@@ -3847,41 +3847,46 @@ describe('Parse.User testing', () => {
38473847 }
38483848 ) ;
38493849 } ) ;
3850+ } ) ;
38503851
3851- it ( 'should validate credentials first and check if account already linked afterwards (GHSA-8w3j-g983-8jh5)' , async done => {
3852- // Add User to Database with authData
3853- const database = Config . get ( Parse . applicationId ) . database ;
3854- const collection = await database . adapter . _adaptiveCollection ( '_User' ) ;
3855- await collection . insertOne ( {
3856- _id : 'ABCDEF1234' ,
3857- name : '<some_name>' ,
3858- email : '<some_email>' ,
3859- username : '<some_username>' ,
3860- _hashed_password : '<some_password>' ,
3861- _auth_data_custom : {
3862- id : 'linkedID' , // Already linked userid
3863- } ,
3864- sessionToken : '<some_session_token>' ,
3865- } ) ;
3866- const provider = {
3867- getAuthType : ( ) => 'custom' ,
3868- restoreAuthentication : ( ) => true ,
3869- } ; // AuthProvider checks if password is 'password'
3870- Parse . User . _registerAuthenticationProvider ( provider ) ;
3871-
3872- // Try to link second user with wrong password
3873- try {
3874- const user = await Parse . AnonymousUtils . logIn ( ) ;
3875- await user . _linkWith ( provider . getAuthType ( ) , {
3876- authData : { id : 'linkedID' , password : 'wrong' } ,
3852+ describe ( 'Security Advisory GHSA-8w3j-g983-8jh5' , function ( ) {
3853+ it_only_db ( 'mongo' ) (
3854+ 'should validate credentials first and check if account already linked afterwards ()' ,
3855+ async done => {
3856+ // Add User to Database with authData
3857+ const database = Config . get ( Parse . applicationId ) . database ;
3858+ const collection = await database . adapter . _adaptiveCollection ( '_User' ) ;
3859+ await collection . insertOne ( {
3860+ _id : 'ABCDEF1234' ,
3861+ name : '<some_name>' ,
3862+ email : '<some_email>' ,
3863+ username : '<some_username>' ,
3864+ _hashed_password : '<some_password>' ,
3865+ _auth_data_custom : {
3866+ id : 'linkedID' , // Already linked userid
3867+ } ,
3868+ sessionToken : '<some_session_token>' ,
38773869 } ) ;
3878- } catch ( error ) {
3879- // This should throw Parse.Error.SESSION_MISSING and not Parse.Error.ACCOUNT_ALREADY_LINKED
3880- expect ( error . code ) . toEqual ( Parse . Error . SESSION_MISSING ) ;
3870+ const provider = {
3871+ getAuthType : ( ) => 'custom' ,
3872+ restoreAuthentication : ( ) => true ,
3873+ } ; // AuthProvider checks if password is 'password'
3874+ Parse . User . _registerAuthenticationProvider ( provider ) ;
3875+
3876+ // Try to link second user with wrong password
3877+ try {
3878+ const user = await Parse . AnonymousUtils . logIn ( ) ;
3879+ await user . _linkWith ( provider . getAuthType ( ) , {
3880+ authData : { id : 'linkedID' , password : 'wrong' } ,
3881+ } ) ;
3882+ } catch ( error ) {
3883+ // This should throw Parse.Error.SESSION_MISSING and not Parse.Error.ACCOUNT_ALREADY_LINKED
3884+ expect ( error . code ) . toEqual ( Parse . Error . SESSION_MISSING ) ;
3885+ done ( ) ;
3886+ return ;
3887+ }
3888+ fail ( ) ;
38813889 done ( ) ;
3882- return ;
38833890 }
3884- fail ( ) ;
3885- done ( ) ;
3886- } ) ;
3891+ ) ;
38873892} ) ;
0 commit comments