Cloud Code parameter value requires JSON escaping

[mtrezza]

trafficstars

New Issue Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Issue Description

When storing a string \ in Cloud Code:

• in a parameter of type String, the string is retrieved in Cloud Code as is.
• in a parameter of type Object or Array the value cannot be saved unless the character is escaped ({ "v": \ } or ["\\"]) so that the string is retrieved in Cloud Code as \.

This is likely due to the JSON stringification of objects and arrays, which is not applied to simple strings. This becomes an issue when modifying values which requires manual transformation from escaped to unescaped and vice-versa. This is prone to user errors due to the special handling that has to be considered.

Steps to reproduce

1. Create Cloud Code params of types String, Object, Array with values as described above.
2. Retrieve values in Cloud Code.

Actual Outcome

Values for Object and Array require escaping.

Expected Outcome

Values for Object and Array don't require escaping and any necessary escaping is handled by Parse Server in the background.

Environment

Server

• Parse Server version: 7.4.0