Repository navigation
fix: Object write with a crafted key can pollute a shared prototype and cause denial of service (GHSA-rx55-fw4j-pvpx) - #10790
Merged
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check |  |
The pull request has no description. It does not provide the required issue, approach, or task information from the repository template. | Add a description that includes the security issue or advisory link, an approach summary, and completed task checkboxes. Confirm the added regression tests and security check, and mark documentation or Parse Error code tasks as not applicab… |
| Docstring Coverage |  |
Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 4 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Title check The title uses the required fix:prefix, starts the title text with a capital letter, and identifies the security fix covered by the changes.Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Security Check PASS: The changed code addresses prototype-pollution paths. ACL transforms now use own-property checks, and dot-notation expansion creates fresh objects instead of descending through inherited or non-… Engage In Review Feedback PASS — The supplied review data reports zero actionable findings and no CodeRabbit review threads. No review feedback comment exists that requires engagement, implementation, or reviewer retraction.
Full details: Description check
-
Resolution
Add a description that includes the security issue or advisory link, an approach summary, and completed task checkboxes. Confirm the added regression tests and security check, and mark documentation or Parse Error code tasks as not applicable when appropriate.
- Fix all pre-merge checks with AI
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10790 +/- ##
==========================================
- Coverage 94.03% 94.02% -0.01%
==========================================
Files 193 193
Lines 17238 17239 +1
Branches 259 259
==========================================
Hits 16209 16209
- Misses 1007 1008 +1
Partials 22 22 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
mtrezza
changed the title
parseplatformorg
pushed a commit
that referenced
this pull request
Oct 15, 2026
## [9.10.5-alpha.9](9.10.5-alpha.8...9.10.5-alpha.9) (2026-10-15) ### Bug Fixes * Object write with a crafted key can pollute a shared prototype and cause denial of service ([GHSA-rx55-fw4j-pvpx](GHSA-rx55-fw4j-pvpx)) ([#10790](#10790)) ([e895091](e895091))
Contributor
|
🎉 This change has been released in version 9.10.5-alpha.9 |
parseplatformorg
pushed a commit
that referenced
this pull request
Oct 16, 2026
## [9.10.5](9.10.4...9.10.5) (2026-10-16) ### Bug Fixes * Custom auth adapters that extend the AuthAdapter class accept any authData ([GHSA-rq3w-5c6f-p7wr](GHSA-rq3w-5c6f-p7wr)) ([#10773](#10773)) ([bee4082](bee4082)) * Installation update is written to the installation named by the request's installation ID instead of the addressed object ([GHSA-8j8q-73xx-w3m4](GHSA-8j8q-73xx-w3m4)) ([#10792](#10792)) ([256a253](256a253)) * LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens ([GHSA-349r-988w-x3jp](GHSA-349r-988w-x3jp)) ([#10776](#10776)) ([a7821c6](a7821c6)) * Login with master key overwrites stored MFA settings of user ([#10771](#10771)) ([28bb53b](28bb53b)) * Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error ([#10775](#10775)) ([c56ccdf](c56ccdf)) * Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access ([GHSA-9rvr-f5hc-9f2f](GHSA-9rvr-f5hc-9f2f)) ([#10788](#10788)) ([0b33504](0b33504)) * Object write with a crafted key can pollute a shared prototype and cause denial of service ([GHSA-rx55-fw4j-pvpx](GHSA-rx55-fw4j-pvpx)) ([#10790](#10790)) ([e895091](e895091)) * Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events ([GHSA-969q-274f-mc7w](GHSA-969q-274f-mc7w)) ([#10786](#10786)) ([6dab17c](6dab17c)) * Option `requestKeywordDenylist` does not apply to query parameters `keys`, `include` and `excludeKeys` ([#10793](#10793)) ([e220f51](e220f51)) * Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL ([GHSA-58m4-cqvw-4vgh](GHSA-58m4-cqvw-4vgh)) ([#10783](#10783)) ([36af858](36af858)) * SMS MFA login code request saves other login request fields with master privileges ([GHSA-9rh6-r4ph-367v](GHSA-9rh6-r4ph-367v)) ([#10781](#10781)) ([e2a1474](e2a1474))
Contributor
|
🎉 This change has been released in version 9.10.5 |
beiguancyc
added a commit
to beiguancyc/parse-server
that referenced
this pull request
Oct 21, 2026
* release: (158 commits) chore(release): 9.10.5 [skip ci] empty commit to trigger CI chore(release): 9.10.5-alpha.11 [skip ci] fix: Option `requestKeywordDenylist` does not apply to query parameters `keys`, `include` and `excludeKeys` (parse-community#10793) chore(release): 9.10.5-alpha.10 [skip ci] fix: Installation update is written to the installation named by the request's installation ID instead of the addressed object ([GHSA-8j8q-73xx-w3m4](GHSA-8j8q-73xx-w3m4)) (parse-community#10792) chore(release): 9.10.5-alpha.9 [skip ci] fix: Object write with a crafted key can pollute a shared prototype and cause denial of service ([GHSA-rx55-fw4j-pvpx](GHSA-rx55-fw4j-pvpx)) (parse-community#10790) chore(release): 9.10.5-alpha.8 [skip ci] fix: Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access ([GHSA-9rvr-f5hc-9f2f](GHSA-9rvr-f5hc-9f2f)) (parse-community#10788) chore(release): 9.10.5-alpha.7 [skip ci] fix: Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events ([GHSA-969q-274f-mc7w](GHSA-969q-274f-mc7w)) (parse-community#10786) chore(release): 9.10.5-alpha.6 [skip ci] fix: Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL ([GHSA-58m4-cqvw-4vgh](GHSA-58m4-cqvw-4vgh)) (parse-community#10783) chore(release): 9.10.5-alpha.5 [skip ci] fix: SMS MFA login code request saves other login request fields with master privileges ([GHSA-9rh6-r4ph-367v](GHSA-9rh6-r4ph-367v)) (parse-community#10781) chore(release): 9.10.5-alpha.4 [skip ci] fix: LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens ([GHSA-349r-988w-x3jp](GHSA-349r-988w-x3jp)) (parse-community#10776) chore(release): 9.10.5-alpha.3 [skip ci] fix: Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error (parse-community#10775) ... # Conflicts: # package-lock.json # package.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
Object write with a crafted key can pollute a shared prototype and cause denial of service (GHSA-rx55-fw4j-pvpx)
Tasks