fix: Server internal error details leaking in error messages returned to clients

spec/AudienceRouter.spec.js

@@ -2,6 +2,7 @@ const auth = require('../lib/Auth');
 const Config = require('../lib/Config');
 const rest = require('../lib/rest');
 const request = require('../lib/request');
+const { getSanitizedErrorCall } = require('../lib/TestUtils');
 const AudiencesRouter = require('../lib/Routers/AudiencesRouter').AudiencesRouter;
 
 describe('AudiencesRouter', () => {
@@ -263,55 +264,75 @@ describe('AudiencesRouter', () => {
   });
 
   it('should only create with master key', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     Parse._request('POST', 'push_audiences', {
       name: 'My Audience',
       query: JSON.stringify({ deviceType: 'ios' }),
     }).then(
       () => {},
       error => {
-        expect(error.message).toEqual('unauthorized: master key is required');
+        expect(error.message).toEqual('Permission denied');
+        sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
         done();
       }
     );
   });
 
   it('should only find with master key', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     Parse._request('GET', 'push_audiences', {}).then(
       () => {},
       error => {
-        expect(error.message).toEqual('unauthorized: master key is required');
+        expect(error.message).toEqual('Permission denied');
+        sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
         done();
       }
     );
   });
 
   it('should only get with master key', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     Parse._request('GET', `push_audiences/someId`, {}).then(
       () => {},
       error => {
-        expect(error.message).toEqual('unauthorized: master key is required');
+        expect(error.message).toEqual('Permission denied');
+        sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
         done();
       }
     );
   });
 
   it('should only update with master key', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     Parse._request('PUT', `push_audiences/someId`, {
       name: 'My Audience 2',
     }).then(
       () => {},
       error => {
-        expect(error.message).toEqual('unauthorized: master key is required');
+        expect(error.message).toEqual('Permission denied');
+        sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
         done();
       }
     );
   });
 
   it('should only delete with master key', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     Parse._request('DELETE', `push_audiences/someId`, {}).then(
       () => {},
       error => {
-        expect(error.message).toEqual('unauthorized: master key is required');
+        expect(error.message).toEqual('Permission denied');
+        sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
         done();
       }
     );

spec/LogsRouter.spec.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const request = require('../lib/request');
+const { getSanitizedErrorCall } = require('../lib/TestUtils');
 const LogsRouter = require('../lib/Routers/LogsRouter').LogsRouter;
 const LoggerController = require('../lib/Controllers/LoggerController').LoggerController;
 const WinstonLoggerAdapter = require('../lib/Adapters/Logger/WinstonLoggerAdapter')
@@ -52,6 +53,9 @@ describe_only(() => {
   });
 
   it('can check invalid master key of request', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     request({
       url: 'http://localhost:8378/1/scriptlog',
       headers: {
@@ -61,7 +65,8 @@ describe_only(() => {
     }).then(fail, response => {
       const body = response.data;
       expect(response.status).toEqual(403);
-      expect(body.error).toEqual('unauthorized: master key is required');
+      expect(body.error).toEqual('Permission denied');
+      sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
       done();
     });
   });

spec/ParseAPI.spec.js

@@ -6,7 +6,7 @@ const request = require('../lib/request');
 const Parse = require('parse/node');
 const Config = require('../lib/Config');
 const SchemaController = require('../lib/Controllers/SchemaController');
-const TestUtils = require('../lib/TestUtils');
+const { getSanitizedErrorCall, destroyAllDataPermanently } = require('../lib/TestUtils');
 
 const userSchema = SchemaController.convertSchemaToAdapterSchema({
   className: '_User',
@@ -169,7 +169,7 @@ describe('miscellaneous', () => {
     }
     const config = Config.get('test');
     // Remove existing data to clear out unique index
-    TestUtils.destroyAllDataPermanently()
+    destroyAllDataPermanently()
       .then(() => config.database.adapter.performInitialization({ VolatileClassesSchemas: [] }))
       .then(() => config.database.adapter.createClass('_User', userSchema))
       .then(() =>
@@ -210,7 +210,7 @@ describe('miscellaneous', () => {
   it_id('d00f907e-41b9-40f6-8168-63e832199a8c')(it)('ensure that if people already have duplicate emails, they can still sign up new users', done => {
     const config = Config.get('test');
     // Remove existing data to clear out unique index
-    TestUtils.destroyAllDataPermanently()
+    destroyAllDataPermanently()
       .then(() => config.database.adapter.performInitialization({ VolatileClassesSchemas: [] }))
       .then(() => config.database.adapter.createClass('_User', userSchema))
       .then(() =>
@@ -1710,11 +1710,14 @@ describe('miscellaneous', () => {
   });
 
   it('fail on purge all objects in class without master key', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
     const headers = {
       'Content-Type': 'application/json',
       'X-Parse-Application-Id': 'test',
       'X-Parse-REST-API-Key': 'rest',
     };
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     request({
       method: 'DELETE',
       headers: headers,
@@ -1724,7 +1727,8 @@ describe('miscellaneous', () => {
         fail('Should not succeed');
       })
       .catch(response => {
-        expect(response.data.error).toEqual('unauthorized: master key is required');
+        expect(response.data.error).toEqual('Permission denied');
+        sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
         done();
       });
   });

spec/ParseFile.spec.js

@@ -5,6 +5,7 @@
 
 const { FilesController } = require('../lib/Controllers/FilesController');
 const request = require('../lib/request');
+const { getSanitizedErrorCall } = require('../lib/TestUtils');
 
 const str = 'Hello World!';
 const data = [];
@@ -132,6 +133,8 @@ describe('Parse.File testing', () => {
     });
 
     it('blocks file deletions with missing or incorrect master-key header', done => {
+      const sanitizedErrorCall = getSanitizedErrorCall();
+
       const headers = {
         'Content-Type': 'image/jpeg',
         'X-Parse-Application-Id': 'test',
@@ -146,6 +149,7 @@ describe('Parse.File testing', () => {
         const b = response.data;
         expect(b.url).toMatch(/^http:\/\/localhost:8378\/1\/files\/test\/.*thefile.jpg$/);
         // missing X-Parse-Master-Key header
+        const callCountBefore = sanitizedErrorCall.callCountBefore();
         request({
           method: 'DELETE',
           headers: {
@@ -156,8 +160,10 @@ describe('Parse.File testing', () => {
         }).then(fail, response => {
           const del_b = response.data;
           expect(response.status).toEqual(403);
-          expect(del_b.error).toMatch(/unauthorized/);
+          expect(del_b.error).toBe('Permission denied');
+          sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
           // incorrect X-Parse-Master-Key header
+          const callCountBefore2 = sanitizedErrorCall.callCountBefore();
           request({
             method: 'DELETE',
             headers: {
@@ -169,7 +175,8 @@ describe('Parse.File testing', () => {
           }).then(fail, response => {
             const del_b2 = response.data;
             expect(response.status).toEqual(403);
-            expect(del_b2.error).toMatch(/unauthorized/);
+            expect(del_b2.error).toBe('Permission denied');
+            sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore2);
             done();
           });
         });
@@ -756,11 +763,16 @@ describe('Parse.File testing', () => {
 
   describe('getting files', () => {
     it('does not crash on file request with invalid app ID', async () => {
+      const { getSanitizedErrorCall } = require('../lib/TestUtils');
+      const sanitizedErrorCall = getSanitizedErrorCall();
+
+      const callCountBefore = sanitizedErrorCall.callCountBefore();
       const res1 = await request({
         url: 'http://localhost:8378/1/files/invalid-id/invalid-file.txt',
       }).catch(e => e);
       expect(res1.status).toBe(403);
-      expect(res1.data).toEqual({ code: 119, error: 'Invalid application ID.' });
+      expect(res1.data).toEqual({ code: 119, error: 'Permission denied' });
+      sanitizedErrorCall.checkMessage('Invalid application ID.', callCountBefore);
       // Ensure server did not crash
       const res2 = await request({ url: 'http://localhost:8378/1/health' });
       expect(res2.status).toEqual(200);

spec/ParseGlobalConfig.spec.js

@@ -2,6 +2,7 @@
 
 const request = require('../lib/request');
 const Config = require('../lib/Config');
+const { getSanitizedErrorCall } = require('../lib/TestUtils');
 
 describe('a GlobalConfig', () => {
   beforeEach(async () => {
@@ -220,6 +221,9 @@ describe('a GlobalConfig', () => {
   });
 
   it('fail to update if master key is missing', done => {
+    const sanitizedErrorCall = getSanitizedErrorCall();
+
+    const callCountBefore = sanitizedErrorCall.callCountBefore();
     request({
       method: 'PUT',
       url: 'http://localhost:8378/1/config',
@@ -233,7 +237,8 @@ describe('a GlobalConfig', () => {
     }).then(fail, response => {
       const body = response.data;
       expect(response.status).toEqual(403);
-      expect(body.error).toEqual('unauthorized: master key is required');
+      expect(body.error).toEqual('Permission denied');
+      sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
       done();
     });
   });

spec/ParseGraphQLServer.spec.js

@@ -35,6 +35,7 @@ const { ParseServer } = require('../');
 const { ParseGraphQLServer } = require('../lib/GraphQL/ParseGraphQLServer');
 const { ReadPreference, Collection } = require('mongodb');
 const { v4: uuidv4 } = require('uuid');
+const { getSanitizedErrorCall } = require('../lib/TestUtils');
 
 function handleError(e) {
   if (e && e.networkError && e.networkError.result && e.networkError.result.errors) {
@@ -3488,6 +3489,9 @@ describe('ParseGraphQLServer', () => {
         });
 
         it('should require master key to create a new class', async () => {
+          const sanitizedErrorCall = getSanitizedErrorCall();
+
+          const callCountBefore = sanitizedErrorCall.callCountBefore();
           try {
             await apolloClient.mutate({
               mutation: gql`
@@ -3501,7 +3505,8 @@ describe('ParseGraphQLServer', () => {
             fail('should fail');
           } catch (e) {
             expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
-            expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
+            expect(e.graphQLErrors[0].message).toEqual('Permission denied');
+            sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
           }
         });
 
@@ -3858,6 +3863,9 @@ describe('ParseGraphQLServer', () => {
             handleError(e);
           }
 
+          const sanitizedErrorCall = getSanitizedErrorCall();
+
+          const callCountBefore = sanitizedErrorCall.callCountBefore();
           try {
             await apolloClient.mutate({
               mutation: gql`
@@ -3871,7 +3879,8 @@ describe('ParseGraphQLServer', () => {
             fail('should fail');
           } catch (e) {
             expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
-            expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
+            expect(e.graphQLErrors[0].message).toEqual('Permission denied');
+            sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
           }
         });
 
@@ -4083,6 +4092,10 @@ describe('ParseGraphQLServer', () => {
             handleError(e);
           }
 
+          const { getSanitizedErrorCall } = require('../lib/TestUtils');
+          const sanitizedErrorCall = getSanitizedErrorCall();
+
+          const callCountBefore = sanitizedErrorCall.callCountBefore();
           try {
             await apolloClient.mutate({
               mutation: gql`
@@ -4096,7 +4109,8 @@ describe('ParseGraphQLServer', () => {
             fail('should fail');
           } catch (e) {
             expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
-            expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
+            expect(e.graphQLErrors[0].message).toEqual('Permission denied');
+            sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
           }
         });
 
@@ -4124,6 +4138,10 @@ describe('ParseGraphQLServer', () => {
         });
 
         it('should require master key to get an existing class', async () => {
+          const { getSanitizedErrorCall } = require('../lib/TestUtils');
+          const sanitizedErrorCall = getSanitizedErrorCall();
+
+          const callCountBefore = sanitizedErrorCall.callCountBefore();
           try {
             await apolloClient.query({
               query: gql`
@@ -4137,11 +4155,16 @@ describe('ParseGraphQLServer', () => {
             fail('should fail');
           } catch (e) {
             expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
-            expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
+            expect(e.graphQLErrors[0].message).toEqual('Permission denied');
+            sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
           }
         });
 
         it('should require master key to find the existing classes', async () => {
+          const { getSanitizedErrorCall } = require('../lib/TestUtils');
+          const sanitizedErrorCall = getSanitizedErrorCall();
+
+          const callCountBefore = sanitizedErrorCall.callCountBefore();
           try {
             await apolloClient.query({
               query: gql`
@@ -4155,7 +4178,8 @@ describe('ParseGraphQLServer', () => {
             fail('should fail');
           } catch (e) {
             expect(e.graphQLErrors[0].extensions.code).toEqual(Parse.Error.OPERATION_FORBIDDEN);
-            expect(e.graphQLErrors[0].message).toEqual('unauthorized: master key is required');
+            expect(e.graphQLErrors[0].message).toEqual('Permission denied');
+            sanitizedErrorCall.checkMessage('unauthorized: master key is required', callCountBefore);
           }
         });
       });
@@ -6081,7 +6105,7 @@ describe('ParseGraphQLServer', () => {
             }
 
             await expectAsync(createObject('GraphQLClass')).toBeRejectedWith(
-              jasmine.stringMatching('Permission denied for action create on class GraphQLClass')
+              jasmine.stringMatching('Permission denied')
             );
             await expectAsync(createObject('PublicClass')).toBeResolved();
             await expectAsync(
@@ -6115,7 +6139,7 @@ describe('ParseGraphQLServer', () => {
                 'X-Parse-Session-Token': user4.getSessionToken(),
               })
             ).toBeRejectedWith(
-              jasmine.stringMatching('Permission denied for action create on class GraphQLClass')
+              jasmine.stringMatching('Permission denied')
             );
             await expectAsync(
               createObject('PublicClass', {

spec/ParseInstallation.spec.js

@@ -176,7 +176,7 @@ describe('Installations', () => {
       .catch(error => {
         expect(error.code).toBe(119);
         expect(error.message).toBe(
-          "Clients aren't allowed to perform the find operation on the installation collection."
+          'Permission denied'
         );
         done();
       });