diff --git a/spec/ParseUser.spec.js b/spec/ParseUser.spec.js index 2eeba7b73b..2b048c36db 100644 --- a/spec/ParseUser.spec.js +++ b/spec/ParseUser.spec.js @@ -3847,41 +3847,46 @@ describe('Parse.User testing', () => { } ); }); +}); - it('should validate credentials first and check if account already linked afterwards (GHSA-8w3j-g983-8jh5)', async done => { - // Add User to Database with authData - const database = Config.get(Parse.applicationId).database; - const collection = await database.adapter._adaptiveCollection('_User'); - await collection.insertOne({ - _id: 'ABCDEF1234', - name: '', - email: '', - username: '', - _hashed_password: '', - _auth_data_custom: { - id: 'linkedID', // Already linked userid - }, - sessionToken: '', - }); - const provider = { - getAuthType: () => 'custom', - restoreAuthentication: () => true, - }; // AuthProvider checks if password is 'password' - Parse.User._registerAuthenticationProvider(provider); - - // Try to link second user with wrong password - try { - const user = await Parse.AnonymousUtils.logIn(); - await user._linkWith(provider.getAuthType(), { - authData: { id: 'linkedID', password: 'wrong' }, +describe('Security Advisory GHSA-8w3j-g983-8jh5', function() { + it_only_db('mongo')( + 'should validate credentials first and check if account already linked afterwards ()', + async done => { + // Add User to Database with authData + const database = Config.get(Parse.applicationId).database; + const collection = await database.adapter._adaptiveCollection('_User'); + await collection.insertOne({ + _id: 'ABCDEF1234', + name: '', + email: '', + username: '', + _hashed_password: '', + _auth_data_custom: { + id: 'linkedID', // Already linked userid + }, + sessionToken: '', }); - } catch (error) { - // This should throw Parse.Error.SESSION_MISSING and not Parse.Error.ACCOUNT_ALREADY_LINKED - expect(error.code).toEqual(Parse.Error.SESSION_MISSING); + const provider = { + getAuthType: () => 'custom', + restoreAuthentication: () => true, + }; // AuthProvider checks if password is 'password' + Parse.User._registerAuthenticationProvider(provider); + + // Try to link second user with wrong password + try { + const user = await Parse.AnonymousUtils.logIn(); + await user._linkWith(provider.getAuthType(), { + authData: { id: 'linkedID', password: 'wrong' }, + }); + } catch (error) { + // This should throw Parse.Error.SESSION_MISSING and not Parse.Error.ACCOUNT_ALREADY_LINKED + expect(error.code).toEqual(Parse.Error.SESSION_MISSING); + done(); + return; + } + fail(); done(); - return; } - fail(); - done(); - }); + ); });