fix: Instance comparison with instanceof is not realm-safe

eslint.config.js

@@ -41,7 +41,30 @@ module.exports = [
       curly: ["error", "all"],
       "block-spacing": ["error", "always"],
       "no-unused-vars": "off",
-      "no-console": "warn"
+      "no-console": "warn",
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Date']",
+          message: "Use Utils.isDate() instead of instanceof Date (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='RegExp']",
+          message: "Use Utils.isRegExp() instead of instanceof RegExp (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Error']",
+          message: "Use Utils.isNativeError() instead of instanceof Error (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Promise']",
+          message: "Use Utils.isPromise() instead of instanceof Promise (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Map']",
+          message: "Use Utils.isMap() instead of instanceof Map (cross-realm safe).",
+        },
+      ]
     },
   },
 ];

spec/CloudCode.spec.js

@@ -5,6 +5,7 @@ const ParseServer = require('../lib/index').ParseServer;
 const request = require('../lib/request');
 const InMemoryCacheAdapter = require('../lib/Adapters/Cache/InMemoryCacheAdapter')
   .InMemoryCacheAdapter;
+const Utils = require('../lib/Utils');
 
 const mockAdapter = {
   createFile: async filename => ({
@@ -1272,15 +1273,15 @@ describe('Cloud Code', () => {
 
   it('test cloud function request params types', function (done) {
     Parse.Cloud.define('params', function (req) {
-      expect(req.params.date instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.date)).toBe(true);
       expect(req.params.date.getTime()).toBe(1463907600000);
-      expect(req.params.dateList[0] instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.dateList[0])).toBe(true);
       expect(req.params.dateList[0].getTime()).toBe(1463907600000);
-      expect(req.params.complexStructure.date[0] instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.complexStructure.date[0])).toBe(true);
       expect(req.params.complexStructure.date[0].getTime()).toBe(1463907600000);
-      expect(req.params.complexStructure.deepDate.date[0] instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.complexStructure.deepDate.date[0])).toBe(true);
       expect(req.params.complexStructure.deepDate.date[0].getTime()).toBe(1463907600000);
-      expect(req.params.complexStructure.deepDate2[0].date instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.complexStructure.deepDate2[0].date)).toBe(true);
       expect(req.params.complexStructure.deepDate2[0].date.getTime()).toBe(1463907600000);
       // Regression for #2294
       expect(req.params.file instanceof Parse.File).toBe(true);

spec/MongoStorageAdapter.spec.js

@@ -6,6 +6,7 @@ const databaseURI = 'mongodb://localhost:27017/parseServerMongoAdapterTestDataba
 const request = require('../lib/request');
 const Config = require('../lib/Config');
 const TestUtils = require('../lib/TestUtils');
+const Utils = require('../lib/Utils');
 
 const fakeClient = {
   s: { options: { dbName: null } },
@@ -245,7 +246,7 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
         const mob = results[0];
         expect(mob.array instanceof Array).toBe(true);
         expect(typeof mob.object).toBe('object');
-        expect(mob.date instanceof Date).toBe(true);
+        expect(Utils.isDate(mob.date)).toBe(true);
         return adapter.find('MyClass', schema, {}, {});
       })
       .then(results => {
@@ -278,9 +279,9 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
     }).save();
     const adapter = Config.get(Parse.applicationId).database.adapter;
     const [object] = await adapter._rawFind('MyClass', {});
-    expect(object.date instanceof Date).toBeTrue();
-    expect(object.bar.date instanceof Date).toBeTrue();
-    expect(object.foo.test.date instanceof Date).toBeTrue();
+    expect(Utils.isDate(object.date)).toBeTrue();
+    expect(Utils.isDate(object.bar.date)).toBeTrue();
+    expect(Utils.isDate(object.foo.test.date)).toBeTrue();
   });
 
   it('handles nested dates in array ', async () => {
@@ -297,13 +298,13 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
     }).save();
     const adapter = Config.get(Parse.applicationId).database.adapter;
     const [object] = await adapter._rawFind('MyClass', {});
-    expect(object.date[0] instanceof Date).toBeTrue();
-    expect(object.bar.date[0] instanceof Date).toBeTrue();
-    expect(object.foo.test.date[0] instanceof Date).toBeTrue();
+    expect(Utils.isDate(object.date[0])).toBeTrue();
+    expect(Utils.isDate(object.bar.date[0])).toBeTrue();
+    expect(Utils.isDate(object.foo.test.date[0])).toBeTrue();
     const obj = await new Parse.Query('MyClass').first({ useMasterKey: true });
-    expect(obj.get('date')[0] instanceof Date).toBeTrue();
-    expect(obj.get('bar').date[0] instanceof Date).toBeTrue();
-    expect(obj.get('foo').test.date[0] instanceof Date).toBeTrue();
+    expect(Utils.isDate(obj.get('date')[0])).toBeTrue();
+    expect(Utils.isDate(obj.get('bar').date[0])).toBeTrue();
+    expect(Utils.isDate(obj.get('foo').test.date[0])).toBeTrue();
   });
 
   it('upserts with $setOnInsert', async () => {
@@ -387,7 +388,7 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
         const mob = results[0];
         expect(mob.array instanceof Array).toBe(true);
         expect(typeof mob.object).toBe('object');
-        expect(mob.date instanceof Date).toBe(true);
+        expect(Utils.isDate(mob.date)).toBe(true);
         done();
       })
       .catch(error => {

spec/MongoTransform.spec.js

@@ -33,8 +33,8 @@ describe('parseObjectToMongoObjectForCreate', () => {
     const output = transform.parseObjectToMongoObjectForCreate(null, input, {
       fields: {},
     });
-    expect(output._created_at instanceof Date).toBe(true);
-    expect(output._updated_at instanceof Date).toBe(true);
+    expect(Utils.isDate(output._created_at)).toBe(true);
+    expect(Utils.isDate(output._updated_at)).toBe(true);
     done();
   });
 

spec/ParseAPI.spec.js

@@ -7,6 +7,7 @@ const Parse = require('parse/node');
 const Config = require('../lib/Config');
 const SchemaController = require('../lib/Controllers/SchemaController');
 const { destroyAllDataPermanently } = require('../lib/TestUtils');
+const Utils = require('../lib/Utils');
 
 const userSchema = SchemaController.convertSchemaToAdapterSchema({
   className: '_User',
@@ -327,7 +328,7 @@ describe('miscellaneous', () => {
         return obj2.fetch();
       })
       .then(obj2 => {
-        expect(obj2.get('date') instanceof Date).toBe(true);
+        expect(Utils.isDate(obj2.get('date'))).toBe(true);
         expect(obj2.get('array') instanceof Array).toBe(true);
         expect(obj2.get('object') instanceof Array).toBe(false);
         expect(obj2.get('object') instanceof Object).toBe(true);

spec/ParseGraphQLServer.spec.js

@@ -5,6 +5,7 @@ const fetch = (...args) => import('node-fetch').then(({ default: fetch }) => fet
 const FormData = require('form-data');
 require('./helper');
 const { updateCLP } = require('./support/dev');
+const Utils = require('../lib/Utils');
 
 const pluralize = require('pluralize');
 const createUploadLink = (...args) => import('apollo-upload-client/createUploadLink.mjs').then(({ default: fn }) => fn(...args));
@@ -8476,15 +8477,15 @@ describe('ParseGraphQLServer', () => {
 
         it('should accept different params', done => {
           Parse.Cloud.define('hello', async req => {
-            expect(req.params.date instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.date)).toBe(true);
             expect(req.params.date.getTime()).toBe(1463907600000);
-            expect(req.params.dateList[0] instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.dateList[0])).toBe(true);
             expect(req.params.dateList[0].getTime()).toBe(1463907600000);
-            expect(req.params.complexStructure.date[0] instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.complexStructure.date[0])).toBe(true);
             expect(req.params.complexStructure.date[0].getTime()).toBe(1463907600000);
-            expect(req.params.complexStructure.deepDate.date[0] instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.complexStructure.deepDate.date[0])).toBe(true);
             expect(req.params.complexStructure.deepDate.date[0].getTime()).toBe(1463907600000);
-            expect(req.params.complexStructure.deepDate2[0].date instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.complexStructure.deepDate2[0].date)).toBe(true);
             expect(req.params.complexStructure.deepDate2[0].date.getTime()).toBe(1463907600000);
             // Regression for #2294
             expect(req.params.file instanceof Parse.File).toBe(true);

spec/ParseQuery.spec.js

@@ -9,6 +9,7 @@ const request = require('../lib/request');
 const ParseServerRESTController = require('../lib/ParseServerRESTController').ParseServerRESTController;
 const ParseServer = require('../lib/ParseServer').default;
 const Deprecator = require('../lib/Deprecator/Deprecator').default;
+const Utils = require('../lib/Utils');
 
 const masterKeyHeaders = {
   'X-Parse-Application-Id': 'test',
@@ -1452,8 +1453,8 @@ describe('Parse.Query testing', () => {
         ok(result);
         equal(result.id, objectId);
         equal(result.get('foo'), 'bar');
-        ok(result.createdAt instanceof Date);
-        ok(result.updatedAt instanceof Date);
+        ok(Utils.isDate(result.createdAt));
+        ok(Utils.isDate(result.updatedAt));
         done();
       });
     });
@@ -3902,7 +3903,7 @@ describe('Parse.Query testing', () => {
         objs => {
           expect(objs.length).toBe(1);
           expect(objs[0].get('child').get('hello')).toEqual('world');
-          expect(objs[0].createdAt instanceof Date).toBe(true);
+          expect(Utils.isDate(objs[0].createdAt)).toBe(true);
           done();
         },
         () => {

spec/ParseUser.spec.js

@@ -12,6 +12,7 @@ const request = require('../lib/request');
 const passwordCrypto = require('../lib/password');
 const Config = require('../lib/Config');
 const cryptoUtils = require('../lib/cryptoUtils');
+const Utils = require('../lib/Utils');
 
 
 describe('allowExpiredAuthDataToken option', () => {
@@ -1128,9 +1129,9 @@ describe('Parse.User testing', () => {
 
           equal(userInMemory.id, id, 'id should be set');
 
-          expect(userInMemory.updatedAt instanceof Date).toBe(true);
+          expect(Utils.isDate(userInMemory.updatedAt)).toBe(true);
 
-          ok(userInMemory.createdAt instanceof Date);
+          ok(Utils.isDate(userInMemory.createdAt));
 
           ok(userInMemory.getSessionToken(), 'user should have a sessionToken after saving');
 
@@ -1167,9 +1168,9 @@ describe('Parse.User testing', () => {
 
           equal(userFromDisk.id, id, 'id should be set on userFromDisk');
 
-          ok(userFromDisk.updatedAt instanceof Date);
+          ok(Utils.isDate(userFromDisk.updatedAt));
 
-          ok(userFromDisk.createdAt instanceof Date);
+          ok(Utils.isDate(userFromDisk.createdAt));
 
           ok(userFromDisk.getSessionToken(), 'userFromDisk should have a sessionToken');
 

spec/PushController.spec.js

@@ -3,6 +3,7 @@ const PushController = require('../lib/Controllers/PushController').PushControll
 const StatusHandler = require('../lib/StatusHandler');
 const Config = require('../lib/Config');
 const validatePushType = require('../lib/Push/utils').validatePushType;
+const Utils = require('../lib/Utils');
 
 const successfulTransmissions = function (body, installations) {
   const promises = installations.map(device => {
@@ -454,8 +455,8 @@ describe('PushController', () => {
     const pushStatusId = await sendPush(payload, {}, config, auth);
     await pushCompleted(pushStatusId);
     const result = await Parse.Push.getPushStatus(pushStatusId);
-    expect(result.createdAt instanceof Date).toBe(true);
-    expect(result.updatedAt instanceof Date).toBe(true);
+    expect(Utils.isDate(result.createdAt)).toBe(true);
+    expect(Utils.isDate(result.updatedAt)).toBe(true);
     expect(result.id.length).toBe(10);
     expect(result.get('source')).toEqual('rest');
     expect(result.get('query')).toEqual(JSON.stringify({}));