Repository navigation
fix: Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v) - #10843
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Expand missing key paths src/Controllers/DatabaseController.js |
_expandResultOnKeyPath checks whether each path segment contains an object before recursing. |
Cover dot-notation response behavior spec/vulnerabilities.spec.js |
Tests cover update and create responses for dot-notation operations, including missing paths. The existing missing-parent Remove case now runs on databases other than PostgreSQL. |
Priority:
Estimated code review effort: 3 (Moderate) | ~20 minutes
Possibly related issues
- parse-community/parse-server#10825: The issue concerns save-response filtering for fields callers cannot read, which the new response tests also cover.
- parse-community/parse-server#10827: The issue concerns absent fields in
_sanitizeDatabaseResultand_expandResultOnKeyPath, the controller code path changed here.
Possibly related PRs
- parse-community/parse-server#10842: This PR contains the same GHSA test changes and
_expandResultOnKeyPathguard for the release-8.x.x branch.
Merge Risk: 
71dae
-
No concrete merge-blocking risk was identified.
Caution
Pre-merge checks failed
Please resolve all errors before merging. Addressing warnings is optional.
- Ignore
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check |  |
The title "fix: GHSA-4m87-fqwv-2m8v" begins with the allowed prefix "fix:", but the first letter after the prefix is not capitalized. The title names only the advisory ID and not the change. The chang… | Capitalize the first letter after the prefix and add a short description of the fix. For example: "fix: Handle missing nested paths in dot-notation results for GHSA-4m87-fqwv-2m8v". |
| Description check | |
The pull request description is empty. The author did not add an issue link, an approach, or any task checklist. The template requires these sections, so the description is largely incomplete. | Add a description that follows the repository template. Include: the issue or advisory this PR closes (GHSA-4m87-fqwv-2m8v), a summary of the approach (the nested path check in _expandResultOnKeyPath and the updated WriteOnly and GHSA test … |
-
Check name Status Explanation Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Security Check No new security vulnerability is introduced. The only production change guards nested result traversal with Object.hasOwn and an object-type check, then stops when the result lacks a path segment. Thi… Engage In Review Feedback No review feedback required engagement. The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files.
Full details: Security Check
-
Explanation
No new security vulnerability is introduced. The only production change guards nested result traversal with Object.hasOwn and an object-type check, then stops when the result lacks a path segment. This prevents missing-path values from entering the sanitized response. The added GHSA-4m87-fqwv-2m8v tests cover callers without read access, missing parents, nested paths, array indexes, master-key requests, and create operations. The remaining changes are tests.
-
Full details: Title check
-
Explanation
The title "fix: GHSA-4m87-fqwv-2m8v" begins with the allowed prefix "fix:", but the first letter after the prefix is not capitalized. The title names only the advisory ID and not the change. The changeset fixes dot-notation handling on missing paths in DatabaseController._expandResultOnKeyPath, and the new tests cover that fix, so the title is related to the change but lacks a descriptive summary and fails the casing requirement.
Resolution
Capitalize the first letter after the prefix and add a short description of the fix. For example: "fix: Handle missing nested paths in dot-notation results for GHSA-4m87-fqwv-2m8v".
Full details: Description check
-
Resolution
Add a description that follows the repository template. Include: the issue or advisory this PR closes (GHSA-4m87-fqwv-2m8v), a summary of the approach (the nested path check in _expandResultOnKeyPath and the updated WriteOnly and GHSA test expectations), and the task checklist with completed items checked and inapplicable items removed.
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
@coderabbitai review |
✅ Action performed
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-8.x.x #10843 +/- ##
=================================================
+ Coverage 92.86% 92.87% +0.01%
=================================================
Files 192 192
Lines 16576 16577 +1
Branches 225 225
=================================================
+ Hits 15393 15396 +3
+ Misses 1163 1161 -2
Partials 20 20 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
mtrezza
changed the title
3515f98
into
parse-community:release-8.x.x
## [8.6.118](8.6.117...8.6.118) (2026-10-29) ### Bug Fixes * Dot notation operation on a missing field reveals whether the field is stored to a caller without read access ([GHSA-4m87-fqwv-2m8v](https://github.com/parse-community/parse-server/security/advisories/GHSA-4m87-fqwv-2m8v)) ([#10843](#10843)) ([3515f98](3515f98))
|
🎉 This change has been released in version 8.6.118 |
Pull Request
Issue
Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v)
Tasks