security check

Author: mtrezza

spec/SecurityCheckGroups.spec.js

@@ -34,6 +34,8 @@ describe('Security Check Groups', () => {
       config.allowClientClassCreation = false;
       config.enableInsecureAuthAdapters = false;
       config.graphQLPublicIntrospection = false;
+      config.databaseAdapter = undefined;
+      config.databaseOptions = { allowPublicExplain: false };
       await reconfigureServer(config);
 
       const group = new CheckGroupServerConfig();
@@ -43,13 +45,16 @@ describe('Security Check Groups', () => {
       expect(group.checks()[2].checkState()).toBe(CheckState.success);
       expect(group.checks()[4].checkState()).toBe(CheckState.success);
       expect(group.checks()[5].checkState()).toBe(CheckState.success);
+      expect(group.checks()[6].checkState()).toBe(CheckState.success);
     });
 
     it('checks fail correctly', async () => {
       config.masterKey = 'insecure';
       config.security.enableCheckLog = true;
       config.allowClientClassCreation = true;
       config.graphQLPublicIntrospection = true;
+      config.databaseAdapter = undefined;
+      config.databaseOptions = { allowPublicExplain: true };
       await reconfigureServer(config);
 
       const group = new CheckGroupServerConfig();
@@ -59,6 +64,7 @@ describe('Security Check Groups', () => {
       expect(group.checks()[2].checkState()).toBe(CheckState.fail);
       expect(group.checks()[4].checkState()).toBe(CheckState.fail);
       expect(group.checks()[5].checkState()).toBe(CheckState.fail);
+      expect(group.checks()[6].checkState()).toBe(CheckState.fail);
     });
   });
 

src/Security/CheckGroups/CheckGroupServerConfig.js

@@ -90,6 +90,21 @@ class CheckGroupServerConfig extends CheckGroup {
           }
         },
       }),
+      new Check({
+        title: 'Public database explain disabled',
+        warning:
+          'Database explain queries are publicly accessible, which may expose sensitive database performance information and schema details.',
+        solution:
+          "Change Parse Server configuration to 'databaseOptions.allowPublicExplain: false'. You will need to use master key to run explain queries.",
+        check: () => {
+          if (
+            config.databaseOptions?.allowPublicExplain === true ||
+            config.databaseOptions?.allowPublicExplain == null
+          ) {
+            throw 1;
+          }
+        },
+      }),
     ];
   }
 }