Skip to content

Commit 81b47f2

Browse files
mtrezzamtrezza
authored
build: Release (parse-community#9905)
2 parents 405a46b + fbde458 commit 81b47f2

File tree

12 files changed

+170
-54
lines changed

12 files changed

+170
-54
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88
paths-ignore:
99
- '**/**.md'
1010
env:
11-
NODE_VERSION: 22.12.0
11+
NODE_VERSION: 24.11.0
1212
PARSE_SERVER_TEST_TIMEOUT: 20000
1313
permissions:
1414
actions: write
@@ -156,20 +156,20 @@ jobs:
156156
- name: MongoDB 6, ReplicaSet
157157
MONGODB_VERSION: 6.0.19
158158
MONGODB_TOPOLOGY: replset
159-
NODE_VERSION: 22.12.0
159+
NODE_VERSION: 24.11.0
160160
- name: MongoDB 7, ReplicaSet
161161
MONGODB_VERSION: 7.0.16
162162
MONGODB_TOPOLOGY: replset
163-
NODE_VERSION: 22.12.0
163+
NODE_VERSION: 24.11.0
164164
- name: MongoDB 8, ReplicaSet
165165
MONGODB_VERSION: 8.0.4
166166
MONGODB_TOPOLOGY: replset
167-
NODE_VERSION: 22.12.0
167+
NODE_VERSION: 24.11.0
168168
- name: Redis Cache
169169
PARSE_SERVER_TEST_CACHE: redis
170170
MONGODB_VERSION: 8.0.4
171171
MONGODB_TOPOLOGY: standalone
172-
NODE_VERSION: 22.12.0
172+
NODE_VERSION: 24.11.0
173173
- name: Node 20
174174
MONGODB_VERSION: 8.0.4
175175
MONGODB_TOPOLOGY: standalone
@@ -178,6 +178,10 @@ jobs:
178178
MONGODB_VERSION: 8.0.4
179179
MONGODB_TOPOLOGY: standalone
180180
NODE_VERSION: 18.20.4
181+
- name: Node 22
182+
MONGODB_VERSION: 8.0.4
183+
MONGODB_TOPOLOGY: standalone
184+
NODE_VERSION: 22.12.0
181185
fail-fast: false
182186
name: ${{ matrix.name }}
183187
timeout-minutes: 20
@@ -225,22 +229,22 @@ jobs:
225229
include:
226230
- name: PostgreSQL 15, PostGIS 3.3
227231
POSTGRES_IMAGE: postgis/postgis:15-3.3
228-
NODE_VERSION: 22.12.0
232+
NODE_VERSION: 24.11.0
229233
- name: PostgreSQL 15, PostGIS 3.4
230234
POSTGRES_IMAGE: postgis/postgis:15-3.4
231-
NODE_VERSION: 22.12.0
235+
NODE_VERSION: 24.11.0
232236
- name: PostgreSQL 15, PostGIS 3.5
233237
POSTGRES_IMAGE: postgis/postgis:15-3.5
234-
NODE_VERSION: 22.12.0
238+
NODE_VERSION: 24.11.0
235239
- name: PostgreSQL 16, PostGIS 3.5
236240
POSTGRES_IMAGE: postgis/postgis:16-3.5
237-
NODE_VERSION: 22.12.0
241+
NODE_VERSION: 24.11.0
238242
- name: PostgreSQL 17, PostGIS 3.5
239243
POSTGRES_IMAGE: postgis/postgis:17-3.5
240-
NODE_VERSION: 22.12.0
244+
NODE_VERSION: 24.11.0
241245
- name: PostgreSQL 18, PostGIS 3.6
242246
POSTGRES_IMAGE: postgis/postgis:18-3.6
243-
NODE_VERSION: 22.12.0
247+
NODE_VERSION: 24.11.0
244248
fail-fast: false
245249
name: ${{ matrix.name }}
246250
timeout-minutes: 20

‎.github/workflows/release-manual-docs.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Trigger this workflow only to manually create a docs release; this should only be used
2+
# in extraordinary circumstances, as docs releases are normally created automatically as
3+
# part of the automated release workflow.
4+
5+
name: release-manual-docs
6+
on:
7+
workflow_dispatch:
8+
inputs:
9+
ref:
10+
default: ''
11+
description: 'Reference (tag / SHA):'
12+
required: true
13+
jobs:
14+
docs:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 15
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v4
20+
with:
21+
ref: ${{ github.event.inputs.ref }}
22+
- name: Use Node.js
23+
uses: actions/setup-node@v4
24+
with:
25+
node-version: 18.20.4
26+
- name: Cache Node.js modules
27+
uses: actions/cache@v4
28+
with:
29+
path: ~/.npm
30+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
31+
restore-keys: |
32+
${{ runner.os }}-node-
33+
- name: Generate Docs
34+
run: |
35+
echo $SOURCE_TAG
36+
npm ci
37+
./release_docs.sh
38+
env:
39+
SOURCE_TAG: ${{ github.event.inputs.ref }}
40+
- name: Deploy
41+
uses: peaceiris/actions-gh-pages@v3.7.3
42+
with:
43+
github_token: ${{ secrets.GITHUB_TOKEN }}
44+
publish_dir: ./docs

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
[![Coverage](https://codecov.io/github/parse-community/parse-server/branch/alpha/graph/badge.svg)](https://app.codecov.io/github/parse-community/parse-server/tree/alpha)
99
[![auto-release](https://img.shields.io/badge/%F0%9F%9A%80-auto--release-9e34eb.svg)](https://github.com/parse-community/parse-dashboard/releases)
1010

11-
[![Node Version](https://img.shields.io/badge/nodejs-18,_20,_22-green.svg?logo=node.js&style=flat)](https://nodejs.org)
11+
[![Node Version](https://img.shields.io/badge/nodejs-18,_20,_22,_24-green.svg?logo=node.js&style=flat)](https://nodejs.org)
1212
[![MongoDB Version](https://img.shields.io/badge/mongodb-6,_7,_8-green.svg?logo=mongodb&style=flat)](https://www.mongodb.com)
1313
[![Postgres Version](https://img.shields.io/badge/postgresql-13,_14,_15,_16,_17,_18-green.svg?logo=postgresql&style=flat)](https://www.postgresql.org)
1414

@@ -130,6 +130,7 @@ Parse Server is continuously tested with the most recent releases of Node.js to
130130
| Node.js 18 | 18.20.4 | April 2025 | <= 8.x (2025) |
131131
| Node.js 20 | 20.18.0 | April 2026 | <= 9.x (2026) |
132132
| Node.js 22 | 22.12.0 | April 2027 | <= 10.x (2027) |
133+
| Node.js 24 | 24.11.0 | April 2028 | <= 11.x (2028) |
133134

134135
#### MongoDB
135136

‎changelogs/CHANGELOG_alpha.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,24 @@
1+
# [8.4.0-alpha.2](https://github.com/parse-community/parse-server/compare/8.4.0-alpha.1...8.4.0-alpha.2) (2025-11-05)
2+
3+
4+
### Bug Fixes
5+
6+
* Uploading a file by providing an origin URL allows for Server-Side Request Forgery (SSRF); fixes vulnerability [GHSA-x4qj-2f4q-r4rx](https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx) ([#9903](https://github.com/parse-community/parse-server/issues/9903)) ([9776386](https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585))
7+
8+
# [8.4.0-alpha.1](https://github.com/parse-community/parse-server/compare/8.3.1-alpha.1...8.4.0-alpha.1) (2025-11-05)
9+
10+
11+
### Features
12+
13+
* Add support for Node 24 ([#9901](https://github.com/parse-community/parse-server/issues/9901)) ([25dfe19](https://github.com/parse-community/parse-server/commit/25dfe19fef02fd44224e4a6d198584a694a1aa52))
14+
15+
## [8.3.1-alpha.1](https://github.com/parse-community/parse-server/compare/8.3.0...8.3.1-alpha.1) (2025-11-05)
16+
17+
18+
### Bug Fixes
19+
20+
* Add problematic MIME types to default value of Parse Server option `fileUpload.fileExtensions` ([#9902](https://github.com/parse-community/parse-server/issues/9902)) ([fa245cb](https://github.com/parse-community/parse-server/commit/fa245cbb5f5b7a0dad962b2ce0524fa4dafcb5f7))
21+
122
# [8.3.0-alpha.14](https://github.com/parse-community/parse-server/compare/8.3.0-alpha.13...8.3.0-alpha.14) (2025-11-01)
223

324

‎jsdoc-conf.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
"source": {
77
"include": [
88
"README.md",
9-
"./src/cloud-code",
10-
"./src/Options/docs.js",
11-
"./src/ParseServer.js",
12-
"./src/Adapters"
9+
"./lib/cloud-code",
10+
"./lib/Options/docs.js",
11+
"./lib/ParseServer.js",
12+
"./lib/Adapters"
1313
],
1414
"excludePattern": "(^|\\/|\\\\)_"
1515
},

‎package-lock.json‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "parse-server",
3-
"version": "8.3.0",
3+
"version": "8.4.0-alpha.2",
44
"description": "An express module providing a Parse-compatible API server",
55
"main": "lib/index.js",
66
"repository": {
@@ -142,7 +142,7 @@
142142
},
143143
"types": "types/index.d.ts",
144144
"engines": {
145-
"node": ">=18.20.4 <19.0.0 || >=20.18.0 <21.0.0 || >=22.12.0 <23.0.0"
145+
"node": ">=18.20.4 <19.0.0 || >=20.18.0 <21.0.0 || >=22.12.0 <23.0.0 || >=24.11.0 <25.0.0"
146146
},
147147
"bin": {
148148
"parse-server": "bin/parse-server"

‎spec/ParseFile.spec.js‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -653,6 +653,80 @@ describe('Parse.File testing', () => {
653653
done();
654654
});
655655
});
656+
657+
describe('URI-backed file upload is disabled to prevent SSRF attack', () => {
658+
const express = require('express');
659+
let testServer;
660+
let testServerPort;
661+
let requestsMade;
662+
663+
beforeEach(async () => {
664+
requestsMade = [];
665+
const app = express();
666+
app.use((req, res) => {
667+
requestsMade.push({ url: req.url, method: req.method });
668+
res.status(200).send('test file content');
669+
});
670+
testServer = app.listen(0);
671+
testServerPort = testServer.address().port;
672+
});
673+
674+
afterEach(async () => {
675+
if (testServer) {
676+
await new Promise(resolve => testServer.close(resolve));
677+
}
678+
Parse.Cloud._removeAllHooks();
679+
});
680+
681+
it('does not access URI when file upload attempted over REST', async () => {
682+
const response = await request({
683+
method: 'POST',
684+
url: 'http://localhost:8378/1/classes/TestClass',
685+
headers: {
686+
'Content-Type': 'application/json',
687+
'X-Parse-Application-Id': 'test',
688+
'X-Parse-REST-API-Key': 'rest',
689+
},
690+
body: {
691+
file: {
692+
__type: 'File',
693+
name: 'test.txt',
694+
_source: {
695+
format: 'uri',
696+
uri: `http://127.0.0.1:${testServerPort}/secret-file.txt`,
697+
},
698+
},
699+
},
700+
});
701+
expect(response.status).toBe(201);
702+
// Verify no HTTP request was made to the URI
703+
expect(requestsMade.length).toBe(0);
704+
});
705+
706+
it('does not access URI when file created in beforeSave trigger', async () => {
707+
Parse.Cloud.beforeSave(Parse.File, () => {
708+
return new Parse.File('trigger-file.txt', {
709+
uri: `http://127.0.0.1:${testServerPort}/secret-file.txt`,
710+
});
711+
});
712+
await expectAsync(
713+
request({
714+
method: 'POST',
715+
headers: {
716+
'Content-Type': 'application/octet-stream',
717+
'X-Parse-Application-Id': 'test',
718+
'X-Parse-REST-API-Key': 'rest',
719+
},
720+
url: 'http://localhost:8378/1/files/test.txt',
721+
body: 'test content',
722+
})
723+
).toBeRejectedWith(jasmine.objectContaining({
724+
status: 400
725+
}));
726+
// Verify no HTTP request was made to the URI
727+
expect(requestsMade.length).toBe(0);
728+
});
729+
});
656730
});
657731

658732
describe('deleting files', () => {

‎src/Options/Definitions.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1077,9 +1077,9 @@ module.exports.FileUploadOptions = {
10771077
fileExtensions: {
10781078
env: 'PARSE_SERVER_FILE_UPLOAD_FILE_EXTENSIONS',
10791079
help:
1080-
"Sets the allowed file extensions for uploading files. The extension is defined as an array of file extensions, or a regex pattern.<br><br>It is recommended to restrict the file upload extensions as much as possible. HTML files are especially problematic as they may be used by an attacker who uploads a HTML form to look legitimate under your app's domain name, or to compromise the session token of another user via accessing the browser's local storage.<br><br>Defaults to `^(?!(h|H)(t|T)(m|M)(l|L)?$)` which allows any file extension except HTML files.",
1080+
"Sets the allowed file extensions for uploading files. The extension is defined as an array of file extensions, or a regex pattern.<br><br>It is recommended to restrict the file upload extensions as much as possible. HTML files are especially problematic as they may be used by an attacker who uploads a HTML form to look legitimate under your app's domain name, or to compromise the session token of another user via accessing the browser's local storage.<br><br>Defaults to `^(?![xXsS]?[hH][tT][mM][lL]?$)` which allows any file extension except those MIME types that are mapped to `text/html` and are rendered as website by a web browser.",
10811081
action: parsers.arrayParser,
1082-
default: ['^(?!(h|H)(t|T)(m|M)(l|L)?$)'],
1082+
default: ['^(?![xXsS]?[hH][tT][mM][lL]?$)'],
10831083
},
10841084
};
10851085
module.exports.DatabaseOptions = {

‎src/Options/docs.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
⚡