joe/kami-parse-server
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request from GHSA-23r4-5mxp-c7g5 (#7497)

Browse Source 
* Merge pull request from GHSA-23r4-5mxp-c7g5

* add anonymous login security fix

* add changelog entry

* update changelog

* Update package.json (#7498)

* Update package-lock.json (#7499)

Co-authored-by: Corey <coreyearleon@icloud.com>
This commit is contained in:
Antonio Davi Macedo Coelho de Castro
2021-08-18 10:03:54 -07:00
committed by GitHub
parent c66a39fadc
commit fc0fef5922
5 changed files with 1016 additions and 941 deletions
Download Patch File Download Diff File Expand all files Collapse all files

106
spec/ParseUser.spec.js
View File

@@ -2377,59 +2377,63 @@ describe('Parse.User testing', () => {
});
});
it('user get session from token on signup', done => {
Promise.resolve()
.then(() => {
return Parse.User.signUp('finn', 'human', { foo: 'bar' });
})
.then(user => {
request({
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-Session-Token': user.getSessionToken(),
'X-Parse-REST-API-Key': 'rest',
},
url: 'http://localhost:8378/1/sessions/me',
}).then(response => {
const b = response.data;
expect(typeof b.sessionToken).toEqual('string');
expect(typeof b.createdWith).toEqual('object');
expect(b.createdWith.action).toEqual('signup');
expect(typeof b.user).toEqual('object');
expect(b.user.objectId).toEqual(user.id);
done();
});
});
it('user get session from token on signup', async () => {
const user = await Parse.User.signUp('finn', 'human', { foo: 'bar' });
const response = await request({
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-Session-Token': user.getSessionToken(),
'X-Parse-REST-API-Key': 'rest',
},
url: 'http://localhost:8378/1/sessions/me',
});
const data = response.data;
expect(typeof data.sessionToken).toEqual('string');
expect(typeof data.createdWith).toEqual('object');
expect(data.createdWith.action).toEqual('signup');
expect(data.createdWith.authProvider).toEqual('password');
expect(typeof data.user).toEqual('object');
expect(data.user.objectId).toEqual(user.id);
});
it('user get session from token on login', done => {
Promise.resolve()
.then(() => {
return Parse.User.signUp('finn', 'human', { foo: 'bar' });
})
.then(() => {
return Parse.User.logOut().then(() => {
return Parse.User.logIn('finn', 'human');
});
})
.then(user => {
request({
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-Session-Token': user.getSessionToken(),
'X-Parse-REST-API-Key': 'rest',
},
url: 'http://localhost:8378/1/sessions/me',
}).then(response => {
const b = response.data;
expect(typeof b.sessionToken).toEqual('string');
expect(typeof b.createdWith).toEqual('object');
expect(b.createdWith.action).toEqual('login');
expect(typeof b.user).toEqual('object');
expect(b.user.objectId).toEqual(user.id);
done();
});
});
it('user get session from token on username/password login', async () => {
await Parse.User.signUp('finn', 'human', { foo: 'bar' });
await Parse.User.logOut();
const user = await Parse.User.logIn('finn', 'human');
const response = await request({
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-Session-Token': user.getSessionToken(),
'X-Parse-REST-API-Key': 'rest',
},
url: 'http://localhost:8378/1/sessions/me',
});
const data = response.data;
expect(typeof data.sessionToken).toEqual('string');
expect(typeof data.createdWith).toEqual('object');
expect(data.createdWith.action).toEqual('login');
expect(data.createdWith.authProvider).toEqual('password');
expect(typeof data.user).toEqual('object');
expect(data.user.objectId).toEqual(user.id);
});
it('user get session from token on anonymous login', async () => {
const user = await Parse.AnonymousUtils.logIn();
const response = await request({
headers: {
'X-Parse-Application-Id': 'test',
'X-Parse-Session-Token': user.getSessionToken(),
'X-Parse-REST-API-Key': 'rest',
},
url: 'http://localhost:8378/1/sessions/me',
});
const data = response.data;
expect(typeof data.sessionToken).toEqual('string');
expect(typeof data.createdWith).toEqual('object');
expect(data.createdWith.action).toEqual('login');
expect(data.createdWith.authProvider).toEqual('anonymous');
expect(typeof data.user).toEqual('object');
expect(data.user.objectId).toEqual(user.id);
});
it('user update session with other field', done => {