation
    const obj = new Parse.Object('TestObject');
    // With 30 'a's followed by 'c', an unprotected regex would hang for seconds
    obj.set('field', 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaac');
    // Set a timeout to detect if the event loop is blocked
    const timeout = 5000;
    const start = Date.now();
    const savePromise = obj.save();
    const eventPromise = new Promise(resolve => {
      subscription.on('create', () => resolve('matched'));
      setTimeout(() => resolve('timeout'), timeout);
    });
    await savePromise;
    const result = await eventPromise;
    const elapsed = Date.now() - start;
    // The regex should be rejected (not match), and the operation should complete quickly
    expect(result).toBe('timeout');
    expect(elapsed).toBeLessThan(timeout + 1000);
    client.close();
  });
});

describe('(GHSA-qpr4-jrj4-6f27) SQL Injection via sort dot-notation field name', () => {
  const headers = {
    'Content-Type': 'application/json',
    'X-Parse-Application-Id': 'test',
    'X-Parse-REST-API-Key': 'rest',
  };

  it_only_db('postgres')('does not execute injected SQL via sort order dot-notation', async () => {
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { key: 'value' });
    obj.set('name', 'original');
    await obj.save();

    // This payload would execute a stacked query if single quotes are not escaped
    await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: "data.x' ASC; UPDATE \"InjectionTest\" SET name = 'hacked' WHERE true--",
      },
    }).catch(() => {});

    // Verify the data was not modified by injected SQL
    const verify = await new Parse.Query('InjectionTest').get(obj.id);
    expect(verify.get('name')).toBe('original');
  });

  it_only_db('postgres')('does not execute injected SQL via sort order with pg_sleep', async () => {
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { key: 'value' });
    await obj.save();

    const start = Date.now();
    await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: "data.x' ASC; SELECT pg_sleep(3)--",
      },
    }).catch(() => {});
    const elapsed = Date.now() - start;

    // If injection succeeded, query would take >= 3 seconds
    expect(elapsed).toBeLessThan(3000);
  });

  it_only_db('postgres')('does not execute injection via dollar-sign quoting bypass', async () => {
    // PostgreSQL supports $$string$$ as alternative to 'string'
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { key: 'value' });
    obj.set('name', 'original');
    await obj.save();

    await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: "data.x' ASC; UPDATE \"InjectionTest\" SET name = $$hacked$$ WHERE true--",
      },
    }).catch(() => {});

    const verify = await new Parse.Query('InjectionTest').get(obj.id);
    expect(verify.get('name')).toBe('original');
  });

  it_only_db('postgres')('does not execute injection via tagged dollar quoting bypass', async () => {
    // PostgreSQL supports $tag$string$tag$ as alternative to 'string'
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { key: 'value' });
    obj.set('name', 'original');
    await obj.save();

    await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: "data.x' ASC; UPDATE \"InjectionTest\" SET name = $t$hacked$t$ WHERE true--",
      },
    }).catch(() => {});

    const verify = await new Parse.Query('InjectionTest').get(obj.id);
    expect(verify.get('name')).toBe('original');
  });

  it_only_db('postgres')('does not execute injection via CHR() concatenation bypass', async () => {
    // CHR(104)||CHR(97)||... builds 'hacked' without quotes
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { key: 'value' });
    obj.set('name', 'original');
    await obj.save();

    await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: "data.x' ASC; UPDATE \"InjectionTest\" SET name = CHR(104)||CHR(97)||CHR(99)||CHR(107) WHERE true--",
      },
    }).catch(() => {});

    const verify = await new Parse.Query('InjectionTest').get(obj.id);
    expect(verify.get('name')).toBe('original');
  });

  it_only_db('postgres')('does not execute injection via backslash escape bypass', async () => {
    // Backslash before quote could interact with '' escaping in some configurations
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { key: 'value' });
    obj.set('name', 'original');
    await obj.save();

    await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: "data.x\\' ASC; UPDATE \"InjectionTest\" SET name = 'hacked' WHERE true--",
      },
    }).catch(() => {});

    const verify = await new Parse.Query('InjectionTest').get(obj.id);
    expect(verify.get('name')).toBe('original');
  });

  it('allows valid dot-notation sort on object field', async () => {
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { key: 'value' });
    await obj.save();

    const response = await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: 'data.key',
      },
    });
    expect(response.status).toBe(200);
  });

  it('allows valid dot-notation with special characters in sub-field', async () => {
    const obj = new Parse.Object('InjectionTest');
    obj.set('data', { 'my-field': 'value' });
    await obj.save();

    const response = await request({
      method: 'GET',
      url: 'http://localhost:8378/1/classes/InjectionTest',
      headers,
      qs: {
        order: 'data.my-field',
      },
    });
    expect(response.status).toBe(200);
  });
});

describe('(GHSA-v5hf-f4c3-m5rv) Stored XSS via .svgz, .xht, .xml, .xsl, .xslt file upload', () => {
  const headers = {
    'X-Parse-Application-Id': 'test',
    'X-Parse-REST-API-Key': 'rest',
  };

  beforeEach(async () => {
    await reconfigureServer({
      fileUpload: {
        enableForPublic: true,
      },
    });
  });

  it('blocks .svgz file upload by default', async () => {
    const svgContent = Buffer.from(
      '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>'
    ).toString('base64');
    for (const extension of ['svgz', 'SVGZ', 'Svgz']) {
      await expectAsync(
        request({
          method: 'POST',
          headers,
          url: `http://localhost:8378/1/files/malicious.${extension}`,
          body: JSON.stringify({
            _ApplicationId: 'test',
            _JavaScriptKey: 'test',
            _ContentType: 'image/svg+xml',
            base64: svgContent,
          }),
        }).catch(e => {
          throw new Error(e.data.error);
        })
      ).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.FILE_SAVE_ERROR,
          `File upload of extension ${extension} is disabled.`
        )
      );
    }
  });

  it('blocks .xht file upload by default', async () => {
    const xhtContent = Buffer.from(
      '<?xml version="1.0"?><html xmlns="http://www.w3.org/1999/xhtml"><body><script>alert(1)</script></body></html>'
    ).toString('base64');
    for (const extension of ['xht', 'XHT', 'Xht']) {
      await expectAsync(
        request({
          method: 'POST',
          headers,
          url: `http://localhost:8378/1/files/malicious.${extension}`,
          body: JSON.stringify({
            _ApplicationId: 'test',
            _JavaScriptKey: 'test',
            _ContentType: 'application/xhtml+xml',
            base64: xhtContent,
          }),
        }).catch(e => {
          throw new Error(e.data.error);
        })
      ).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.FILE_SAVE_ERROR,
          `File upload of extension ${extension} is disabled.`
        )
      );
    }
  });

  it('blocks .xml file upload by default', async () => {
    const xmlContent = Buffer.from(
      '<?xml version="1.0"?><root><data>test</data></root>'
    ).toString('base64');
    for (const extension of ['xml', 'XML', 'Xml']) {
      await expectAsync(
        request({
          method: 'POST',
          headers,
          url: `http://localhost:8378/1/files/malicious.${extension}`,
          body: JSON.stringify({
            _ApplicationId: 'test',
            _JavaScriptKey: 'test',
            _ContentType: 'application/xml',
            base64: xmlContent,
          }),
        }).catch(e => {
          throw new Error(e.data.error);
        })
      ).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.FILE_SAVE_ERROR,
          `File upload of extension ${extension} is disabled.`
        )
      );
    }
  });

  it('blocks .xsl file upload by default', async () => {
    const xslContent = Buffer.from(
      '<?xml version="1.0"?><xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"></xsl:stylesheet>'
    ).toString('base64');
    for (const extension of ['xsl', 'XSL', 'Xsl']) {
      await expectAsync(
        request({
          method: 'POST',
          headers,
          url: `http://localhost:8378/1/files/malicious.${extension}`,
          body: JSON.stringify({
            _ApplicationId: 'test',
            _JavaScriptKey: 'test',
            _ContentType: 'application/xml',
            base64: xslContent,
          }),
        }).catch(e => {
          throw new Error(e.data.error);
        })
      ).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.FILE_SAVE_ERROR,
          `File upload of extension ${extension} is disabled.`
        )
      );
    }
  });

  it('blocks .xslt file upload by default', async () => {
    const xsltContent = Buffer.from(
      '<?xml version="1.0"?><xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"></xsl:stylesheet>'
    ).toString('base64');
    for (const extension of ['xslt', 'XSLT', 'Xslt']) {
      await expectAsync(
        request({
          method: 'POST',
          headers,
          url: `http://localhost:8378/1/files/malicious.${extension}`,
          body: JSON.stringify({
            _ApplicationId: 'test',
            _JavaScriptKey: 'test',
            _ContentType: 'application/xslt+xml',
            base64: xsltContent,
          }),
        }).catch(e => {
          throw new Error(e.data.error);
        })
      ).toBeRejectedWith(
        new Parse.Error(
          Parse.Error.FILE_SAVE_ERROR,
          `File upload of extension ${extension} is disabled.`
        )
      );
    }
  });

  // Headers are intentionally omitted below so that the middleware parses _ContentType
  // from the JSON body and sets it as the content-type header. When X-Parse-Application-Id
  // is sent as a header, the middleware skips body parsing and _ContentType is ignored.
  it('blocks extensionless upload with application/xhtml+xml content type', async () => {
    const xhtContent = Buffer.from(
      '<?xml version="1.0"?><html xmlns="http://www.w3.org/1999/xhtml"><body><script>alert(1)</script></body></html>'
    ).toString('base64');
    await expectAsync(
      request({
        method: 'POST',
        url: 'http://localhost:8378/1/files/payload',
        body: JSON.stringify({
          _ApplicationId: 'test',
          _JavaScriptKey: 'test',
          _ContentType: 'application/xhtml+xml',
          base64: xhtContent,
        }),
      }).catch(e => {
        throw new Error(e.data.error);
      })
    ).toBeRejectedWith(
      new Parse.Error(
        Parse.Error.FILE_SAVE_ERROR,
        'File upload of extension xhtml+xml is disabled.'
      )
    );
  });

  it('blocks extensionless upload with application/xslt+xml content type', async () => {
    const xsltContent = Buffer.from(
      '<?xml version="1.0"?><xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"></xsl:stylesheet>'
    ).toString('base64');
    await expectAsync(
      request({
        method: 'POST',
        url: 'http://localhost:8378/1/files/payload',
        body: JSON.stringify({
          _ApplicationId: 'test',
          _JavaScriptKey: 'test',
          _ContentType: 'application/xslt+xml',
          base64: xsltContent,
        }),
      }).catch(e => {
        throw new Error(e.data.error);
      })
    ).toBeRejectedWith(
      new Parse.Error(
        Parse.Error.FILE_SAVE_ERROR,
        'File upload of extension xslt+xml is disabled.'
      )
    );
  });

  it('still allows common file types', async () => {
    for (const type of ['txt', 'png', 'jpg', 'gif', 'pdf', 'doc']) {
      const file = new Parse.File(`file.${type}`, { base64: 'ParseA==' });
      await file.save();
    }
  });
});

describe('(GHSA-42ph-pf9q-cr72) Stored XSS filter bypass via parameterized Content-Type and additional XML extensions', () => {
  const headers = {
    'X-Parse-Application-Id': 'test',
    'X-Parse-REST-API-Key': 'rest',
  };

  beforeEach(async () => {
    await reconfigureServer({
      fileUpload: {
        enableForPublic: true,
      },
    });
  });

  for (const { ext, contentType } of [
    { ext: 'xsd', contentType: 'application/xml' },
    { ext: 'rng', contentType: 'application/xml' },
    { ext: 'rdf', contentType: 'application/rdf+xml' },
    { ext: 'owl', contentType: 'application/rdf+xml' },
    { ext: 'mathml', contentType: 'application/mathml+xml' },
  ]) {
    it(`blocks .${ext} file upload by default`, async () => {
      const content = Buffer.from(
        '<?xml version="1.0"?><html xmlns="http://www.w3.org/1999/xhtml"><body><script>alert(1)</script></body></html>'
      ).toString('base64');
      for (const extension of [ext, ext.toUpperCase(), ext[0].toUpperCase() + ext.slice(1)]) {
        await expectAsync(
          request({
            method: 'POST',
            headers,
            url: `http://localhost:8378/1/files/malicious.${extension}`,
            body: JSON.stringify({
              _ApplicationId: 'test',
              _JavaScriptKey: 'test',
              _ContentType: contentType,
              base64: content,
            }),
          }).catch(e => {
            throw new Error(e.data.error);
          })
        ).toBeRejectedWith(
          new Parse.Error(
            Parse.Error.FILE_SAVE_ERROR,
            `File upload of extension ${extension} is disabled.`
          )
        );
      }
    });
  }

  it('blocks extensionless upload with parameterized Content-Type that bypasses regex', async () => {
    const content = Buffer.from(
      '<?xml version="1.0"?><html xmlns="http://www.w3.org/1999/xhtml"><body><script>alert(1)</script></body></html>'
    ).toString('base64');
    // MIME parameters like ;charset=utf-8 should not bypass the extension filter
    const dangerousContentTypes = [
      'application/xhtml+xml;charset=utf-8',
      'application/xhtml+xml; charset=utf-8',
      'application/xhtml+xml\t;charset=utf-8',
      'image/svg+xml;charset=utf-8',
      'application/xml;charset=utf-8',
      'text/html;charset=utf-8',
      'application/xslt+xml;charset=utf-8',
      'application/rdf+xml;charset=utf-8',
      'application/mathml+xml;charset=utf-8',
    ];
    for (const contentType of dangerousContentTypes) {
      await expectAsync(
        request({
          method: 'POST',
          url: 'http://localhost:8378/1/files/payload',
          body: JSON.stringify({
            _ApplicationId: 'test',
            _JavaScriptKey: 'test',
            _ContentType: contentType,
            base64: content,
          }),
        }).catch(e => {
          throw new Error(e.data.error);
        })
      ).toBeRejectedWith(jasmine.objectContaining({
        message: jasmine.stringMatching(/File upload of extension .+ is disabled/),
      }));
    }
  });
});

describe('(GHSA-3jmq-rrxf-gqrg) Stored XSS via file serving', () => {
  it('sets X-Content-Type-Options: nosniff on file GET response', async () => {
    const file = new Parse.File('hello.txt', [1, 2, 3], 'text/plain');
    await file.save({ useMasterKey: true });
    const response = await request({
      url: file.url(),
      headers: {
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      },
    });
    expect(response.headers['x-content-type-options']).toBe('nosniff');
  });

  it('sets X-Content-Type-Options: nosniff on streaming file GET response', async () => {
    const file = new Parse.File('hello.txt', [1, 2, 3], 'text/plain');
    await file.save({ useMasterKey: true });
    const response = await request({
      url: file.url(),
      headers: {
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
        'Range': 'bytes=0-2',
      },
    });
    expect(response.headers['x-content-type-options']).toBe('nosniff');
  });
});

describe('(GHSA-q3vj-96h2-gwvg) SQL Injection via Increment amount on nested Object field', () => {
  const headers = {
    'Content-Type': 'application/json',
    'X-Parse-Application-Id': 'test',
    'X-Parse-REST-API-Key': 'rest',
  };

  it('rejects non-number Increment amount on nested object field', async () => {
    const obj = new Parse.Object('IncrTest');
    obj.set('stats', { counter: 0 });
    await obj.save();

    const response = await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/IncrTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        'stats.counter': { __op: 'Increment', amount: '1' },
      }),
    }).catch(e => e);

    expect(response.status).toBe(400);
    const text = JSON.parse(response.text);
    expect(text.code).toBe(Parse.Error.INVALID_JSON);
  });

  it_only_db('postgres')('does not execute injected SQL via Increment amount with pg_sleep', async () => {
    const obj = new Parse.Object('IncrTest');
    obj.set('stats', { counter: 0 });
    await obj.save();

    const start = Date.now();
    await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/IncrTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        'stats.counter': { __op: 'Increment', amount: '0+(SELECT 1 FROM pg_sleep(3))' },
      }),
    }).catch(() => {});
    const elapsed = Date.now() - start;

    // If injection succeeded, query would take >= 3 seconds
    expect(elapsed).toBeLessThan(3000);
  });

  it_only_db('postgres')('does not execute injected SQL via Increment amount for data exfiltration', async () => {
    const obj = new Parse.Object('IncrTest');
    obj.set('stats', { counter: 0 });
    await obj.save();

    await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/IncrTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        'stats.counter': {
          __op: 'Increment',
          amount: '0+(SELECT ascii(substr(current_database(),1,1)))',
        },
      }),
    }).catch(() => {});

    // Verify counter was not modified by injected SQL
    const verify = await new Parse.Query('IncrTest').get(obj.id);
    expect(verify.get('stats').counter).toBe(0);
  });

  it('allows valid numeric Increment on nested object field', async () => {
    const obj = new Parse.Object('IncrTest');
    obj.set('stats', { counter: 5 });
    await obj.save();

    const response = await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/IncrTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        'stats.counter': { __op: 'Increment', amount: 3 },
      }),
    });

    expect(response.status).toBe(200);
    const verify = await new Parse.Query('IncrTest').get(obj.id);
    expect(verify.get('stats').counter).toBe(8);
  });
});

describe('(GHSA-gqpp-xgvh-9h7h) SQL Injection via dot-notation sub-key name in Increment operation', () => {
  const headers = {
    'Content-Type': 'application/json',
    'X-Parse-Application-Id': 'test',
    'X-Parse-REST-API-Key': 'rest',
  };

  it_only_db('postgres')('does not execute injected SQL via single quote in sub-key name', async () => {
    const obj = new Parse.Object('SubKeyTest');
    obj.set('stats', { counter: 0 });
    await obj.save();

    const start = Date.now();
    await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/SubKeyTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        "stats.x' || (SELECT pg_sleep(3))::text || '": { __op: 'Increment', amount: 1 },
      }),
    }).catch(() => {});
    const elapsed = Date.now() - start;

    // If injection succeeded, query would take >= 3 seconds
    expect(elapsed).toBeLessThan(3000);
    // The escaped payload becomes a harmless literal key; original data is untouched
    const verify = await new Parse.Query('SubKeyTest').get(obj.id);
    expect(verify.get('stats').counter).toBe(0);
  });

  it_only_db('postgres')('does not execute injected SQL via double quote in sub-key name', async () => {
    const obj = new Parse.Object('SubKeyTest');
    obj.set('stats', { counter: 0 });
    await obj.save();

    const start = Date.now();
    await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/SubKeyTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        'stats.x" || (SELECT pg_sleep(3))::text || "': { __op: 'Increment', amount: 1 },
      }),
    }).catch(() => {});
    const elapsed = Date.now() - start;

    // Double quotes break JSON structure inside the CONCAT, producing invalid JSONB.
    // This causes a database error, NOT SQL injection. If injection succeeded,
    // the query would take >= 3 seconds due to pg_sleep.
    expect(elapsed).toBeLessThan(3000);
    // Invalid JSONB cast fails the UPDATE, so the row is not modified
    const verify = await new Parse.Query('SubKeyTest').get(obj.id);
    expect(verify.get('stats')).toEqual({ counter: 0 });
  });

  it_only_db('postgres')('does not execute injected SQL via double quote crafted as valid JSONB in sub-key name', async () => {
    const obj = new Parse.Object('SubKeyTest');
    obj.set('stats', { counter: 0 });
    await obj.save();

    // This payload uses double quotes to craft a sub-key that produces valid JSONB
    // (e.g. '{"x":0,"evil":1}') instead of breaking JSON structure. Even so, both
    // interpolation sites are inside single-quoted SQL strings, so double quotes
    // cannot escape the SQL context — no arbitrary SQL execution is possible.
    const start = Date.now();
    await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/SubKeyTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        'stats.x":0,"pg_sleep(3)': { __op: 'Increment', amount: 1 },
      }),
    }).catch(() => {});
    const elapsed = Date.now() - start;

    expect(elapsed).toBeLessThan(3000);
    // Double quotes craft valid JSONB with extra keys, but no SQL injection occurs;
    // original counter is untouched
    const verify = await new Parse.Query('SubKeyTest').get(obj.id);
    expect(verify.get('stats').counter).toBe(0);
  });

  it_only_db('postgres')('allows valid Increment on nested object field with normal sub-key', async () => {
    const obj = new Parse.Object('SubKeyTest');
    obj.set('stats', { counter: 5 });
    await obj.save();

    const response = await request({
      method: 'PUT',
      url: `http://localhost:8378/1/classes/SubKeyTest/${obj.id}`,
      headers,
      body: JSON.stringify({
        'stats.counter': { __op: 'Increment', amount: 2 },
      }),
    });

    expect(response.status).toBe(200);
    const verify = await new Parse.Query('SubKeyTest').get(obj.id);
    expect(verify.get('stats').counter).toBe(7);
  });
});

describe('(GHSA-r2m8-pxm9-9c4g) Protected fields WHERE clause bypass via dot-notation on object-type fields', () => {
  let obj;

  beforeEach(async () => {
    const schema = new Parse.Schema('SecretClass');
    schema.addObject('secretObj');
    schema.addString('publicField');
    schema.setCLP({
      find: { '*': true },
      get: { '*': true },
      create: { '*': true },
      update: { '*': true },
      delete: { '*': true },
      addField: {},
      protectedFields: { '*': ['secretObj'] },
    });
    await schema.save();

    obj = new Parse.Object('SecretClass');
    obj.set('secretObj', { apiKey: 'SENSITIVE_KEY_123', score: 42 });
    obj.set('publicField', 'visible');
    await obj.save(null, { useMasterKey: true });
  });

  it('should deny query with dot-notation on protected field in where clause', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { where: JSON.stringify({ 'secretObj.apiKey': 'SENSITIVE_KEY_123' }) },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should deny query with dot-notation on protected field in $or', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: {
        where: JSON.stringify({
          $or: [{ 'secretObj.apiKey': 'SENSITIVE_KEY_123' }, { 'secretObj.apiKey': 'other' }],
        }),
      },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should deny query with dot-notation on protected field in $and', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: {
        where: JSON.stringify({
          $and: [{ 'secretObj.apiKey': 'SENSITIVE_KEY_123' }, { publicField: 'visible' }],
        }),
      },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should deny query with dot-notation on protected field in $nor', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: {
        where: JSON.stringify({
          $nor: [{ 'secretObj.apiKey': 'WRONG' }],
        }),
      },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should deny query with deeply nested dot-notation on protected field', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { where: JSON.stringify({ 'secretObj.nested.deep.key': 'value' }) },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should deny sort on protected field via dot-notation', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { order: 'secretObj.score' },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should deny sort on protected field directly', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { order: 'secretObj' },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should deny descending sort on protected field via dot-notation', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { order: '-secretObj.score' },
    }).catch(e => e);
    expect(res.data.code).toBe(Parse.Error.OPERATION_FORBIDDEN);
    expect(res.data.error).toBe('Permission denied');
  });

  it('should still allow queries on non-protected fields', async () => {
    const response = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { where: JSON.stringify({ publicField: 'visible' }) },
    });
    expect(response.data.results.length).toBe(1);
    expect(response.data.results[0].publicField).toBe('visible');
    expect(response.data.results[0].secretObj).toBeUndefined();
  });

  it('should still allow sort on non-protected fields', async () => {
    const response = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { order: 'publicField' },
    });
    expect(response.data.results.length).toBe(1);
  });

  it('should still allow master key to query protected fields with dot-notation', async () => {
    const response = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-Master-Key': Parse.masterKey,
      },
      qs: { where: JSON.stringify({ 'secretObj.apiKey': 'SENSITIVE_KEY_123' }) },
    });
    expect(response.data.results.length).toBe(1);
  });

  it('should still block direct query on protected field (existing behavior)', async () => {
    const res = await request({
      method: 'GET',
      url: `${Parse.serverURL}/classes/SecretClass`,
      headers: {
        'X-Parse-Application-Id': Parse.applicationId,
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: { where: JSON.stringify({ secretObj: { apiKey: 'SENSITIVE_KEY_123' } }) },
    }).catch(e => e);
    expect(res.status).toBe(400);
  });
});

describe('(GHSA-j7mm-f4rv-6q6q) Protected fields bypass via LiveQuery dot-notation WHERE', () => {
  let obj;

  beforeEach(async () => {
    Parse.CoreManager.getLiveQueryController().setDefaultLiveQueryClient(null);
    await reconfigureServer({
      liveQuery: { classNames: ['SecretClass'] },
      startLiveQueryServer: true,
      verbose: false,
      silent: true,
    });
    const config = Config.get(Parse.applicationId);
    const schemaController = await config.database.loadSchema();
    await schemaController.addClassIfNotExists(
      'SecretClass',
      { secretObj: { type: 'Object' }, publicField: { type: 'String' } },
    );
    await schemaController.updateClass(
      'SecretClass',
      {},
      {
        find: { '*': true },
        get: { '*': true },
        create: { '*': true },
        update: { '*': true },
        delete: { '*': true },
        addField: {},
        protectedFields: { '*': ['secretObj'] },
      }
    );

    obj = new Parse.Object('SecretClass');
    obj.set('secretObj', { apiKey: 'SENSITIVE_KEY_123', score: 42 });
    obj.set('publicField', 'visible');
    await obj.save(null, { useMasterKey: true });
  });

  afterEach(async () => {
    const client = await Parse.CoreManager.getLiveQueryController().getDefaultLiveQueryClient();
    if (client) {
      await client.close();
    }
  });

  it('should reject LiveQuery subscription with dot-notation on protected field in where clause', async () => {
    const query = new Parse.Query('SecretClass');
    query._addCondition('secretObj.apiKey', '$eq', 'SENSITIVE_KEY_123');
    await expectAsync(query.subscribe()).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should reject LiveQuery subscription with protected field directly in where clause', async () => {
    const query = new Parse.Query('SecretClass');
    query.exists('secretObj');
    await expectAsync(query.subscribe()).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should reject LiveQuery subscription with protected field in $or', async () => {
    const q1 = new Parse.Query('SecretClass');
    q1._addCondition('secretObj.apiKey', '$eq', 'SENSITIVE_KEY_123');
    const q2 = new Parse.Query('SecretClass');
    q2._addCondition('secretObj.apiKey', '$eq', 'other');
    const query = Parse.Query.or(q1, q2);
    await expectAsync(query.subscribe()).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should reject LiveQuery subscription with protected field in $and', async () => {
    // Build $and manually since Parse SDK doesn't expose it directly
    const query = new Parse.Query('SecretClass');
    query._where = { $and: [{ 'secretObj.apiKey': 'SENSITIVE_KEY_123' }, { publicField: 'visible' }] };
    await expectAsync(query.subscribe()).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should reject LiveQuery subscription with protected field in $nor', async () => {
    // Build $nor manually since Parse SDK doesn't expose it directly
    const query = new Parse.Query('SecretClass');
    query._where = { $nor: [{ 'secretObj.apiKey': 'SENSITIVE_KEY_123' }] };
    await expectAsync(query.subscribe()).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should reject LiveQuery subscription with $regex on protected field (boolean oracle)', async () => {
    const query = new Parse.Query('SecretClass');
    query._addCondition('secretObj.apiKey', '$regex', '^S');
    await expectAsync(query.subscribe()).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should reject LiveQuery subscription with deeply nested dot-notation on protected field', async () => {
    const query = new Parse.Query('SecretClass');
    query._addCondition('secretObj.nested.deep.key', '$eq', 'value');
    await expectAsync(query.subscribe()).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should allow LiveQuery subscription on non-protected fields and strip protected fields from response', async () => {
    const query = new Parse.Query('SecretClass');
    query.exists('publicField');
    const subscription = await query.subscribe();
    await Promise.all([
      new Promise(resolve => {
        subscription.on('update', object => {
          expect(object.get('secretObj')).toBeUndefined();
          expect(object.get('publicField')).toBe('updated');
          resolve();
        });
      }),
      obj.save({ publicField: 'updated' }, { useMasterKey: true }),
    ]);
  });

  it('should reject admin user querying protected field when both * and role protect it', async () => {
    // Common case: protectedFields has both '*' and 'role:admin' entries.
    // Even without resolving user roles, the '*' protection applies and blocks the query.
    // This validates that role-based exemptions are irrelevant when '*' covers the field.
    const config = Config.get(Parse.applicationId);
    const schemaController = await config.database.loadSchema();
    await schemaController.updateClass(
      'SecretClass',
      {},
      {
        find: { '*': true },
        get: { '*': true },
        create: { '*': true },
        update: { '*': true },
        delete: { '*': true },
        addField: {},
        protectedFields: { '*': ['secretObj'], 'role:admin': ['secretObj'] },
      }
    );

    const user = new Parse.User();
    user.setUsername('adminuser');
    user.setPassword('password');
    await user.signUp();

    const roleACL = new Parse.ACL();
    roleACL.setPublicReadAccess(true);
    const role = new Parse.Role('admin', roleACL);
    role.getUsers().add(user);
    await role.save(null, { useMasterKey: true });

    const query = new Parse.Query('SecretClass');
    query._addCondition('secretObj.apiKey', '$eq', 'SENSITIVE_KEY_123');
    await expectAsync(query.subscribe(user.getSessionToken())).toBeRejectedWith(
      new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Permission denied')
    );
  });

  it('should not reject when role-only protection exists without * entry', async () => {
    // Edge case: protectedFields only has a role entry, no '*'.
    // Without resolving roles, the protection set is empty, so the subscription is allowed.
    // This is a correctness gap, not a security issue: the role entry means "protect this
    // field FROM role members" (i.e. admins should not see it). Not resolving roles means
    // the admin loses their own restriction — they see data meant to be hidden from them.
    // This does not allow unprivileged users to access protected data.
    const config = Config.get(Parse.applicationId);
    const schemaController = await config.database.loadSchema();
    await schemaController.updateClass(
      'SecretClass',
      {},
      {
        find: { '*': true },
        get: { '*': true },
        create: { '*': true },
        update: { '*': true },
        delete: { '*': true },
        addField: {},
        protectedFields: { 'role:admin': ['secretObj'] },
      }
    );

    const user = new Parse.User();
    user.setUsername('adminuser2');
    user.setPassword('password');
    await user.signUp();

    const roleACL = new Parse.ACL();
    roleACL.setPublicReadAccess(true);
    const role = new Parse.Role('admin', roleACL);
    role.getUsers().add(user);
    await role.save(null, { useMasterKey: true });

    // This subscribes successfully because without '*' entry, no fields are protected
    // for purposes of WHERE clause validation. The role-only config means "hide secretObj
    // from admins" — a restriction ON the privileged user, not a security boundary.
    const query = new Parse.Query('SecretClass');
    query._addCondition('secretObj.apiKey', '$eq', 'SENSITIVE_KEY_123');
    const subscription = await query.subscribe(user.getSessionToken());
    expect(subscription).toBeDefined();
  });

  // Note: master key bypass is inherently tested by the `!client.hasMasterKey` guard
  // in the implementation. Testing master key LiveQuery requires configuring keyPairs
  // in the LiveQuery server config, which is not part of the default test setup.
});

describe('(GHSA-w54v-hf9p-8856) User enumeration via email verification endpoint', () => {
  let sendVerificationEmail;

  async function createTestUsers() {
    const user = new Parse.User();
    user.setUsername('testuser');
    user.setPassword('password123');
    user.set('email', 'unverified@example.com');
    await user.signUp();

    const user2 = new Parse.User();
    user2.setUsername('verifieduser');
    user2.setPassword('password123');
    user2.set('email', 'verified@example.com');
    await user2.signUp();
    const config = Config.get(Parse.applicationId);
    await config.database.update(
      '_User',
      { username: 'verifieduser' },
      { emailVerified: true }
    );
  }

  describe('default (emailVerifySuccessOnInvalidEmail: true)', () => {
    beforeEach(async () => {
      sendVerificationEmail = jasmine.createSpy('sendVerificationEmail');
      await reconfigureServer({
        appName: 'test',
        publicServerURL: 'http://localhost:8378/1',
        verifyUserEmails: true,
        emailAdapter: {
          sendVerificationEmail,
          sendPasswordResetEmail: () => Promise.resolve(),
          sendMail: () => {},
        },
      });
      await createTestUsers();
    });
    it('returns success for non-existent email', async () => {
      const response = await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'nonexistent@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      });
      expect(response.status).toBe(200);
      expect(response.data).toEqual({});
    });

    it('returns success for already verified email', async () => {
      const response = await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'verified@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      });
      expect(response.status).toBe(200);
      expect(response.data).toEqual({});
    });

    it('returns success for unverified email', async () => {
      sendVerificationEmail.calls.reset();
      const response = await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'unverified@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      });
      expect(response.status).toBe(200);
      expect(response.data).toEqual({});
      await jasmine.timeout();
      expect(sendVerificationEmail).toHaveBeenCalledTimes(1);
    });

    it('does not send verification email for non-existent email', async () => {
      sendVerificationEmail.calls.reset();
      await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'nonexistent@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      });
      expect(sendVerificationEmail).not.toHaveBeenCalled();
    });

    it('does not send verification email for already verified email', async () => {
      sendVerificationEmail.calls.reset();
      await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'verified@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      });
      expect(sendVerificationEmail).not.toHaveBeenCalled();
    });
  });

  describe('opt-out (emailVerifySuccessOnInvalidEmail: false)', () => {
    beforeEach(async () => {
      sendVerificationEmail = jasmine.createSpy('sendVerificationEmail');
      await reconfigureServer({
        appName: 'test',
        publicServerURL: 'http://localhost:8378/1',
        verifyUserEmails: true,
        emailVerifySuccessOnInvalidEmail: false,
        emailAdapter: {
          sendVerificationEmail,
          sendPasswordResetEmail: () => Promise.resolve(),
          sendMail: () => {},
        },
      });
      await createTestUsers();
    });

    it('returns error for non-existent email', async () => {
      const response = await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'nonexistent@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      }).catch(e => e);
      expect(response.data.code).toBe(Parse.Error.EMAIL_NOT_FOUND);
    });

    it('returns error for already verified email', async () => {
      const response = await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'verified@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      }).catch(e => e);
      expect(response.data.code).toBe(Parse.Error.OTHER_CAUSE);
      expect(response.data.error).toBe('Email verified@example.com is already verified.');
    });

    it('sends verification email for unverified email', async () => {
      sendVerificationEmail.calls.reset();
      await request({
        url: 'http://localhost:8378/1/verificationEmailRequest',
        method: 'POST',
        body: { email: 'unverified@example.com' },
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-REST-API-Key': 'rest',
          'Content-Type': 'application/json',
        },
      });
      await jasmine.timeout();
      expect(sendVerificationEmail).toHaveBeenCalledTimes(1);
    });
  });

  it('rejects invalid emailVerifySuccessOnInvalidEmail values', async () => {
    const invalidValues = [[], {}, 0, 1, '', 'string'];
    for (const value of invalidValues) {
      await expectAsync(
        reconfigureServer({
          appName: 'test',
          publicServerURL: 'http://localhost:8378/1',
          verifyUserEmails: true,
          emailVerifySuccessOnInvalidEmail: value,
          emailAdapter: {
            sendVerificationEmail: () => {},
            sendPasswordResetEmail: () => Promise.resolve(),
            sendMail: () => {},
          },
        })
      ).toBeRejectedWith('emailVerifySuccessOnInvalidEmail must be a boolean value');
    }
  });
});

describe('(GHSA-c442-97qw-j6c6) SQL Injection via $regex query operator field name in PostgreSQL adapter', () => {
  const headers = {
    'Content-Type': 'application/json',
    'X-Parse-Application-Id': 'test',
    'X-Parse-REST-API-Key': 'rest',
    'X-Parse-Master-Key': 'test',
  };
  const serverURL = 'http://localhost:8378/1';

  beforeEach(async () => {
    const obj = new Parse.Object('TestClass');
    obj.set('playerName', 'Alice');
    obj.set('score', 100);
    await obj.save(null, { useMasterKey: true });
  });

  it('rejects field names containing double quotes in $regex query with master key', async () => {
    const maliciousField = 'playerName" OR 1=1 --';
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers,
      qs: {
        where: JSON.stringify({
          [maliciousField]: { $regex: 'x' },
        }),
      },
    }).catch(e => e);
    expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
  });

  it('rejects field names containing single quotes in $regex query with master key', async () => {
    const maliciousField = "playerName' OR '1'='1";
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers,
      qs: {
        where: JSON.stringify({
          [maliciousField]: { $regex: 'x' },
        }),
      },
    }).catch(e => e);
    expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
  });

  it('rejects field names containing semicolons in $regex query with master key', async () => {
    const maliciousField = 'playerName; DROP TABLE "TestClass" --';
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers,
      qs: {
        where: JSON.stringify({
          [maliciousField]: { $regex: 'x' },
        }),
      },
    }).catch(e => e);
    expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
  });

  it('rejects field names containing parentheses in $regex query with master key', async () => {
    const maliciousField = 'playerName" ~ \'x\' OR (SELECT 1) --';
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers,
      qs: {
        where: JSON.stringify({
          [maliciousField]: { $regex: 'x' },
        }),
      },
    }).catch(e => e);
    expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
  });

  it('allows legitimate $regex query with master key', async () => {
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers,
      qs: {
        where: JSON.stringify({
          playerName: { $regex: 'Ali' },
        }),
      },
    });
    expect(response.data.results.length).toBe(1);
    expect(response.data.results[0].playerName).toBe('Alice');
  });

  it('allows legitimate $regex query with dot notation and master key', async () => {
    const obj = new Parse.Object('TestClass');
    obj.set('metadata', { tag: 'hello-world' });
    await obj.save(null, { useMasterKey: true });
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers,
      qs: {
        where: JSON.stringify({
          'metadata.tag': { $regex: 'hello' },
        }),
      },
    });
    expect(response.data.results.length).toBe(1);
    expect(response.data.results[0].metadata.tag).toBe('hello-world');
  });

  it('allows legitimate $regex query without master key', async () => {
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers: {
        'Content-Type': 'application/json',
        'X-Parse-Application-Id': 'test',
        'X-Parse-REST-API-Key': 'rest',
      },
      qs: {
        where: JSON.stringify({
          playerName: { $regex: 'Ali' },
        }),
      },
    });
    expect(response.data.results.length).toBe(1);
    expect(response.data.results[0].playerName).toBe('Alice');
  });

  it('rejects field names with SQL injection via non-$regex operators with master key', async () => {
    const maliciousField = 'playerName" OR 1=1 --';
    const response = await request({
      method: 'GET',
      url: `${serverURL}/classes/TestClass`,
      headers,
      qs: {
        where: JSON.stringify({
          [maliciousField]: { $exists: true },
        }),
      },
    }).catch(e => e);
    expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
  });

  describe('validateQuery key name enforcement', () => {
    const maliciousField = 'field"; DROP TABLE test --';
    const noMasterHeaders = {
      'Content-Type': 'application/json',
      'X-Parse-Application-Id': 'test',
      'X-Parse-REST-API-Key': 'rest',
    };

    it('rejects malicious field name in find without master key', async () => {
      const response = await request({
        method: 'GET',
        url: `${serverURL}/classes/TestClass`,
        headers: noMasterHeaders,
        qs: {
          where: JSON.stringify({ [maliciousField]: 'value' }),
        },
      }).catch(e => e);
      expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
    });

    it('rejects malicious field name in find with master key', async () => {
      const response = await request({
        method: 'GET',
        url: `${serverURL}/classes/TestClass`,
        headers,
        qs: {
          where: JSON.stringify({ [maliciousField]: 'value' }),
        },
      }).catch(e => e);
      expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
    });

    it('allows master key to query whitelisted internal field _email_verify_token', async () => {
      await reconfigureServer({
        verifyUserEmails: true,
        emailAdapter: {
          sendVerificationEmail: () => Promise.resolve(),
          sendPasswordResetEmail: () => Promise.resolve(),
          sendMail: () => {},
        },
        appName: 'test',
        publicServerURL: 'http://localhost:8378/1',
      });
      const user = new Parse.User();
      user.setUsername('testuser');
      user.setPassword('testpass');
      user.setEmail('test@example.com');
      await user.signUp();
      const response = await request({
        method: 'GET',
        url: `${serverURL}/classes/_User`,
        headers,
        qs: {
          where: JSON.stringify({ _email_verify_token: { $exists: true } }),
        },
      });
      expect(response.data.results.length).toBeGreaterThan(0);
    });

    it('rejects non-master key querying internal field _email_verify_token', async () => {
      const response = await request({
        method: 'GET',
        url: `${serverURL}/classes/_User`,
        headers: noMasterHeaders,
        qs: {
          where: JSON.stringify({ _email_verify_token: { $exists: true } }),
        },
      }).catch(e => e);
      expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
    });

    describe('non-master key cannot update internal fields', () => {
      const internalFields = [
        '_rperm',
        '_wperm',
        '_hashed_password',
        '_email_verify_token',
        '_perishable_token',
        '_perishable_token_expires_at',
        '_email_verify_token_expires_at',
        '_failed_login_count',
        '_account_lockout_expires_at',
        '_password_changed_at',
        '_password_history',
        '_tombstone',
        '_session_token',
      ];

      for (const field of internalFields) {
        it(`rejects non-master key updating ${field}`, async () => {
          const user = new Parse.User();
          user.setUsername(`updatetest_${field}`);
          user.setPassword('password123');
          await user.signUp();
          const response = await request({
            method: 'PUT',
            url: `${serverURL}/classes/_User/${user.id}`,
            headers: {
              'Content-Type': 'application/json',
              'X-Parse-Application-Id': 'test',
              'X-Parse-REST-API-Key': 'rest',
              'X-Parse-Session-Token': user.getSessionToken(),
            },
            body: JSON.stringify({ [field]: 'malicious_value' }),
          }).catch(e => e);
          expect(response.data.code).toBe(Parse.Error.INVALID_KEY_NAME);
        });
      }
    });
  });

  describe('(GHSA-2cjm-2gwv-m892) OAuth2 adapter singleton shares mutable state across providers', () => {
    it('should return isolated adapter instances for different OAuth2 providers', () => {
      const { loadAuthAdapter } = require('../lib/Adapters/Auth/index');

      const authOptions = {
        providerA: {
          oauth2: true,
          tokenIntrospectionEndpointUrl: 'https://a.example.com/introspect',
          useridField: 'sub',
          appidField: 'aud',
          appIds: ['appA'],
        },
        providerB: {
          oauth2: true,
          tokenIntrospectionEndpointUrl: 'https://b.example.com/introspect',
          useridField: 'sub',
          appidField: 'aud',
          appIds: ['appB'],
        },
      };

      const resultA = loadAuthAdapter('providerA', authOptions);
      const resultB = loadAuthAdapter('providerB', authOptions);

      // Adapters must be different instances to prevent cross-contamination
      expect(resultA.adapter).not.toBe(resultB.adapter);

      // After loading providerB, providerA's config must still be intact
      expect(resultA.adapter.tokenIntrospectionEndpointUrl).toBe('https://a.example.com/introspect');
      expect(resultA.adapter.appIds).toEqual(['appA']);
      expect(resultB.adapter.tokenIntrospectionEndpointUrl).toBe('https://b.example.com/introspect');
      expect(resultB.adapter.appIds).toEqual(['appB']);
    });

    it('should not allow concurrent OAuth2 auth requests to cross-contaminate provider config', async () => {
      await reconfigureServer({
        auth: {
          oauthProviderA: {
            oauth2: true,
            tokenIntrospectionEndpointUrl: 'https://a.example.com/introspect',
            useridField: 'sub',
            appidField: 'aud',
            appIds: ['appA'],
          },
          oauthProviderB: {
            oauth2: true,
            tokenIntrospectionEndpointUrl: 'https://b.example.com/introspect',
            useridField: 'sub',
            appidField: 'aud',
            appIds: ['appB'],
          },
        },
      });

      // Provider A: valid token with appA audience
      // Provider B: valid token with appB audience
      mockFetch([
        {
          url: 'https://a.example.com/introspect',
          method: 'POST',
          response: {
            ok: true,
            json: () => Promise.resolve({ active: true, sub: 'user1', aud: 'appA' }),
          },
        },
        {
          url: 'https://b.example.com/introspect',
          method: 'POST',
          response: {
            ok: true,
            json: () => Promise.resolve({ active: true, sub: 'user2', aud: 'appB' }),
          },
        },
      ]);

      // Both providers should authenticate independently without cross-contamination
      const [userA, userB] = await Promise.all([
        Parse.User.logInWith('oauthProviderA', {
          authData: { id: 'user1', access_token: 'tokenA' },
        }),
        Parse.User.logInWith('oauthProviderB', {
          authData: { id: 'user2', access_token: 'tokenB' },
        }),
      ]);

      expect(userA.id).toBeDefined();
      expect(userB.id).toBeDefined();
    });
  });

  describe('(GHSA-p2x3-8689-cwpg) GraphQL WebSocket middleware bypass', () => {
    let httpServer;
    const gqlPort = 13399;

    const gqlHeaders = {
      'X-Parse-Application-Id': 'test',
      'X-Parse-Javascript-Key': 'test',
      'Content-Type': 'application/json',
    };

    async function setupGraphQLServer(serverOptions = {}, graphQLOptions = {}) {
      if (httpServer) {
        await new Promise(resolve => httpServer.close(resolve));
      }
      const server = await reconfigureServer(serverOptions);
      const expressApp = express();
      httpServer = http.createServer(expressApp);
      expressApp.use('/parse', server.app);
      const parseGraphQLServer = new ParseGraphQLServer(server, {
        graphQLPath: '/graphql',
        ...graphQLOptions,
      });
      parseGraphQLServer.applyGraphQL(expressApp);
      await new Promise(resolve => httpServer.listen({ port: gqlPort }, resolve));
      return parseGraphQLServer;
    }

    async function gqlRequest(query, headers = gqlHeaders) {
      const response = await fetch(`http://localhost:${gqlPort}/graphql`, {
        method: 'POST',
        headers,
        body: JSON.stringify({ query }),
      });
      return { status: response.status, body: await response.json().catch(() => null) };
    }

    afterEach(async () => {
      if (httpServer) {
        await new Promise(resolve => httpServer.close(resolve));
        httpServer = null;
      }
    });

    it('should not have createSubscriptions method', async () => {
      const pgServer = await setupGraphQLServer();
      expect(pgServer.createSubscriptions).toBeUndefined();
    });

    it('should not accept WebSocket connections on /subscriptions path', async () => {
      await setupGraphQLServer();
      const connectionResult = await new Promise((resolve) => {
        const socket = new ws(`ws://localhost:${gqlPort}/subscriptions`);
        socket.on('open', () => {
          socket.close();
          resolve('connected');
        });
        socket.on('error', () => {
          resolve('refused');
        });
        setTimeout(() => {
          socket.close();
          resolve('timeout');
        }, 2000);
      });
      expect(connectionResult).not.toBe('connected');
    });

    it('HTTP GraphQL should still work with API key', async () => {
      await setupGraphQLServer();
      const result = await gqlRequest('{ health }');
      expect(result.status).toBe(200);
      expect(result.body?.data?.health).toBeTruthy();
    });

    it('HTTP GraphQL should still reject requests without API key', async () => {
      await setupGraphQLServer();
      const result = await gqlRequest('{ health }', { 'Content-Type': 'application/json' });
      expect(result.status).toBe(403);
    });

    it('HTTP introspection control should still work', async () => {
      await setupGraphQLServer({}, { graphQLPublicIntrospection: false });
      const result = await gqlRequest('{ __schema { types { name } } }');
      expect(result.body?.errors).toBeDefined();
      expect(result.body.errors[0].message).toContain('Introspection is not allowed');
    });

    it('HTTP complexity limits should still work', async () => {
      await setupGraphQLServer({ requestComplexity: { graphQLFields: 5 } });
      const fields = Array.from({ length: 10 }, (_, i) => `f${i}: health`).join(' ');
      const result = await gqlRequest(`{ ${fields} }`);
      expect(result.body?.errors).toBeDefined();
      expect(result.body.errors[0].message).toMatch(/exceeds maximum allowed/);
    });
  });
});