Merge pull request from GHSA-23r4-5mxp-c7g5 (#7497)

* Merge pull request from GHSA-23r4-5mxp-c7g5

* add anonymous login security fix

* add changelog entry

* update changelog

* Update package.json (#7498)

* Update package-lock.json (#7499)

Co-authored-by: Corey <coreyearleon@icloud.com>

CHANGELOG.md

@@ -88,7 +88,7 @@ Jump directly to a version:
 ___
 
 ## Unreleased (Master Branch)
-[Full Changelog](https://github.com/parse-community/parse-server/compare/4.5.0...master)
+[Full Changelog](https://github.com/parse-community/parse-server/compare/4.5.1...master)
 ### Breaking Changes
 - Improved schema caching through database real-time hooks. Reduces DB queries, decreases Parse Query execution time and fixes a potential schema memory leak. If multiple Parse Server instances connect to the same DB (for example behind a load balancer), set the [Parse Server Option](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) `databaseOptions.enableSchemaHooks: true` to enable this feature and keep the schema in sync across all instances. Failing to do so will cause a schema change to not propagate to other instances and re-syncing will only happen when these instances restart. The options `enableSingleSchemaCache` and `schemaCacheTTL` have been removed. To use this feature with MongoDB, a replica set cluster with [change stream](https://docs.mongodb.com/manual/changeStreams/#availability) support is required. (Diamond Lewis, SebC) [#7214](https://github.com/parse-community/parse-server/issues/7214)
 - Added file upload restriction. File upload is now only allowed for authenticated users by default for improved security. To allow file upload also for Anonymous Users or Public, set the `fileUpload` parameter in the [Parse Server Options](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) (dblythy, Manuel Trezza) [#7071](https://github.com/parse-community/parse-server/pull/7071)
@@ -140,6 +140,12 @@ ___
 - Added runtime deprecation warnings (Manuel Trezza) [#7451](https://github.com/parse-community/parse-server/pull/7451)
 - Add ability to pass context of an object via a header, X-Parse-Cloud-Context, for Cloud Code triggers. The header addition allows client SDK's to add context without injecting _context in the body of JSON objects (Corey Baker) [#7437](https://github.com/parse-community/parse-server/pull/7437)
 
+___
+### 4.5.1
+[Full Changelog](https://github.com/parse-community/parse-server/compare/4.5.0...4.5.1)
+### Security Fixes
+- SECURITY FIX: Fixes incorrect session property `authProvider: password` of anonymous users. When signing up an anonymous user, the session field `createdWith` indicates incorrectly that the session has been created using username and password with `authProvider: password`, instead of an anonymous sign-up with `authProvider: anonymous`. This fixes the issue by setting the correct `authProvider: anonymous` for future sign-ups of anonymous users. This fix does not fix incorrect `authProvider: password` for existing sessions of anonymous users. Consider this if your app logic depends on the `authProvider` field. (Corey Baker) [GHSA-23r4-5mxp-c7g5](https://github.com/parse-community/parse-server/security/advisories/GHSA-23r4-5mxp-c7g5)
+
 ___
 ## 4.5.0
 [Full Changelog](https://github.com/parse-community/parse-server/compare/4.4.0...4.5.0)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "parse-server",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "An express module providing a Parse-compatible API server",
   "main": "lib/index.js",
   "repository": {

spec/ParseUser.spec.js

@@ -2377,59 +2377,63 @@ describe('Parse.User testing', () => {
       });
   });
 
-  it('user get session from token on signup', done => {
+  it('user get session from token on signup', async () => {
-    Promise.resolve()
+    const user = await Parse.User.signUp('finn', 'human', { foo: 'bar' });
-      .then(() => {
+    const response = await request({
-        return Parse.User.signUp('finn', 'human', { foo: 'bar' });
+      headers: {
-      })
+        'X-Parse-Application-Id': 'test',
-      .then(user => {
+        'X-Parse-Session-Token': user.getSessionToken(),
-        request({
+        'X-Parse-REST-API-Key': 'rest',
-          headers: {
+      },
-            'X-Parse-Application-Id': 'test',
+      url: 'http://localhost:8378/1/sessions/me',
-            'X-Parse-Session-Token': user.getSessionToken(),
+    });
-            'X-Parse-REST-API-Key': 'rest',
+    const data = response.data;
-          },
+    expect(typeof data.sessionToken).toEqual('string');
-          url: 'http://localhost:8378/1/sessions/me',
+    expect(typeof data.createdWith).toEqual('object');
-        }).then(response => {
+    expect(data.createdWith.action).toEqual('signup');
-          const b = response.data;
+    expect(data.createdWith.authProvider).toEqual('password');
-          expect(typeof b.sessionToken).toEqual('string');
+    expect(typeof data.user).toEqual('object');
-          expect(typeof b.createdWith).toEqual('object');
+    expect(data.user.objectId).toEqual(user.id);
-          expect(b.createdWith.action).toEqual('signup');
-          expect(typeof b.user).toEqual('object');
-          expect(b.user.objectId).toEqual(user.id);
-          done();
-        });
-      });
   });
 
-  it('user get session from token on login', done => {
+  it('user get session from token on username/password login', async () => {
-    Promise.resolve()
+    await Parse.User.signUp('finn', 'human', { foo: 'bar' });
-      .then(() => {
+    await Parse.User.logOut();
-        return Parse.User.signUp('finn', 'human', { foo: 'bar' });
+    const user = await Parse.User.logIn('finn', 'human');
-      })
+    const response = await request({
-      .then(() => {
+      headers: {
-        return Parse.User.logOut().then(() => {
+        'X-Parse-Application-Id': 'test',
-          return Parse.User.logIn('finn', 'human');
+        'X-Parse-Session-Token': user.getSessionToken(),
-        });
+        'X-Parse-REST-API-Key': 'rest',
-      })
+      },
-      .then(user => {
+      url: 'http://localhost:8378/1/sessions/me',
-        request({
+    });
-          headers: {
+    const data = response.data;
-            'X-Parse-Application-Id': 'test',
+    expect(typeof data.sessionToken).toEqual('string');
-            'X-Parse-Session-Token': user.getSessionToken(),
+    expect(typeof data.createdWith).toEqual('object');
-            'X-Parse-REST-API-Key': 'rest',
+    expect(data.createdWith.action).toEqual('login');
-          },
+    expect(data.createdWith.authProvider).toEqual('password');
-          url: 'http://localhost:8378/1/sessions/me',
+    expect(typeof data.user).toEqual('object');
-        }).then(response => {
+    expect(data.user.objectId).toEqual(user.id);
-          const b = response.data;
+  });
-          expect(typeof b.sessionToken).toEqual('string');
+
-          expect(typeof b.createdWith).toEqual('object');
+  it('user get session from token on anonymous login', async () => {
-          expect(b.createdWith.action).toEqual('login');
+    const user = await Parse.AnonymousUtils.logIn();
-          expect(typeof b.user).toEqual('object');
+    const response = await request({
-          expect(b.user.objectId).toEqual(user.id);
+      headers: {
-          done();
+        'X-Parse-Application-Id': 'test',
-        });
+        'X-Parse-Session-Token': user.getSessionToken(),
-      });
+        'X-Parse-REST-API-Key': 'rest',
+      },
+      url: 'http://localhost:8378/1/sessions/me',
+    });
+    const data = response.data;
+    expect(typeof data.sessionToken).toEqual('string');
+    expect(typeof data.createdWith).toEqual('object');
+    expect(data.createdWith.action).toEqual('login');
+    expect(data.createdWith.authProvider).toEqual('anonymous');
+    expect(typeof data.user).toEqual('object');
+    expect(data.user.objectId).toEqual(user.id);
   });
 
   it('user update session with other field', done => {

src/RestWrite.js

@@ -857,6 +857,10 @@ RestWrite.prototype.createSessionToken = async function () {
     return;
   }
 
+  if (this.storage['authProvider'] == null && this.data.authData) {
+    this.storage['authProvider'] = Object.keys(this.data.authData).join(',');
+  }
+
   const { sessionData, createSession } = RestWrite.createSession(this.config, {
     userId: this.objectId(),
     createdWith: {