Add Security Checks Log

spec/ParseServer.Security.spec.js

@@ -0,0 +1,55 @@
+'use strict';
+const Parse = require('parse/node');
+const request = require('../lib/request');
+
+const masterKeyHeaders = {
+  'X-Parse-Application-Id': 'test',
+  'X-Parse-Rest-API-Key': 'rest',
+  'X-Parse-Master-Key': 'test',
+  'Content-Type': 'application/json',
+};
+const masterKeyOptions = {
+  headers: masterKeyHeaders,
+  json: true,
+};
+
+describe('SecurityChecks', () => {
+  it('can get security advice', async done => {
+    await reconfigureServer({
+      securityChecks: {
+        enabled: true,
+        logOutput: true,
+      },
+    });
+    const options = Object.assign({}, masterKeyOptions, {
+      method: 'GET',
+      url: Parse.serverURL + '/securityChecks',
+    });
+    request(options).then(res => {
+      expect(res.data.Security).not.toBeUndefined();
+      expect(res.data.CLP).not.toBeUndefined();
+      expect(res.data.Total).not.toBeUndefined();
+      done();
+    });
+  });
+
+  it('can get security on start', async done => {
+    await reconfigureServer({
+      securityChecks: {
+        enabled: true,
+        logOutput: true,
+      },
+    });
+    const logger = require('../lib/logger').logger;
+    spyOn(logger, 'warn').and.callFake(() => {});
+    await new Promise(resolve => {
+      setTimeout(() => {
+        resolve();
+      }, 2000);
+    });
+    expect(logger.warn.calls.mostRecent().args[0]).toContain(
+      'Allow Client Class Creation is not recommended.'
+    );
+    done();
+  });
+});

src/Options/Definitions.js

@@ -11,6 +11,11 @@ module.exports.ParseServerOptions = {
     help: 'account lockout policy for failed login attempts',
     action: parsers.objectParser,
   },
+  securityChecks: {
+    env: 'PARSE_SERVER_SECURITY_CHECKS',
+    help: 'view recommendations for server improvements',
+    default: {},
+  },
   allowClientClassCreation: {
     env: 'PARSE_SERVER_ALLOW_CLIENT_CLASS_CREATION',
     help: 'Enable (or disable) client class creation, defaults to true',

src/ParseServer.js

@@ -40,6 +40,7 @@ import { AggregateRouter } from './Routers/AggregateRouter';
 import { ParseServerRESTController } from './ParseServerRESTController';
 import * as controllers from './Controllers';
 import { ParseGraphQLServer } from './GraphQL/ParseGraphQLServer';
+import { securityChecks } from './SecurityChecks.js';
 
 // Mutate the Parse object to add the Cloud Code handlers
 addParseCloud();
@@ -80,6 +81,9 @@ class ParseServer {
         if (serverStartComplete) {
           serverStartComplete();
         }
+        if (options.securityChecks.logOutput) {
+          this.getSecurityChecks();
+        }
       })
       .catch(error => {
         if (serverStartComplete) {
@@ -109,6 +113,34 @@ class ParseServer {
     return this._app;
   }
 
+  async getSecurityChecks() {
+    const config = Config.get(this.config.appId);
+    const response = await securityChecks(config);
+    const logger = logging.getLogger();
+    const warnings = response.response;
+    const security = warnings.Security || [];
+    const clp = warnings.CLP || [];
+    const total = warnings.Total;
+    if (total == 0) {
+      return;
+    }
+    let errorString = `We found ${total} improvement${
+      total == 1 ? '' : 's'
+    } for you to make on your Parse Server:\n\n`;
+    for (const issue of security) {
+      errorString += ` -${issue.title}\n`;
+      errorString += `   ${issue.message}\n\n`;
+    }
+    for (const issue in clp) {
+      errorString += `\n Add CLP for Class: ${issue}\n`;
+      const classData = clp[issue];
+      for (const clpIssue of classData) {
+        errorString += `   ${clpIssue.title}\n`;
+      }
+    }
+    logger.warn(errorString);
+  }
+
   handleShutdown() {
     const promises = [];
     const { adapter: databaseAdapter } = this.config.databaseController;

src/Routers/CloudCodeRouter.js

@@ -1,6 +1,7 @@
 import PromiseRouter from '../PromiseRouter';
 import Parse from 'parse/node';
 import rest from '../rest';
+import { securityChecks } from '../SecurityChecks.js';
 const triggers = require('../triggers');
 const middleware = require('../middlewares');
 
@@ -53,6 +54,7 @@ export class CloudCodeRouter extends PromiseRouter {
       middleware.promiseEnforceMasterKeyAccess,
       CloudCodeRouter.deleteJob
     );
+    this.route('GET', '/securityChecks', middleware.promiseEnforceMasterKeyAccess, securityChecks);
   }
 
   static getJobs(req) {

src/SecurityChecks.js

@@ -0,0 +1,167 @@
+import { getTrigger } from './triggers.js';
+import url from 'url';
+import Parse from 'parse/node';
+export async function securityChecks(req) {
+  try {
+    const options = req.config || req;
+    if (!options.securityChecks.enabled && options.securityChecks.enabled != null) {
+      return { error: { code: 1, error: 'Security checks are not enabled.' } };
+    }
+    const clpWarnings = {};
+    const securityWarnings = [];
+    let totalWarnings = 0;
+    if (options.allowClientClassCreation) {
+      securityWarnings.push({
+        title: 'Allow Client Class Creation is not recommended.',
+        message:
+          'Allow client class creation is not recommended for production servers it allows any user - authorized or not - to create a new class.',
+        link: 'https://docs.parseplatform.org/js/guide/#restricting-class-creation',
+      });
+    }
+    const schema = await options.database.loadSchema();
+    const all = await schema.getAllClasses();
+    for (const field of all) {
+      const className = field.className;
+      const clp = field.classLevelPermissions;
+      const thisClassWarnings = clpWarnings[className] || [];
+      if (!clp) {
+        totalWarnings++;
+        thisClassWarnings.push({
+          title: `No Class Level Permissions on ${className}`,
+          message:
+            'Class level permissions are a security feature from that allows one to restrict access on a broader way than the ACL based permissions. We recommend implementing CLPs on all database classes.',
+          link: 'https://docs.parseplatform.org/parse-server/guide/#class-level-permissions',
+        });
+        clpWarnings[className] = thisClassWarnings;
+        continue;
+      }
+      const keys = ['find', 'count', 'get', 'create', 'update', 'delete', 'addField'];
+      for (const key of keys) {
+        const option = clp[key];
+        if (className === '_User' && key === 'create') {
+          continue;
+        }
+        if (!option || option['*']) {
+          totalWarnings++;
+          thisClassWarnings.push({
+            title: `Unrestricted access to ${key}.`,
+            message: `We recommend restricting ${key} on all classes`,
+            link: 'https://docs.parseplatform.org/parse-server/guide/#class-level-permissions',
+          });
+        } else if (Object.keys(option).length != 0 && key === 'addField') {
+          totalWarnings++;
+          thisClassWarnings.push({
+            title: `Certain users can add fields.`,
+            message:
+              'Class level permissions are a security feature from that allows one to restrict access on a broader way than the ACL based permissions. We recommend implementing CLPs on all database classes.',
+            link: 'https://docs.parseplatform.org/parse-server/guide/#class-level-permissions',
+          });
+        }
+      }
+      clpWarnings[className] = thisClassWarnings;
+    }
+    const fileTrigger = getTrigger('@File', 'beforeSaveFile', options.appId);
+    if (!fileTrigger) {
+      totalWarnings++;
+      securityWarnings.push({
+        title: `No beforeFileSave Trigger`,
+        message:
+          "Even if you don't store files, we strongly recommend using a beforeFileSave trigger to prevent unauthorized uploads.",
+        link: 'https://docs.parseplatform.org/cloudcode/guide/#beforesavefile',
+      });
+    } else {
+      try {
+        const file = new Parse.File('testpopeye.txt', [1, 2, 3], 'text/plain');
+        await file.save();
+        totalWarnings++;
+        securityWarnings.push({
+          title: `Unrestricted access to file uploads`,
+          message:
+            'Even though you have a beforeFileSave trigger, it allows unregistered users to upload.',
+          link: 'https://docs.parseplatform.org/cloudcode/guide/#beforesavefile',
+        });
+        await options.filesController.deleteFile(file._name);
+      } catch (e) {
+        /* */
+      }
+    }
+    let https = false;
+    try {
+      const serverURL = url.parse(options.serverURL);
+      https = serverURL.protocol === 'https:';
+    } catch (e) {
+      /* */
+    }
+    if (!https) {
+      totalWarnings++;
+      securityWarnings.push({
+        title: `Server served over HTTP`,
+        message: 'We strongly recommend using a HTTPS protocol.',
+      });
+    }
+    let databaseURI = options.databaseURI;
+    let protocol;
+    try {
+      const parsedURI = url.parse(databaseURI);
+      protocol = parsedURI.protocol ? parsedURI.protocol.toLowerCase() : null;
+    } catch (e) {
+      /* */
+    }
+    if (protocol !== 'postgres:') {
+      if (databaseURI.includes('@')) {
+        databaseURI = `mongodb://${databaseURI.split('@')[1]}`;
+        const pwd = options.databaseURI.split('//')[1].split('@')[0].split(':')[1] || '';
+        if (!pwd.match('^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[!@#$%^&*])(?=.{14,})')) {
+          // DB string must contain at least 1 lowercase alphabetical character
+          // DB string must contain at least 1 uppercase alphabetical character
+          // DB string must contain at least 1 numeric character
+          // DB string must contain at least one special character
+          // DB string must be 14 characters or longer
+          securityWarnings.push({
+            title: `Weak Database Password`,
+            message: 'The password used to connect to your database could be stronger.',
+            link: 'https://docs.mongodb.com/manual/security/',
+          });
+          totalWarnings++;
+        }
+      }
+      let databaseAdmin = '' + databaseURI;
+      try {
+        const parsedURI = url.parse(databaseAdmin);
+        parsedURI.port = '27017';
+        databaseAdmin = parsedURI.toString();
+      } catch (e) {
+        /* */
+      }
+      const mongodb = require('mongodb');
+      const MongoClient = mongodb.MongoClient;
+      try {
+        await MongoClient.connect(databaseAdmin, { useNewUrlParser: true });
+        securityWarnings.push({
+          title: `Unrestricted access to port 27017`,
+          message:
+            'It is possible to connect to the admin port of your mongoDb without authentication.',
+          link: 'https://docs.mongodb.com/manual/security/',
+        });
+        totalWarnings++;
+      } catch (e) {
+        /* */
+      }
+      try {
+        await MongoClient.connect(databaseURI, { useNewUrlParser: true });
+        securityWarnings.push({
+          title: `Unrestricted access to your database`,
+          message:
+            'It is possible to connect to your mongoDb without username and password on your connection string.',
+          link: 'https://docs.mongodb.com/manual/security/',
+        });
+        totalWarnings++;
+      } catch (e) {
+        /* */
+      }
+    }
+    return { response: { Security: securityWarnings, CLP: clpWarnings, Total: totalWarnings } };
+  } catch (error) {
+    return { error: { code: 1, error: error.message || 'Internal Server Error.' } };
+  }
+}