fix: Rate limit bypass via batch request endpoint (GHSA-775h-3xrc-c228)

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Rate limit bypass via batch request endpoint (GHSA-775h-3xrc-c228)

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, code comments)
• Add security check
• Add new Parse Error codes to Parse JS SDK

Summary by CodeRabbit

• New Features

  • Rate limiting now enforces per-path limits on sub-requests inside batch requests.
  • Added configurable errorResponseMessage to customize HTTP 429 response body.

• Documentation

  • Clarified rate limit docs: batch semantics, how current-window consumption interacts with batches, and recommendation to use reverse proxy/WAF for full protection.

• Tests

  • Added test suite validating batch rate-limit behaviors (exceeding, within-limit, mixed-path, and non-limited scenarios).

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

📝 Walkthrough

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	PR description is missing the 'Approach' section explaining the changes made to fix the security vulnerability.	Add a detailed 'Approach' section describing how the rate limit bypass was fixed, including the implementation changes across batch handling, middleware, and configuration files.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Title check	✅ Passed	The title clearly and specifically references the security vulnerability (GHSA-775h-3xrc-c228) being fixed and identifies the primary change as preventing a rate limit bypass via batch request endpoints.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 86.36364% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.71%. Comparing base (9cfd06e) to head (5d439eb).
⚠️ Report is 137 commits behind head on alpha.

Files with missing lines	Patch %	Lines
src/batch.js	86.36%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha   #10147      +/-   ##
==========================================
- Coverage   92.73%   92.71%   -0.02%     
==========================================
  Files         192      192              
  Lines       16098    16120      +22     
  Branches      183      183              
==========================================
+ Hits        14928    14946      +18     
- Misses       1158     1162       +4     
  Partials       12       12              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/batch.js`:
- Around line 89-103: The batch preflight currently only checks path regex and
ignores rate-limit metadata; update the loop that iterates req.config.rateLimits
to honor each limit's requestMethods, master/internal skip rules, and configured
errorResponseMessage: when counting matches for a given limit (referencing
rateLimits, limit.path.regexp, makeRoutablePath, and limit.requestCount) only
increment matchCount for restRequest entries whose HTTP method is allowed by
limit.requestMethods and that are not excluded by master/internal skip rules
(apply the same auth/context checks used by the single-request rate limiter),
and when throwing use the configured limit.errorResponseMessage (or fall back to
the existing hardcoded message) and the appropriate Parse.Error code instead of
the hardcoded string.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: db4fe855-f4a7-4775-b045-0265e8a7a4c2

📥 Commits

Reviewing files that changed from the base of the PR and between e236ddf and 14d06b0.

📒 Files selected for processing (6)

• spec/RateLimit.spec.js
• src/Options/Definitions.js
• src/Options/docs.js
• src/Options/index.js
• src/batch.js
• src/middlewares.js

[coderabbitai]

🧹 Nitpick comments (2)

spec/RateLimit.spec.js (2)

498-498: PR title suggestion per repository conventions.

Based on learnings, consider an Angular-style PR title that describes the fix for a meaningful changelog entry:

fix(security): add rate limit enforcement to batch endpoint sub-requests

This clarifies the security improvement for developers reviewing the changelog.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/RateLimit.spec.js` at line 498, Update the PR title to follow the
repository's Angular-style convention; change it to a clear, changelog-friendly
message such as "fix(security): add rate limit enforcement to batch endpoint
sub-requests" so reviewers and release notes reflect the security fix (refer to
the test suite context around describe('batch', () => { in
spec/RateLimit.spec.js to confirm this concerns the batch endpoint).

---

498-709: Consider adding test for includeMasterKey: true scenario.

The current test suite validates that master key requests bypass rate limits when includeMasterKey is not set. For completeness, consider adding a test that verifies master key requests are rate-limited when includeMasterKey: true is explicitly configured.

📝 Suggested additional test case

it('should rate limit batch with master key when includeMasterKey is true', async () => {
  await reconfigureServer({
    rateLimit: [
      {
        requestPath: '/classes/*path',
        requestTimeWindow: 10000,
        requestCount: 1,
        includeMasterKey: true,
        errorResponseMessage: 'Too many requests',
        includeInternalRequests: true,
      },
    ],
  });
  const masterHeaders = {
    'Content-Type': 'application/json',
    'X-Parse-Application-Id': 'test',
    'X-Parse-Master-Key': 'test',
  };
  const response = await request({
    method: 'POST',
    headers: masterHeaders,
    url: 'http://localhost:8378/1/batch',
    body: JSON.stringify({
      requests: [
        { method: 'POST', path: '/1/classes/MyObject', body: { key: 'value1' } },
        { method: 'POST', path: '/1/classes/MyObject', body: { key: 'value2' } },
      ],
    }),
  }).catch(e => e);
  expect(response.data).toEqual({
    code: Parse.Error.CONNECTION_FAILED,
    error: 'Too many requests',
  });
});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/RateLimit.spec.js` around lines 498 - 709, Add a new test to the 'batch'
suite that verifies master-key requests are rate-limited when the rateLimit rule
sets includeMasterKey: true: create a test (e.g., "should rate limit batch with
master key when includeMasterKey is true") that calls reconfigureServer with a
rateLimit entry containing requestPath '/classes/*path', requestCount: 1,
requestTimeWindow, includeMasterKey: true and includeInternalRequests: true,
then send a POST batch using masterHeaders (X-Parse-Master-Key) and assert the
response is the expected rate-limit error (match the pattern used in existing
tests via request and expect(response.data) to equal the configured error
object); place it alongside the other batch tests and mirror the structure of
the existing master-key bypass test to ensure consistency.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@spec/RateLimit.spec.js`:
- Line 498: Update the PR title to follow the repository's Angular-style
convention; change it to a clear, changelog-friendly message such as
"fix(security): add rate limit enforcement to batch endpoint sub-requests" so
reviewers and release notes reflect the security fix (refer to the test suite
context around describe('batch', () => { in spec/RateLimit.spec.js to confirm
this concerns the batch endpoint).
- Around line 498-709: Add a new test to the 'batch' suite that verifies
master-key requests are rate-limited when the rateLimit rule sets
includeMasterKey: true: create a test (e.g., "should rate limit batch with
master key when includeMasterKey is true") that calls reconfigureServer with a
rateLimit entry containing requestPath '/classes/*path', requestCount: 1,
requestTimeWindow, includeMasterKey: true and includeInternalRequests: true,
then send a POST batch using masterHeaders (X-Parse-Master-Key) and assert the
response is the expected rate-limit error (match the pattern used in existing
tests via request and expect(response.data) to equal the configured error
object); place it alongside the other batch tests and mirror the structure of
the existing master-key bypass test to ensure consistency.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 35664986-9c18-48b1-bf2f-e43caa06f481

📥 Commits

Reviewing files that changed from the base of the PR and between 14d06b0 and 5d439eb.

📒 Files selected for processing (3)

• spec/RateLimit.spec.js
• src/batch.js
• src/middlewares.js

🚧 Files skipped from review as they are similar to previous changes (2)

• src/batch.js
• src/middlewares.js

[parseplatformorg]

🎉 This change has been released in version 9.5.2-alpha.10

[parseplatformorg]

🎉 This change has been released in version 9.6.0