parse-community / parse-community/parse-server

Database Password Security Check Doesn't Check All Possible URIs

Open
#8,833 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type:feature
Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

https://github.com/parse-community/parse-server/blob/2c2563ebd2ac5255b387296a563a34157ec076f5/src/Security/CheckGroups/CheckGroupDatabase.js#L18

Would it be beneficial to also look for config.databaseURI if a database adapter is not defined in the configuration object? I do not currently have a database adapter defined in my config (using Postgresql), and when I access the new /security endpoint, it informs me my password does not meet the minimum requirements. However, it does meet the minimum requirements specified in CheckGroupDatabase.js.

Here is an example that will fail the database password security check when only config.databaseURI is specified, but it should pass:

    export const config = {  
        databaseURI: 'postgres://mypostgresuser:q00A1qgxYNHzn2ID5XST@localhost:5432/parse'
        ...  
    }

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read src/Security/CheckGroups/CheckGroupDatabase.js at the referenced line and reproduce the /security check with only config.databaseURI set. Verify that a PostgreSQL URI whose password meets the stated requirements passes the database password security check.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, postgresql
Domain
backend, databases, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.