From 20a31cb8e67826e21cf467cd1bf3621c9c937aa8 Mon Sep 17 00:00:00 2001
From: mukeshr06 <174724920+mukeshr06@users.noreply.github.com>
Date: Sat, 22 Aug 2026 10:55:04 +0530
Subject: [PATCH] fix: validate CIDR masks in IP configuration

---
 spec/index.spec.js | 41 +++++++++++++++++++++++++++++++++++++++++
 src/Config.js      | 19 +++++++++++++------
 2 files changed, 54 insertions(+), 6 deletions(-)

diff --git a/spec/index.spec.js b/spec/index.spec.js
index 988f35cc3e..4dec05f5ec 100644
--- a/spec/index.spec.js
+++ b/spec/index.spec.js
@@ -460,12 +460,53 @@ describe('server', () => {
     });
   });
 
+  it('fails if you provide an invalid CIDR mask in masterKeyIps', async () => {
+    const invalidIps = [
+      '127.0.0.1/999',
+      '10.0.0.0/8.9',
+      '127.0.0.0/32.0',
+      '127.0.0.0/3.2e1',
+      '127.0.0.0/0x20',
+      '127.0.0.0/0b100000',
+      '127.0.0.0/ 32',
+      '127.0.0.0/32 ',
+      '127.0.0.1/-1',
+      '127.0.0.1/',
+      '127.0.0.1/32/ignored',
+      '2001:db8::/129',
+    ];
+
+    for (const ip of invalidIps) {
+      expect(() => Config.validateIps('masterKeyIps', [ip]))
+        .withContext(ip)
+        .toThrow(
+          `The Parse Server option "masterKeyIps" contains an invalid CIDR notation "${ip}".`
+        );
+    }
+
+    const startupIp = '127.0.0.1/33';
+    await expectAsync(reconfigureServer({ masterKeyIps: [startupIp] })).toBeRejectedWith(
+      `The Parse Server option \"masterKeyIps\" contains an invalid CIDR notation \"${startupIp}\".`
+    );
+  });
+
   it('should succeed if you provide valid ip in masterKeyIps', done => {
     reconfigureServer({
       masterKeyIps: ['1.2.3.4', '2001:0db8:0000:0042:0000:8a2e:0370:7334'],
     }).then(done);
   });
 
+  it('should succeed if you provide valid CIDR boundaries in masterKeyIps', () => {
+    expect(() =>
+      Config.validateIps('masterKeyIps', [
+        '0.0.0.0/0',
+        '255.255.255.255/32',
+        '::/0',
+        '2001:db8::/128',
+      ])
+    ).not.toThrow();
+  });
+
   it('should set default masterKeyIps for IPv4 and IPv6 localhost', () => {
     const definitions = require('../lib/Options/Definitions.js');
     expect(definitions.ParseServerOptions.masterKeyIps.default).toEqual(['127.0.0.1', '::1']);
diff --git a/src/Config.js b/src/Config.js
index 95543c6c6b..266f6ba961 100644
--- a/src/Config.js
+++ b/src/Config.js
@@ -625,12 +625,19 @@ export class Config {
   }
 
   static validateIps(field, masterKeyIps) {
-    for (let ip of masterKeyIps) {
-      if (ip.includes('/')) {
-        ip = ip.split('/')[0];
-      }
-      if (!net.isIP(ip)) {
-        throw `The Parse Server option "${field}" contains an invalid IP address "${ip}".`;
+    for (const ip of masterKeyIps) {
+      const parts = ip.split('/');
+      const address = parts[0];
+      const ipVersion = net.isIP(address);
+      if (!ipVersion) {
+        throw `The Parse Server option "${field}" contains an invalid IP address "${address}".`;
+      }
+      if (parts.length > 1) {
+        const mask = parts[1];
+        const maxMask = ipVersion === 4 ? 32 : 128;
+        if (parts.length !== 2 || !/^\d+$/.test(mask) || Number(mask) > maxMask) {
+          throw `The Parse Server option "${field}" contains an invalid CIDR notation "${ip}".`;
+        }
       }
     }
   }