fix: Security upgrade to parse 7.0.1

package.json

@@ -49,7 +49,7 @@
     "mongodb": "6.17.0",
     "mustache": "4.2.0",
     "otpauth": "9.4.0",
-    "parse": "6.1.1",
+    "parse": "7.0.0",
     "path-to-regexp": "6.3.0",
     "pg-monitor": "3.0.0",
     "pg-promise": "12.2.0",

spec/Adapters/Auth/wechat.spec.js

@@ -23,7 +23,8 @@ describe('WeChatAdapter', function () {
       const user = await adapter.getUserFromAccessToken('validToken', { id: 'validOpenId' });
 
       expect(global.fetch).toHaveBeenCalledWith(
-        'https://api.weixin.qq.com/sns/auth?access_token=validToken&openid=validOpenId'
+        'https://api.weixin.qq.com/sns/auth?access_token=validToken&openid=validOpenId',
+        jasmine.any(Object)
       );
       expect(user).toEqual({ errcode: 0, id: 'validUserId' });
     });
@@ -64,7 +65,8 @@ describe('WeChatAdapter', function () {
       const token = await adapter.getAccessTokenFromCode(authData);
 
       expect(global.fetch).toHaveBeenCalledWith(
-        'https://api.weixin.qq.com/sns/oauth2/access_token?appid=validAppId&secret=validAppSecret&code=validCode&grant_type=authorization_code'
+        'https://api.weixin.qq.com/sns/oauth2/access_token?appid=validAppId&secret=validAppSecret&code=validCode&grant_type=authorization_code',
+        jasmine.any(Object)
       );
       expect(token).toEqual('validToken');
     });

spec/ParseObject.spec.js

@@ -1395,10 +1395,10 @@ describe('Parse.Object testing', () => {
       .save()
       .then(function () {
         const query = new Parse.Query(TestObject);
-        return query.find(object.id);
+        return query.get(object.id);
       })
-      .then(function (results) {
-        updatedObject = results[0];
+      .then(function (result) {
+        updatedObject = result;
         updatedObject.set('x', 11);
         return updatedObject.save();
       })
@@ -1409,7 +1409,8 @@ describe('Parse.Object testing', () => {
         equal(object.createdAt.getTime(), updatedObject.createdAt.getTime());
         equal(object.updatedAt.getTime(), updatedObject.updatedAt.getTime());
         done();
-      });
+      })
+      .catch(done.fail);
   });
 
   xit('fetchAll backbone-style callbacks', function (done) {

spec/ParseQuery.Comment.spec.js

@@ -46,7 +46,7 @@ describe_only_db('mongo')('Parse.Query with comment testing', () => {
   });
 
   it('send comment with query through REST', async () => {
-    const comment = 'Hello Parse';
+    const comment = `Hello Parse ${Date.now()}`;
     const object = new TestObject();
     object.set('name', 'object');
     await object.save();
@@ -58,23 +58,55 @@ describe_only_db('mongo')('Parse.Query with comment testing', () => {
       },
     });
     await request(options);
-    const result = await database.collection('system.profile').findOne({}, { sort: { ts: -1 } });
+
+    // Wait for profile entry to appear with retry logic
+    let result;
+    const maxRetries = 10;
+    const retryDelay = 100;
+    for (let i = 0; i < maxRetries; i++) {
+      result = await database.collection('system.profile').findOne(
+        { 'command.explain.comment': comment },
+        { sort: { ts: -1 } }
+      );
+      if (result) {
+        break;
+      }
+      await new Promise(resolve => setTimeout(resolve, retryDelay));
+    }
+
+    expect(result).toBeDefined();
     expect(result.command.explain.comment).toBe(comment);
   });
 
   it('send comment with query', async () => {
-    const comment = 'Hello Parse';
+    const comment = `Hello Parse ${Date.now()}`;
     const object = new TestObject();
     object.set('name', 'object');
     await object.save();
     const collection = await config.database.adapter._adaptiveCollection('TestObject');
     await collection._rawFind({ name: 'object' }, { comment: comment });
-    const result = await database.collection('system.profile').findOne({}, { sort: { ts: -1 } });
+
+    // Wait for profile entry to appear with retry logic
+    let result;
+    const maxRetries = 10;
+    const retryDelay = 100;
+    for (let i = 0; i < maxRetries; i++) {
+      result = await database.collection('system.profile').findOne(
+        { 'command.comment': comment },
+        { sort: { ts: -1 } }
+      );
+      if (result) {
+        break;
+      }
+      await new Promise(resolve => setTimeout(resolve, retryDelay));
+    }
+
+    expect(result).toBeDefined();
     expect(result.command.comment).toBe(comment);
   });
 
   it('send a comment with a count query', async () => {
-    const comment = 'Hello Parse';
+    const comment = `Hello Parse ${Date.now()}`;
     const object = new TestObject();
     object.set('name', 'object');
     await object.save();
@@ -86,12 +118,28 @@ describe_only_db('mongo')('Parse.Query with comment testing', () => {
     const collection = await config.database.adapter._adaptiveCollection('TestObject');
     const countResult = await collection.count({ name: 'object' }, { comment: comment });
     expect(countResult).toEqual(2);
-    const result = await database.collection('system.profile').findOne({}, { sort: { ts: -1 } });
+
+    // Wait for profile entry to appear with retry logic
+    let result;
+    const maxRetries = 10;
+    const retryDelay = 100;
+    for (let i = 0; i < maxRetries; i++) {
+      result = await database.collection('system.profile').findOne(
+        { 'command.comment': comment },
+        { sort: { ts: -1 } }
+      );
+      if (result) {
+        break;
+      }
+      await new Promise(resolve => setTimeout(resolve, retryDelay));
+    }
+
+    expect(result).toBeDefined();
     expect(result.command.comment).toBe(comment);
   });
 
   it('attach a comment to an aggregation', async () => {
-    const comment = 'Hello Parse';
+    const comment = `Hello Parse ${Date.now()}`;
     const object = new TestObject();
     object.set('name', 'object');
     await object.save();
@@ -100,7 +148,23 @@ describe_only_db('mongo')('Parse.Query with comment testing', () => {
       explain: true,
       comment: comment,
     });
-    const result = await database.collection('system.profile').findOne({}, { sort: { ts: -1 } });
+
+    // Wait for profile entry to appear with retry logic
+    let result;
+    const maxRetries = 10;
+    const retryDelay = 100;
+    for (let i = 0; i < maxRetries; i++) {
+      result = await database.collection('system.profile').findOne(
+        { 'command.explain.comment': comment },
+        { sort: { ts: -1 } }
+      );
+      if (result) {
+        break;
+      }
+      await new Promise(resolve => setTimeout(resolve, retryDelay));
+    }
+
+    expect(result).toBeDefined();
     expect(result.command.explain.comment).toBe(comment);
   });
 });

spec/ParseRelation.spec.js

@@ -517,7 +517,7 @@ describe('Parse.Relation testing', () => {
 
         // Parent object is un-fetched, so this will call /1/classes/Car instead
         // of /1/classes/Wheel and pass { "redirectClassNameForKey":"wheels" }.
-        return query.find(origWheel.id);
+        return query.find();
       })
       .then(function (results) {
         // Make sure this is Wheel and not Car.