fix: OAuth2 adapter shares mutable state across providers via singleton instance (GHSA-2cjm-2gwv-m892)

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

OAuth2 adapter shares mutable state across providers via singleton instance (GHSA-2cjm-2gwv-m892)

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, code comments)
• Add security check
• Add new Parse Error codes to Parse JS SDK

Summary by CodeRabbit

• Bug Fixes

  • Fixed OAuth2 adapter behavior to ensure proper isolation of provider configurations when handling concurrent authentication requests.

• Tests

  • Added test suite for OAuth2 adapter provider isolation and concurrent authentication scenarios.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds new test suite verifying OAuth2 adapter singleton behavior across providers, ensuring distinct instances per provider and isolated configurations. Also modifies adapter loading logic to instantiate new adapter instances instead of reusing existing ones.

Changes

Cohort / File(s)	Summary
Test Suite for Adapter Behavior spec/vulnerabilities.spec.js	New tests validating that loadAuthAdapter creates distinct instances per provider, preserves per-provider configuration (tokenIntrospectionEndpointUrl, appIds), and prevents provider config cross-contamination during concurrent OAuth2 authentication requests.
Adapter Loading Logic src/Adapters/Auth/index.js	Modified instance construction to create new AuthAdapter instances via new defaultAdapter.constructor() instead of reusing existing instances when defaultAdapter is already an AuthAdapter.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main security fix: preventing OAuth2 adapter state sharing across providers via singleton instances, and references the security advisory.
Description check	✅ Passed	The pull request description follows the required template structure with Issue, Approach, and Tasks sections. The Issue is clearly identified, and completed tasks are marked.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.61%. Comparing base (be281b1) to head (793edb6).
⚠️ Report is 104 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10183   +/-   ##
=======================================
  Coverage   92.61%   92.61%           
=======================================
  Files         192      192           
  Lines       16256    16256           
  Branches      190      190           
=======================================
  Hits        15055    15055           
  Misses       1188     1188           
  Partials       13       13           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 9.6.0-alpha.11

[parseplatformorg]

🎉 This change has been released in version 9.6.0