diff --git a/package-lock.json b/package-lock.json index 545827ca2c..ee51192aae 100644 --- a/package-lock.json +++ b/package-lock.json @@ -40,7 +40,7 @@ "mongodb": "5.9.0", "mustache": "4.2.0", "otpauth": "9.2.2", - "parse": "4.1.0", + "parse": "5.0.0-alpha.2", "path-to-regexp": "6.2.1", "pg-monitor": "2.0.0", "pg-promise": "11.5.4", @@ -6321,9 +6321,9 @@ } }, "node_modules/core-js-pure": { - "version": "3.26.1", - "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.26.1.tgz", - "integrity": "sha512-VVXcDpp/xJ21KdULRq/lXdLzQAtX7+37LzpyfFM973il0tWSsDEoyzG38G14AjTpK9VTfiNM9jnFauq/CpaWGQ==", + "version": "3.36.0", + "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.36.0.tgz", + "integrity": "sha512-cN28qmhRNgbMZZMc/RFu5w8pK9VJzpb2rJVR/lHuZJKwmXnoWOpXmMkxqBB514igkp1Hu8WGROsiOAzUcKdHOQ==", "hasInstallScript": true, "funding": { "type": "opencollective", @@ -16631,22 +16631,22 @@ } }, "node_modules/parse": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/parse/-/parse-4.1.0.tgz", - "integrity": "sha512-s0Ti+nWrKWj9DlFcmkEE05fGwa/K5ycZSdqCz01F8YL7Hevqv4WLXAmYGOwzq5UJSZ005seKgb20KwVwLdy/Zg==", + "version": "5.0.0-alpha.2", + "resolved": "https://registry.npmjs.org/parse/-/parse-5.0.0-alpha.2.tgz", + "integrity": "sha512-R8I+wIGMwqWNjkXrwHyHlLvpCENEgNw1Z5jsPABOFhpYFNsc2/sEehDZz3YBUG1v+x0Ujy2kETRJ/7bNrvSC5A==", "dependencies": { - "@babel/runtime-corejs3": "7.21.0", - "idb-keyval": "6.2.0", + "@babel/runtime-corejs3": "7.23.2", + "idb-keyval": "6.2.1", "react-native-crypto-js": "1.0.0", - "uuid": "9.0.0", - "ws": "8.12.0", + "uuid": "9.0.1", + "ws": "8.16.0", "xmlhttprequest": "1.8.0" }, "engines": { - "node": ">=14.21.0 <17 || >=18 <20" + "node": ">=18 <21" }, "optionalDependencies": { - "crypto-js": "4.1.1" + "crypto-js": "4.2.0" } }, "node_modules/parse-json": { @@ -16676,34 +16676,34 @@ "node": ">=6" } }, - "node_modules/parse/node_modules/uuid": { - "version": "9.0.0", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.0.tgz", - "integrity": "sha512-MXcSTerfPa4uqyzStbRoTgt5XIe3x5+42+q1sDuy3R5MDk66URdLMOZe5aPX/SQd+kuYAh0FdP/pO28IkQyTeg==", - "bin": { - "uuid": "dist/bin/uuid" - } - }, - "node_modules/parse/node_modules/ws": { - "version": "8.12.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.12.0.tgz", - "integrity": "sha512-kU62emKIdKVeEIOIKVegvqpXMSTAMLJozpHZaJNDYqBjzlSYXQGviYwN1osDLJ9av68qHd4a2oSjd7yD4pacig==", - "engines": { - "node": ">=10.0.0" - }, - "peerDependencies": { - "bufferutil": "^4.0.1", - "utf-8-validate": ">=5.0.2" + "node_modules/parse/node_modules/@babel/runtime-corejs3": { + "version": "7.23.2", + "resolved": "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.23.2.tgz", + "integrity": "sha512-54cIh74Z1rp4oIjsHjqN+WM4fMyCBYe+LpZ9jWm51CZ1fbH3SkAzQD/3XLoNkjbJ7YEmjobLXyvQrFypRHOrXw==", + "dependencies": { + "core-js-pure": "^3.30.2", + "regenerator-runtime": "^0.14.0" }, - "peerDependenciesMeta": { - "bufferutil": { - "optional": true - }, - "utf-8-validate": { - "optional": true - } + "engines": { + "node": ">=6.9.0" } }, + "node_modules/parse/node_modules/crypto-js": { + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.2.0.tgz", + "integrity": "sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==", + "optional": true + }, + "node_modules/parse/node_modules/idb-keyval": { + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/idb-keyval/-/idb-keyval-6.2.1.tgz", + "integrity": "sha512-8Sb3veuYCyrZL+VBt9LJfZjLUPWVvqn8tG28VqYNFCo43KHcKuq+b4EiXGeuaLAQWL2YmyDgMp2aSpH9JHsEQg==" + }, + "node_modules/parse/node_modules/regenerator-runtime": { + "version": "0.14.1", + "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.1.tgz", + "integrity": "sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==" + }, "node_modules/parseurl": { "version": "1.3.3", "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz", @@ -26129,9 +26129,9 @@ } }, "core-js-pure": { - "version": "3.26.1", - "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.26.1.tgz", - "integrity": "sha512-VVXcDpp/xJ21KdULRq/lXdLzQAtX7+37LzpyfFM973il0tWSsDEoyzG38G14AjTpK9VTfiNM9jnFauq/CpaWGQ==" + "version": "3.36.0", + "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.36.0.tgz", + "integrity": "sha512-cN28qmhRNgbMZZMc/RFu5w8pK9VJzpb2rJVR/lHuZJKwmXnoWOpXmMkxqBB514igkp1Hu8WGROsiOAzUcKdHOQ==" }, "core-util-is": { "version": "1.0.3", @@ -33894,29 +33894,43 @@ } }, "parse": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/parse/-/parse-4.1.0.tgz", - "integrity": "sha512-s0Ti+nWrKWj9DlFcmkEE05fGwa/K5ycZSdqCz01F8YL7Hevqv4WLXAmYGOwzq5UJSZ005seKgb20KwVwLdy/Zg==", + "version": "5.0.0-alpha.2", + "resolved": "https://registry.npmjs.org/parse/-/parse-5.0.0-alpha.2.tgz", + "integrity": "sha512-R8I+wIGMwqWNjkXrwHyHlLvpCENEgNw1Z5jsPABOFhpYFNsc2/sEehDZz3YBUG1v+x0Ujy2kETRJ/7bNrvSC5A==", "requires": { - "@babel/runtime-corejs3": "7.21.0", - "crypto-js": "4.1.1", - "idb-keyval": "6.2.0", + "@babel/runtime-corejs3": "7.23.2", + "crypto-js": "4.2.0", + "idb-keyval": "6.2.1", "react-native-crypto-js": "1.0.0", - "uuid": "9.0.0", - "ws": "8.12.0", + "uuid": "9.0.1", + "ws": "8.16.0", "xmlhttprequest": "1.8.0" }, "dependencies": { - "uuid": { - "version": "9.0.0", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.0.tgz", - "integrity": "sha512-MXcSTerfPa4uqyzStbRoTgt5XIe3x5+42+q1sDuy3R5MDk66URdLMOZe5aPX/SQd+kuYAh0FdP/pO28IkQyTeg==" + "@babel/runtime-corejs3": { + "version": "7.23.2", + "resolved": "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.23.2.tgz", + "integrity": "sha512-54cIh74Z1rp4oIjsHjqN+WM4fMyCBYe+LpZ9jWm51CZ1fbH3SkAzQD/3XLoNkjbJ7YEmjobLXyvQrFypRHOrXw==", + "requires": { + "core-js-pure": "^3.30.2", + "regenerator-runtime": "^0.14.0" + } }, - "ws": { - "version": "8.12.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.12.0.tgz", - "integrity": "sha512-kU62emKIdKVeEIOIKVegvqpXMSTAMLJozpHZaJNDYqBjzlSYXQGviYwN1osDLJ9av68qHd4a2oSjd7yD4pacig==", - "requires": {} + "crypto-js": { + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.2.0.tgz", + "integrity": "sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==", + "optional": true + }, + "idb-keyval": { + "version": "6.2.1", + "resolved": "https://registry.npmjs.org/idb-keyval/-/idb-keyval-6.2.1.tgz", + "integrity": "sha512-8Sb3veuYCyrZL+VBt9LJfZjLUPWVvqn8tG28VqYNFCo43KHcKuq+b4EiXGeuaLAQWL2YmyDgMp2aSpH9JHsEQg==" + }, + "regenerator-runtime": { + "version": "0.14.1", + "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.14.1.tgz", + "integrity": "sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==" } } }, diff --git a/package.json b/package.json index 8e42ba3147..9453157972 100644 --- a/package.json +++ b/package.json @@ -49,7 +49,7 @@ "mongodb": "5.9.0", "mustache": "4.2.0", "otpauth": "9.2.2", - "parse": "4.1.0", + "parse": "5.0.0-alpha.2", "path-to-regexp": "6.2.1", "pg-monitor": "2.0.0", "pg-promise": "11.5.4", diff --git a/src/RestWrite.js b/src/RestWrite.js index 7243238cfa..91cd77f12f 100644 --- a/src/RestWrite.js +++ b/src/RestWrite.js @@ -524,8 +524,7 @@ RestWrite.prototype.handleAuthData = async function (authData) { const results = this.filteredObjectsByACL(r); if (results.length > 1) { - // To avoid https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5 - // Let's run some validation before throwing + // Run validation before throwing to avoid https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5 await Auth.handleAuthDataValidation(authData, this, results[0]); throw new Parse.Error(Parse.Error.ACCOUNT_ALREADY_LINKED, 'this auth is already used'); } @@ -546,6 +545,10 @@ RestWrite.prototype.handleAuthData = async function (authData) { if (results.length === 1) { const userId = this.getUserId(); const userResult = results[0]; + + // Run validation to avoid https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5 + await Auth.handleAuthDataValidation(authData, this, userResult); + // Prevent duplicate authData id if (userId && userId !== userResult.objectId) { throw new Parse.Error(Parse.Error.ACCOUNT_ALREADY_LINKED, 'this auth is already used');