GHSA-mmg8-87c5-jrc2 Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

• npm parse-server: >= 9.0.0, < 9.7.0-alpha.16 → fixed in 9.7.0-alpha.16 • npm parse-server: < 8.6.70 → fixed in 8.6.70

Impact An authenticated user with `find` class-level permission can bypass the `protectedFields` class-level permission setting on LiveQuery subscriptions. By sending a subscription with a `$or`, `$and`, or `$nor` operator value as a plain object with numeric keys and a `length` property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value. Patches The fix validates that `$or`, `$and`, and `$nor` operator values are arrays in the LiveQuery subscription handler, the query depth checker, and the protected-field guard. As defense in depth, the LiveQuery query evaluator also rejects non-array values for these operators. Workarounds There is no known workaround.