parse-community / parse-community/parse-server

Allowing restricted field names

Open
#7,130 8 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

type:feature
Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

New Issue Checklist
  • I am not disclosing a vulnerability.
  • I am not just asking a question.
  • I have searched through existing issues.
  • I can reproduce the issue with the latest version of Parse Server.
Issue Description

We updated Parse Server to version 4.5.0, and included in the latest security changes, now we can not use certain restricted fields like lengthor className as this merged PR explains: https://github.com/parse-community/parse-server/pull/7053

We have a class in production since Parse Server 3.0.0 that has been using the newly restricted field length so now we can not create or edit objects of that class as Parse returns an error: {Invalid field name: length., code=105}

As a workaround, we've tried to unset the length key in a beforeSave hook of that class. That works great for any object which is newly created, but not for object updates (tested with REST API POST and PUT). When updating an object, the beforeSave hook is not called, and Parse Server returns an error before we can unset the key.

This issue attempts to open a discussion about how to work this concept out. As suggested by @mtrezza we could allow the "reserved" field names by encoding fields differently in the Parse Object. https://github.com/parse-community/parse-server/pull/7053#issuecomment-758204151

Steps to reproduce

Create a class in Parse Server 4.4.1 (or anything lower than 4.5.0) with the field length.
Create some objects for that class.
Update Parse Server to (4.5.0).
Attempt editing those objects or creating new ones by REST API POST and PUT, or from Parse dashboard.

Actual Outcome

The object can not be created or edited: {Invalid field name: length., code=105}

Expected Outcome

The object is successfully created or edited.

Environment

Server

  • Parse Server version: 4.5.0
  • Operating system: Linux
  • Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Heroku

Database

  • System (MongoDB or Postgres): MongoDB
  • Database version: 4.4.3
  • Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): mLab

Client

  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): iOS
  • SDK version: 1.19.0
Logs

From iOS: Error Domain=Parse Code=105 "Invalid field name: length." UserInfo={error=Invalid field name: length., NSLocalizedDescription=Invalid field name: length., code=105}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading PR #7053 and its discussion about restricted field names and encoding fields differently in Parse Objects. Reproduce the failure by updating an existing object with a restricted field such as length through REST API POST or PUT, then compare creation and update behavior, including the beforeSave hook. Done means existing objects can be created and edited successfully without the invalid-field-name error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, mongodb, nodejs
Domain
api, backend, databases
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.