parse-community / parse-community/parse-server
Allowing restricted field names
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Issue Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
- I can reproduce the issue with the latest version of Parse Server.
Issue Description
We updated Parse Server to version 4.5.0, and included in the latest security changes, now we can not use certain restricted fields like lengthor className as this merged PR explains: https://github.com/parse-community/parse-server/pull/7053
We have a class in production since Parse Server 3.0.0 that has been using the newly restricted field length so now we can not create or edit objects of that class as Parse returns an error: {Invalid field name: length., code=105}
As a workaround, we've tried to unset the length key in a beforeSave hook of that class. That works great for any object which is newly created, but not for object updates (tested with REST API POST and PUT). When updating an object, the beforeSave hook is not called, and Parse Server returns an error before we can unset the key.
This issue attempts to open a discussion about how to work this concept out. As suggested by @mtrezza we could allow the "reserved" field names by encoding fields differently in the Parse Object. https://github.com/parse-community/parse-server/pull/7053#issuecomment-758204151
Steps to reproduce
Create a class in Parse Server 4.4.1 (or anything lower than 4.5.0) with the field length.
Create some objects for that class.
Update Parse Server to (4.5.0).
Attempt editing those objects or creating new ones by REST API POST and PUT, or from Parse dashboard.
Actual Outcome
The object can not be created or edited: {Invalid field name: length., code=105}
Expected Outcome
The object is successfully created or edited.
Environment
Server
- Parse Server version:
4.5.0 - Operating system:
Linux - Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc):
Heroku
Database
- System (MongoDB or Postgres):
MongoDB - Database version:
4.4.3 - Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc):
mLab
Client
- SDK (iOS, Android, JavaScript, PHP, Unity, etc):
iOS - SDK version:
1.19.0
Logs
From iOS: Error Domain=Parse Code=105 "Invalid field name: length." UserInfo={error=Invalid field name: length., NSLocalizedDescription=Invalid field name: length., code=105}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading PR #7053 and its discussion about restricted field names and encoding fields differently in Parse Objects. Reproduce the failure by updating an existing object with a restricted field such as length through REST API POST or PUT, then compare creation and update behavior, including the beforeSave hook. Done means existing objects can be created and edited successfully without the invalid-field-name error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, mongodb, nodejs
- Domain
- api, backend, databases
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100