fix: Instance comparison with instanceof is not realm-safe

eslint.config.js

@@ -41,7 +41,46 @@ module.exports = [
       curly: ["error", "all"],
       "block-spacing": ["error", "always"],
       "no-unused-vars": "off",
-      "no-console": "warn"
+      "no-console": "warn",
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Date']",
+          message: "Use Utils.isDate() instead of instanceof Date (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='RegExp']",
+          message: "Use Utils.isRegExp() instead of instanceof RegExp (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Error']",
+          message: "Use Utils.isNativeError() instead of instanceof Error (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Promise']",
+          message: "Use Utils.isPromise() instead of instanceof Promise (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Map']",
+          message: "Use Utils.isMap() instead of instanceof Map (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Object']",
+          message: "Use Utils.isObject() instead of instanceof Object (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Set']",
+          message: "Use Utils.isSet() instead of instanceof Set (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Buffer']",
+          message: "Use Buffer.isBuffer() instead of instanceof Buffer (cross-realm safe).",
+        },
+        {
+          selector: "BinaryExpression[operator='instanceof'][right.name='Array']",
+          message: "Use Array.isArray() instead of instanceof Array (cross-realm safe).",
+        },
+      ]
     },
   },
 ];

spec/AdapterLoader.spec.js

@@ -2,6 +2,7 @@ const { loadAdapter, loadModule } = require('../lib/Adapters/AdapterLoader');
 const FilesAdapter = require('@parse/fs-files-adapter').default;
 const MockFilesAdapter = require('mock-files-adapter');
 const Config = require('../lib/Config');
+const Utils = require('../lib/Utils');
 
 describe('AdapterLoader', () => {
   it('should instantiate an adapter from string in object', done => {
@@ -15,7 +16,7 @@ describe('AdapterLoader', () => {
       },
     });
 
-    expect(adapter instanceof Object).toBe(true);
+    expect(Utils.isObject(adapter)).toBe(true);
     expect(adapter.options.key).toBe('value');
     expect(adapter.options.foo).toBe('bar');
     done();
@@ -25,7 +26,7 @@ describe('AdapterLoader', () => {
     const adapterPath = require('path').resolve('./spec/support/MockAdapter');
     const adapter = loadAdapter(adapterPath);
 
-    expect(adapter instanceof Object).toBe(true);
+    expect(Utils.isObject(adapter)).toBe(true);
     done();
   });
 

spec/CloudCode.spec.js

@@ -5,6 +5,7 @@ const ParseServer = require('../lib/index').ParseServer;
 const request = require('../lib/request');
 const InMemoryCacheAdapter = require('../lib/Adapters/Cache/InMemoryCacheAdapter')
   .InMemoryCacheAdapter;
+const Utils = require('../lib/Utils');
 
 const mockAdapter = {
   createFile: async filename => ({
@@ -1272,15 +1273,15 @@ describe('Cloud Code', () => {
 
   it('test cloud function request params types', function (done) {
     Parse.Cloud.define('params', function (req) {
-      expect(req.params.date instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.date)).toBe(true);
       expect(req.params.date.getTime()).toBe(1463907600000);
-      expect(req.params.dateList[0] instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.dateList[0])).toBe(true);
       expect(req.params.dateList[0].getTime()).toBe(1463907600000);
-      expect(req.params.complexStructure.date[0] instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.complexStructure.date[0])).toBe(true);
       expect(req.params.complexStructure.date[0].getTime()).toBe(1463907600000);
-      expect(req.params.complexStructure.deepDate.date[0] instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.complexStructure.deepDate.date[0])).toBe(true);
       expect(req.params.complexStructure.deepDate.date[0].getTime()).toBe(1463907600000);
-      expect(req.params.complexStructure.deepDate2[0].date instanceof Date).toBe(true);
+      expect(Utils.isDate(req.params.complexStructure.deepDate2[0].date)).toBe(true);
       expect(req.params.complexStructure.deepDate2[0].date.getTime()).toBe(1463907600000);
       // Regression for #2294
       expect(req.params.file instanceof Parse.File).toBe(true);

spec/GridFSBucketStorageAdapter.spec.js

@@ -103,12 +103,12 @@ describe_only_db('mongo')('GridFSBucket', () => {
     ).toEqual(1);
     expect(notRotated.length).toEqual(0);
     let result = await encryptedAdapter.getFileData(fileName1);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data1);
     const encryptedData1 = await unencryptedAdapter.getFileData(fileName1);
     expect(encryptedData1.toString('utf-8')).not.toEqual(unencryptedResult1);
     result = await encryptedAdapter.getFileData(fileName2);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data2);
     const encryptedData2 = await unencryptedAdapter.getFileData(fileName2);
     expect(encryptedData2.toString('utf-8')).not.toEqual(unencryptedResult2);
@@ -146,7 +146,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
     ).toEqual(1);
     expect(notRotated.length).toEqual(0);
     let result = await encryptedAdapter.getFileData(fileName1);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data1);
     let decryptionError1;
     let encryptedData1;
@@ -158,7 +158,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
     expect(decryptionError1).toMatch('Error');
     expect(encryptedData1).toBeUndefined();
     result = await encryptedAdapter.getFileData(fileName2);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data2);
     let decryptionError2;
     let encryptedData2;
@@ -203,7 +203,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
     ).toEqual(1);
     expect(notRotated.length).toEqual(0);
     let result = await unEncryptedAdapter.getFileData(fileName1);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data1);
     let decryptionError1;
     let encryptedData1;
@@ -215,7 +215,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
     expect(decryptionError1).toMatch('Error');
     expect(encryptedData1).toBeUndefined();
     result = await unEncryptedAdapter.getFileData(fileName2);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data2);
     let decryptionError2;
     let encryptedData2;
@@ -271,7 +271,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
       }).length
     ).toEqual(0);
     let result = await encryptedAdapter.getFileData(fileName1);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data1);
     let decryptionError1;
     let encryptedData1;
@@ -283,7 +283,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
     expect(decryptionError1).toMatch('Error');
     expect(encryptedData1).toBeUndefined();
     result = await encryptedAdapter.getFileData(fileName2);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data2);
     let decryptionError2;
     let encryptedData2;
@@ -338,7 +338,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
       }).length
     ).toEqual(1);
     let result = await encryptedAdapter.getFileData(fileName1);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data1);
     let decryptionError1;
     let encryptedData1;
@@ -350,7 +350,7 @@ describe_only_db('mongo')('GridFSBucket', () => {
     expect(decryptionError1).toMatch('Error');
     expect(encryptedData1).toBeUndefined();
     result = await encryptedAdapter.getFileData(fileName2);
-    expect(result instanceof Buffer).toBe(true);
+    expect(Buffer.isBuffer(result)).toBe(true);
     expect(result.toString('utf-8')).toEqual(data2);
     let decryptionError2;
     let encryptedData2;

spec/MongoStorageAdapter.spec.js

@@ -6,6 +6,7 @@ const databaseURI = 'mongodb://localhost:27017/parseServerMongoAdapterTestDataba
 const request = require('../lib/request');
 const Config = require('../lib/Config');
 const TestUtils = require('../lib/TestUtils');
+const Utils = require('../lib/Utils');
 
 const fakeClient = {
   s: { options: { dbName: null } },
@@ -243,15 +244,15 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
       .then(results => {
         expect(results.length).toEqual(1);
         const mob = results[0];
-        expect(mob.array instanceof Array).toBe(true);
+        expect(Array.isArray(mob.array)).toBe(true);
         expect(typeof mob.object).toBe('object');
-        expect(mob.date instanceof Date).toBe(true);
+        expect(Utils.isDate(mob.date)).toBe(true);
         return adapter.find('MyClass', schema, {}, {});
       })
       .then(results => {
         expect(results.length).toEqual(1);
         const mob = results[0];
-        expect(mob.array instanceof Array).toBe(true);
+        expect(Array.isArray(mob.array)).toBe(true);
         expect(typeof mob.object).toBe('object');
         expect(mob.date.__type).toBe('Date');
         expect(mob.date.iso).toBe('2016-05-26T20:55:01.154Z');
@@ -278,9 +279,9 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
     }).save();
     const adapter = Config.get(Parse.applicationId).database.adapter;
     const [object] = await adapter._rawFind('MyClass', {});
-    expect(object.date instanceof Date).toBeTrue();
-    expect(object.bar.date instanceof Date).toBeTrue();
-    expect(object.foo.test.date instanceof Date).toBeTrue();
+    expect(Utils.isDate(object.date)).toBeTrue();
+    expect(Utils.isDate(object.bar.date)).toBeTrue();
+    expect(Utils.isDate(object.foo.test.date)).toBeTrue();
   });
 
   it('handles nested dates in array ', async () => {
@@ -297,13 +298,13 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
     }).save();
     const adapter = Config.get(Parse.applicationId).database.adapter;
     const [object] = await adapter._rawFind('MyClass', {});
-    expect(object.date[0] instanceof Date).toBeTrue();
-    expect(object.bar.date[0] instanceof Date).toBeTrue();
-    expect(object.foo.test.date[0] instanceof Date).toBeTrue();
+    expect(Utils.isDate(object.date[0])).toBeTrue();
+    expect(Utils.isDate(object.bar.date[0])).toBeTrue();
+    expect(Utils.isDate(object.foo.test.date[0])).toBeTrue();
     const obj = await new Parse.Query('MyClass').first({ useMasterKey: true });
-    expect(obj.get('date')[0] instanceof Date).toBeTrue();
-    expect(obj.get('bar').date[0] instanceof Date).toBeTrue();
-    expect(obj.get('foo').test.date[0] instanceof Date).toBeTrue();
+    expect(Utils.isDate(obj.get('date')[0])).toBeTrue();
+    expect(Utils.isDate(obj.get('bar').date[0])).toBeTrue();
+    expect(Utils.isDate(obj.get('foo').test.date[0])).toBeTrue();
   });
 
   it('upserts with $setOnInsert', async () => {
@@ -376,7 +377,7 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
       })
       .then(results => {
         const mob = results;
-        expect(mob.array instanceof Array).toBe(true);
+        expect(Array.isArray(mob.array)).toBe(true);
         expect(typeof mob.object).toBe('object');
         expect(mob.date.__type).toBe('Date');
         expect(mob.date.iso).toBe('2016-05-26T20:55:01.154Z');
@@ -385,9 +386,9 @@ describe_only_db('mongo')('MongoStorageAdapter', () => {
       .then(results => {
         expect(results.length).toEqual(1);
         const mob = results[0];
-        expect(mob.array instanceof Array).toBe(true);
+        expect(Array.isArray(mob.array)).toBe(true);
         expect(typeof mob.object).toBe('object');
-        expect(mob.date instanceof Date).toBe(true);
+        expect(Utils.isDate(mob.date)).toBe(true);
         done();
       })
       .catch(error => {

spec/MongoTransform.spec.js

@@ -33,8 +33,8 @@ describe('parseObjectToMongoObjectForCreate', () => {
     const output = transform.parseObjectToMongoObjectForCreate(null, input, {
       fields: {},
     });
-    expect(output._created_at instanceof Date).toBe(true);
-    expect(output._updated_at instanceof Date).toBe(true);
+    expect(Utils.isDate(output._created_at)).toBe(true);
+    expect(Utils.isDate(output._updated_at)).toBe(true);
     done();
   });
 

spec/ParseAPI.spec.js

@@ -7,6 +7,7 @@ const Parse = require('parse/node');
 const Config = require('../lib/Config');
 const SchemaController = require('../lib/Controllers/SchemaController');
 const { destroyAllDataPermanently } = require('../lib/TestUtils');
+const Utils = require('../lib/Utils');
 
 const userSchema = SchemaController.convertSchemaToAdapterSchema({
   className: '_User',
@@ -327,10 +328,10 @@ describe('miscellaneous', () => {
         return obj2.fetch();
       })
       .then(obj2 => {
-        expect(obj2.get('date') instanceof Date).toBe(true);
-        expect(obj2.get('array') instanceof Array).toBe(true);
-        expect(obj2.get('object') instanceof Array).toBe(false);
-        expect(obj2.get('object') instanceof Object).toBe(true);
+        expect(Utils.isDate(obj2.get('date'))).toBe(true);
+        expect(Array.isArray(obj2.get('array'))).toBe(true);
+        expect(Array.isArray(obj2.get('object'))).toBe(false);
+        expect(Utils.isObject(obj2.get('object'))).toBe(true);
         done();
       });
   });

spec/ParseGraphQLServer.spec.js

@@ -5,6 +5,7 @@ const fetch = (...args) => import('node-fetch').then(({ default: fetch }) => fet
 const FormData = require('form-data');
 require('./helper');
 const { updateCLP } = require('./support/dev');
+const Utils = require('../lib/Utils');
 
 const pluralize = require('pluralize');
 const createUploadLink = (...args) => import('apollo-upload-client/createUploadLink.mjs').then(({ default: fn }) => fn(...args));
@@ -8476,15 +8477,15 @@ describe('ParseGraphQLServer', () => {
 
         it('should accept different params', done => {
           Parse.Cloud.define('hello', async req => {
-            expect(req.params.date instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.date)).toBe(true);
             expect(req.params.date.getTime()).toBe(1463907600000);
-            expect(req.params.dateList[0] instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.dateList[0])).toBe(true);
             expect(req.params.dateList[0].getTime()).toBe(1463907600000);
-            expect(req.params.complexStructure.date[0] instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.complexStructure.date[0])).toBe(true);
             expect(req.params.complexStructure.date[0].getTime()).toBe(1463907600000);
-            expect(req.params.complexStructure.deepDate.date[0] instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.complexStructure.deepDate.date[0])).toBe(true);
             expect(req.params.complexStructure.deepDate.date[0].getTime()).toBe(1463907600000);
-            expect(req.params.complexStructure.deepDate2[0].date instanceof Date).toBe(true);
+            expect(Utils.isDate(req.params.complexStructure.deepDate2[0].date)).toBe(true);
             expect(req.params.complexStructure.deepDate2[0].date.getTime()).toBe(1463907600000);
             // Regression for #2294
             expect(req.params.file instanceof Parse.File).toBe(true);

spec/ParseQuery.spec.js

@@ -9,6 +9,7 @@ const request = require('../lib/request');
 const ParseServerRESTController = require('../lib/ParseServerRESTController').ParseServerRESTController;
 const ParseServer = require('../lib/ParseServer').default;
 const Deprecator = require('../lib/Deprecator/Deprecator').default;
+const Utils = require('../lib/Utils');
 
 const masterKeyHeaders = {
   'X-Parse-Application-Id': 'test',
@@ -1452,8 +1453,8 @@ describe('Parse.Query testing', () => {
         ok(result);
         equal(result.id, objectId);
         equal(result.get('foo'), 'bar');
-        ok(result.createdAt instanceof Date);
-        ok(result.updatedAt instanceof Date);
+        ok(Utils.isDate(result.createdAt));
+        ok(Utils.isDate(result.updatedAt));
         done();
       });
     });
@@ -3902,7 +3903,7 @@ describe('Parse.Query testing', () => {
         objs => {
           expect(objs.length).toBe(1);
           expect(objs[0].get('child').get('hello')).toEqual('world');
-          expect(objs[0].createdAt instanceof Date).toBe(true);
+          expect(Utils.isDate(objs[0].createdAt)).toBe(true);
           done();
         },
         () => {

spec/ParseUser.spec.js

@@ -12,6 +12,7 @@ const request = require('../lib/request');
 const passwordCrypto = require('../lib/password');
 const Config = require('../lib/Config');
 const cryptoUtils = require('../lib/cryptoUtils');
+const Utils = require('../lib/Utils');
 
 
 describe('allowExpiredAuthDataToken option', () => {
@@ -1128,9 +1129,9 @@ describe('Parse.User testing', () => {
 
           equal(userInMemory.id, id, 'id should be set');
 
-          expect(userInMemory.updatedAt instanceof Date).toBe(true);
+          expect(Utils.isDate(userInMemory.updatedAt)).toBe(true);
 
-          ok(userInMemory.createdAt instanceof Date);
+          ok(Utils.isDate(userInMemory.createdAt));
 
           ok(userInMemory.getSessionToken(), 'user should have a sessionToken after saving');
 
@@ -1167,9 +1168,9 @@ describe('Parse.User testing', () => {
 
           equal(userFromDisk.id, id, 'id should be set on userFromDisk');
 
-          ok(userFromDisk.updatedAt instanceof Date);
+          ok(Utils.isDate(userFromDisk.updatedAt));
 
-          ok(userFromDisk.createdAt instanceof Date);
+          ok(Utils.isDate(userFromDisk.createdAt));
 
           ok(userFromDisk.getSessionToken(), 'userFromDisk should have a sessionToken');