@@ -3847,41 +3847,46 @@ describe('Parse.User testing', () => {
3847
3847
}
3848
3848
) ;
3849
3849
} ) ;
3850
+ } ) ;
3850
3851
3851
- it ( 'should validate credentials first and check if account already linked afterwards (GHSA-8w3j-g983-8jh5)' , async done => {
3852
- // Add User to Database with authData
3853
- const database = Config . get ( Parse . applicationId ) . database ;
3854
- const collection = await database . adapter . _adaptiveCollection ( '_User' ) ;
3855
- await collection . insertOne ( {
3856
- _id : 'ABCDEF1234' ,
3857
- name : '<some_name>' ,
3858
- email : '<some_email>' ,
3859
- username : '<some_username>' ,
3860
- _hashed_password : '<some_password>' ,
3861
- _auth_data_custom : {
3862
- id : 'linkedID' , // Already linked userid
3863
- } ,
3864
- sessionToken : '<some_session_token>' ,
3865
- } ) ;
3866
- const provider = {
3867
- getAuthType : ( ) => 'custom' ,
3868
- restoreAuthentication : ( ) => true ,
3869
- } ; // AuthProvider checks if password is 'password'
3870
- Parse . User . _registerAuthenticationProvider ( provider ) ;
3871
-
3872
- // Try to link second user with wrong password
3873
- try {
3874
- const user = await Parse . AnonymousUtils . logIn ( ) ;
3875
- await user . _linkWith ( provider . getAuthType ( ) , {
3876
- authData : { id : 'linkedID' , password : 'wrong' } ,
3852
+ describe ( 'Security Advisory GHSA-8w3j-g983-8jh5' , function ( ) {
3853
+ it_only_db ( 'mongo' ) (
3854
+ 'should validate credentials first and check if account already linked afterwards ()' ,
3855
+ async done => {
3856
+ // Add User to Database with authData
3857
+ const database = Config . get ( Parse . applicationId ) . database ;
3858
+ const collection = await database . adapter . _adaptiveCollection ( '_User' ) ;
3859
+ await collection . insertOne ( {
3860
+ _id : 'ABCDEF1234' ,
3861
+ name : '<some_name>' ,
3862
+ email : '<some_email>' ,
3863
+ username : '<some_username>' ,
3864
+ _hashed_password : '<some_password>' ,
3865
+ _auth_data_custom : {
3866
+ id : 'linkedID' , // Already linked userid
3867
+ } ,
3868
+ sessionToken : '<some_session_token>' ,
3877
3869
} ) ;
3878
- } catch ( error ) {
3879
- // This should throw Parse.Error.SESSION_MISSING and not Parse.Error.ACCOUNT_ALREADY_LINKED
3880
- expect ( error . code ) . toEqual ( Parse . Error . SESSION_MISSING ) ;
3870
+ const provider = {
3871
+ getAuthType : ( ) => 'custom' ,
3872
+ restoreAuthentication : ( ) => true ,
3873
+ } ; // AuthProvider checks if password is 'password'
3874
+ Parse . User . _registerAuthenticationProvider ( provider ) ;
3875
+
3876
+ // Try to link second user with wrong password
3877
+ try {
3878
+ const user = await Parse . AnonymousUtils . logIn ( ) ;
3879
+ await user . _linkWith ( provider . getAuthType ( ) , {
3880
+ authData : { id : 'linkedID' , password : 'wrong' } ,
3881
+ } ) ;
3882
+ } catch ( error ) {
3883
+ // This should throw Parse.Error.SESSION_MISSING and not Parse.Error.ACCOUNT_ALREADY_LINKED
3884
+ expect ( error . code ) . toEqual ( Parse . Error . SESSION_MISSING ) ;
3885
+ done ( ) ;
3886
+ return ;
3887
+ }
3888
+ fail ( ) ;
3881
3889
done ( ) ;
3882
- return ;
3883
3890
}
3884
- fail ( ) ;
3885
- done ( ) ;
3886
- } ) ;
3891
+ ) ;
3887
3892
} ) ;
0 commit comments