fix: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (GHSA-8cph-rgr4-g5vj) by mtrezza · Pull Request #10467 · parse-community/parse-server

mtrezza · May 17, 2026

Issue

GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (GHSA-8cph-rgr4-g5vj)

Tasks

Add tests

parse-github-assistant · May 17, 2026

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
Group code into logical blocks. Add a short comment before each block to explain its purpose.
We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

coderabbitai · May 17, 2026

📝 Walkthrough

Walkthrough

This PR adds a GraphQL validation error filtering mechanism that prevents "Did you mean" suggestions from leaking to unauthorized public users. A new Apollo Server plugin strips these schema hints when public introspection is disabled and the request lacks master or maintenance credentials, while preserving them for authorized callers.

Changes

Schema Suggestions Error Handling

Layer / File(s)	Summary
Schema suggestions plugin and server integration `src/GraphQL/ParseGraphQLServer.js`, `spec/ParseGraphQLServer.spec.js`	`SchemaSuggestionsControlPlugin` post-processes validation errors to remove trailing "Did you mean" hints for unauthorized users when introspection is off. Plugin is added to Apollo Server configuration. Tests confirm suggestions are stripped for public requests and retained when master key, maintenance key, or public introspection is enabled.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The pull request description is entirely missing; no content was provided by the author despite the template requiring Issue, Approach, and Tasks sections.	Add a complete pull request description following the provided template, including Issue (link to GHSA-8cph-rgr4-g5vj), Approach (summary of the plugin-based solution), and completed Tasks (tests added, security check applied).
Engage In Review Feedback	❓ Inconclusive	PR `#10467` is newly opened with no visible review comments in git history. Cannot access GitHub PR discussion threads where feedback would appear.	Manually review PR `#10467` on GitHub to check for review feedback comments and verify user engagement with any posted feedback.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	Secure fix for schema enumeration vulnerability. Plugin strips "Did you mean" from GraphQL validation errors with proper auth checks and safe implementation. No security issues detected.
Title check	✅ Passed	The title begins with 'fix:' prefix as required and clearly describes the security fix: preventing GraphQL 'Did you mean' validation suggestions from disclosing schema information to unauthenticated callers.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · May 17, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.57%. Comparing base (56c159e) to head (7429415).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10467   +/-   ##
=======================================
  Coverage   92.57%   92.57%           
=======================================
  Files         193      193           
  Lines       16874    16884   +10     
  Branches      234      234           
=======================================
+ Hits        15621    15631   +10     
  Misses       1230     1230           
  Partials       23       23

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

## [9.9.1-alpha.2](9.9.1-alpha.1...9.9.1-alpha.2) (2026-05-18) ### Bug Fixes * GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers ([GHSA-8cph-rgr4-g5vj](GHSA-8cph-rgr4-g5vj)) ([#10467](#10467)) ([155123a](155123a))

parseplatformorg · May 18, 2026

🎉 This change has been released in version 9.9.1-alpha.2

# [9.10.0](9.9.0...9.10.0) (2026-07-13) ### Bug Fixes * Cloud Code beforeFind trigger context is not isolated from prototype pollution ([#10570](#10570)) ([bea001e](bea001e)) * Cloud Function multipart requests bypass the maxUploadSize limit ([#10498](#10498)) ([f12e1c3](f12e1c3)) * Denial of service via exponential-time processing of deeply nested query operators ([GHSA-cgxm-vr2f-6fj8](GHSA-cgxm-vr2f-6fj8)) ([#10511](#10511)) ([1103c7a](1103c7a)) * Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied ([GHSA-75v4-m273-5j49](GHSA-75v4-m273-5j49)) ([#10492](#10492)) ([83e90ed](83e90ed)) * GeoPoint distance queries fail with an internal server error on MongoDB 8.3 and later ([#10572](#10572)) ([b706c22](b706c22)) * GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers ([GHSA-8cph-rgr4-g5vj](GHSA-8cph-rgr4-g5vj)) ([#10467](#10467)) ([155123a](155123a)) * GraphQL error messages disclose pointer and relation target class names when public introspection is disabled ([GHSA-r2g6-4f6j-f6rf](GHSA-r2g6-4f6j-f6rf)) ([#10568](#10568)) ([cb9b542](cb9b542)) * GraphQL error messages disclose required input field names when public introspection is disabled ([GHSA-2fgh-8j2g-w354](GHSA-2fgh-8j2g-w354)) ([#10566](#10566)) ([d96c945](d96c945)), closes [GHSA-2f#8j2g-w354](https://github.com/GHSA-2f/issues/8j2g-w354) [/github.com/parse-community/parse-server/security/advisories/GHSA-2f#8j2g-w354](https://github.com//github.com/parse-community/parse-server/security/advisories/GHSA-2f/issues/8j2g-w354) * GraphQL variable-coercion suggestions disclose schema to unauthenticated callers ([GHSA-9g8f-h8f3-hjcm](GHSA-9g8f-h8f3-hjcm)) ([#10563](#10563)) ([2625489](2625489)) * LiveQuery discloses object data to a subscriber across an ACL read-access change ([GHSA-97pr-9hgg-3p8r](GHSA-97pr-9hgg-3p8r)) ([#10515](#10515)) ([e9c85df](e9c85df)) * LiveQuery subscriptions leak when a client reuses a subscribe requestId ([#10499](#10499)) ([3fad4fb](3fad4fb)) * Middleware route checks do not match routing-equivalent path variants (trailing slash, case) ([#10501](#10501)) ([f861210](f861210)) * NumberOrBoolean config option (cluster) value not coerced from env/CLI ([#10531](#10531)) ([459786f](459786f)) * Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](GHSA-38m6-82c8-4xfm)) ([#10463](#10463)) ([56c159e](56c159e)) * rateLimit on exact static routes is bypassed by appending a query string ([#10500](#10500)) ([880e8e6](880e8e6)) * Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL ([GHSA-wmwx-jr2p-4j4r](GHSA-wmwx-jr2p-4j4r)) ([#10493](#10493)) ([43658f1](43658f1)) * Server option routeAllowList is bypassable through batch sub-requests ([GHSA-p84r-h6rx-f2xr](GHSA-p84r-h6rx-f2xr)) ([#10482](#10482)) ([552c6dd](552c6dd)) * Stored XSS via malformed Content-Type bypassing file upload extension blocklist ([GHSA-r899-h629-j84r](GHSA-r899-h629-j84r)) ([#10521](#10521)) ([cce91e5](cce91e5)) * Stored XSS via non-standard file extension bypassing file upload extension blocklist ([GHSA-v8x7-r927-cc93](GHSA-v8x7-r927-cc93)) ([#10505](#10505)) ([be12a60](be12a60)) * Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](GHSA-7wqv-xjf3-x35v)) ([#10489](#10489)) ([66484ce](66484ce)) ### Features * Add option to disallow aggregation pipelines for the read-only master key ([#10517](#10517)) ([816078f](816078f))

parseplatformorg · Jul 13, 2026

🎉 This change has been released in version 9.10.0

fix: GHSA-8cph-rgr4-g5vj

7429415

coderabbitai Bot approved these changes May 17, 2026

View reviewed changes

mtrezza changed the title ~~fix: GHSA-8cph-rgr4-g5vj~~ fix: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (GHSA-8cph-rgr4-g5vj) May 18, 2026

mtrezza merged commit 155123a into parse-community:alpha May 18, 2026
24 checks passed

parseplatformorg added the state:released-alpha Released as alpha version label May 18, 2026

github-actions Bot mentioned this pull request May 18, 2026

[Vulnerability] parse-community/parse-server: Information Disclosure 7azimo01/vulnerability-spoiler-alert#466

Open

mtrezza deleted the fix/GHSA-8cph-rgr4-g5vj-v9 branch May 18, 2026 18:56

coderabbitai Bot mentioned this pull request Jun 2, 2026

fix: GraphQL "Did you mean" suggestions disclose schema to unauthenticated callers (GHSA-8cph-rgr4-g5vj) #10491

Closed

cookesan mentioned this pull request Jun 29, 2026

Add parse-server GraphQL suggestion advisory references github/advisory-database#8260

Closed

parseplatformorg added the state:released Released as stable version label Jul 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (GHSA-8cph-rgr4-g5vj) - #10467

mtrezza commented May 17, 2026 •

edited

Loading

Uh oh!

parse-github-assistant Bot commented May 17, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 17, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

codecov Bot commented May 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

parseplatformorg commented May 18, 2026

Uh oh!

parseplatformorg commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Search code, repositories, users, issues, pull requests...

Uh oh!

Uh oh!

Conversation

mtrezza commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Tasks

Uh oh!

parse-github-assistant Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

codecov Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

parseplatformorg commented May 18, 2026

Uh oh!

parseplatformorg commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mtrezza commented May 17, 2026 •

edited

Loading

parse-github-assistant Bot commented May 17, 2026 •

edited

Loading

coderabbitai Bot commented May 17, 2026 •

edited

Loading

codecov Bot commented May 17, 2026 •

edited

Loading