parse-community / parse-community/parse-server
Database Password Security Check Doesn't Check All Possible URIs
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
Would it be beneficial to also look for config.databaseURI if a database adapter is not defined in the configuration object? I do not currently have a database adapter defined in my config (using Postgresql), and when I access the new /security endpoint, it informs me my password does not meet the minimum requirements. However, it does meet the minimum requirements specified in CheckGroupDatabase.js.
Here is an example that will fail the database password security check when only config.databaseURI is specified, but it should pass:
export const config = {
databaseURI: 'postgres://mypostgresuser:q00A1qgxYNHzn2ID5XST@localhost:5432/parse'
...
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read src/Security/CheckGroups/CheckGroupDatabase.js at the referenced line and reproduce the /security check with only config.databaseURI set. Verify that a PostgreSQL URI whose password meets the stated requirements passes the database password security check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, postgresql
- Domain
- backend, databases, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100