v5.8.2 - Batch Credentials, Regex Checks, Agent and Webhook Trust

[AdrianCurtin]

Summary

Release 5.8.2: a security and correctness patch scoped from the 5.8.1 backlog survey. It fixes batch writes that ran with the master key, agents that fell back to master posture when their session could not be resolved, session reads served from the response cache after revocation, ReDoS checks that most regex paths skipped, and webhook master trust on unauthenticated ingress, plus transport and redaction gaps found in review. No new features beyond the session: arguments and the cache opt-in the fixes need; intentional master-key and analytics access is unchanged.

Batches and transactions

• Parse Server runs every sub-request of POST /batch under the outer call's credentials. Array#save, Array#destroy, Parse.batch, and transaction sent everything through the default client, so writes built for a user session ran as master. Each write now goes out under the credentials it would have as a single request (options, session header, master-key suppression header, class client, ambient session), grouped by a credential fingerprint.
• A client chosen explicitly (BatchOperation#client= or the batch_request receiver) is used for every request. Mixed-credential non-transactional batches are split per group with responses in order; a transaction that mixes credentials raises MixedAuthorityError before anything is sent.
• use_master_key counts only when exactly true or false, and a session that resolves to no token fails closed. Array#save, Array#destroy, and transaction accept session:.

Agents

• A session-token agent whose token cannot be resolved no longer runs the SDK-side permission checks as master. It retries on first use (outside the scope lock, with a 5-second backoff) and otherwise raises Parse::Agent::UnresolvedIdentity.
• Scope reads, impersonate, and refresh_scope! are consistent under concurrency; sub-agents reuse a parent scope only from a locked snapshot; stop_impersonating! is a no-op unless impersonating.
• Agent and Client inspect, to_s, as_json, to_json, and to_yaml are redacted, and both refuse Marshal.dump.

Response cache

• Reads made with a session token bypass the response cache by default, so a revoked session or a user who lost access no longer reads cached rows until expiry. Opt back in with cache_session_requests (globally or per client). Master-key and anonymous caching is unchanged.

Regex and direct reads

• Raw $regex in REST where hashes and every mongo-direct filter and pipeline now go through Parse::RegexSecurity, which parses each pattern instead of matching substrings: it refuses nested, alternation, optional, and subroutine repeats, long runs of wide quantifiers, comments, and extended mode, and accepts single-atom repeats, simple lookarounds, and non-overlapping alternations and separator runs.
• Mongo-direct reads carrying a non-literal regex get a default 5-second max_time_ms. Parse::MongoDB.find raises ACLRequired inside without_master_key.

Webhooks

• A webhook master claim is trusted only on authenticated ingress (webhook key or verified signature). Forged claims under allow_unauthenticated no longer pass master-only guards, ACL owner resolution, handler checks, or callback dedup.

Transport and redaction

• Blank and whitespace MCP API keys count as no key. Scheme checks are case-insensitive; the TLS guard covers verify_mode, verify_hostname, SSLOptions, and ConnectionOptions. LiveQuery URLs are validated, and http(s):// maps to ws(s):// with a deprecation warning.
• Hydrated Parse::File URLs are normalized the way a browser reads them and checked against trusted_url_hosts, including scheme-relative and non-http(s) values.
• Redaction covers MFA recovery codes, storage-form credential columns, header-shaped text, and whole quoted values, and runs on string values so Response#to_s stays valid JSON.

Behavior changes for upgrading apps

CHANGELOG.md lists each under Behavior Notes. The ones most likely to need changes:

• Batches of objects whose class is bound to a session client now run as that user; mixed-credential transactions raise.
• Custom agent handlers that test agent.acl_scope for truthiness should use agent.acl_scope?.
• Session-token queries with cache: true no longer hit the response cache.
• Regex patterns the parser refuses now raise; $options accepts i, m, s, u.
• Under allow_unauthenticated with no signing secret, payload.master? is false; configure a webhook key or signing secret.
• Response#to_s filters credential values; read #result for raw data.

Testing

• bundle exec rake test:unit passes.
• Integration files for every changed area pass against Parse Server 9.10.3 and MongoDB 9.0.2, including new tests for batch credentials and the webhook suite running with a configured webhook key. The test stack now sets PARSE_SERVER_WEBHOOK_KEY.
• Each fix has a regression test that fails on the previous code; batch credential parity is checked against the real auth middleware.