CVE-2022-31089 (JavaScript, published 2022-06-27T21:15Z)
Description: value: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be high. This issue has been addressed in versions 4.10.12 and 5.2.3. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-706 \u2014 Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/parse-community/parse-server
Files changed:
spec/ParseFile.spec.js
src/Routers/FilesRouter.js
Commit message: fix: invalid file request not properly handled; this fixes a security vulnerability in which an invalid file request can crash the server ([GHSA-xw6g-jjvf-wwf9](https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9)) (#8060)



Vulnerable code:
    const config = Config.get(req.params.appId);
    const { filesController } = config;
    const { filename } = req.params;

Fixed code:
  describe('getting files', () => {
    it('does not crash on file request with invalid app ID', async () => {
      const res1 = await request({
        url: 'http://localhost:8378/1/files/invalid-id/invalid-file.txt',
      }).catch(e => e);
      expect(res1.status).toBe(403);
      expect(res1.data).toEqual({ code: 119, error: 'Invalid application ID.' });
      // Ensure server did not crash
      const res2 = await request({ url: 'http://localhost:8378/1/health' });
      expect(res2.status).toEqual(200);
      expect(res2.data).toEqual({ status: 'ok' });
    });

    it('does not crash on file request with invalid path', async () => {
      const res1 = await request({
        url: 'http://localhost:8378/1/files/invalid-id//invalid-path/%20/invalid-file.txt',
      }).catch(e => e);
      expect(res1.status).toBe(403);
      expect(res1.data).toEqual({ error: 'unauthorized' });
      // Ensure server did not crash
      const res2 = await request({ url: 'http://localhost:8378/1/health' });
      expect(res2.status).toEqual(200);
      expect(res2.data).toEqual({ status: 'ok' });
    });

    it('does not crash on file metadata request with invalid app ID', async () => {
      const res1 = await request({
        url: `http://localhost:8378/1/files/invalid-id/metadata/invalid-file.txt`,
      });
      expect(res1.status).toBe(200);
      expect(res1.data).toEqual({});
      // Ensure server did not crash
      const res2 = await request({ url: 'http://localhost:8378/1/health' });
      expect(res2.status).toEqual(200);
      expect(res2.data).toEqual({ status: 'ok' });
    });
  });

    if (!config) {
      res.status(403);
      const err = new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Invalid application ID.');
      res.json({ code: err.code, error: err.message });
      return;
    }
      const config = Config.get(req.params.appId);
      const { filesController } = config;
      const { filename } = req.params;