fix: Account takeover via operator injection in authentication data identifier (GHSA-5fw2-8jcv-xh87)

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Account takeover via operator injection in authentication data identifier (GHSA-5fw2-8jcv-xh87)

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, code comments)
• Add security check
• Add new Parse Error codes to Parse JS SDK

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

[coderabbitai]

📝 Walkthrough

Walkthrough

Introduces validation for authData.id type checking in the authentication provider flow to reject non-string identifiers at runtime. Adds comprehensive test coverage for operator injection vulnerabilities, including scenarios for anonymous login and custom adapter configurations with regex, equality, and existence operators.

Changes

Cohort / File(s)	Summary
Operator Injection Tests spec/RegexVulnerabilities.spec.js	New test suites validating rejection of $regex, $ne, and $exists operators in authData injection, including valid string ID login scenarios and custom adapter edge cases.
AuthData Validation src/Auth.js	Runtime type check added to findUsersWithAuthData to reject non-string providerAuthData.id values with early error throw.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Possibly related PRs

• fix: Unlinking auth provider triggers auth data validation #10045: Modifies findUsersWithAuthData validation logic for provider authData handling.
• fix: LDAP injection via unsanitized user input in DN and group filter construction (GHSA-7m6r-fhh7-r47c) #10154: Adds explicit validation rejecting non-string authData.id values in authentication adapters.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description follows the template with the Issue section properly filled with the security advisory link. However, critical tasks remain incomplete: documentation updates, security checks, and error code additions are unchecked despite being part of the standard checklist.	Complete or document why remaining tasks (documentation, security checks, error codes) are not applicable. At minimum, address whether these tasks truly don't apply to this security fix.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title accurately describes the main change: a security fix for operator injection vulnerability in authentication data, matching the code changes that add type validation and tests.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.61%. Comparing base (6009bc1) to head (dc98abf).
⚠️ Report is 102 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10185   +/-   ##
=======================================
  Coverage   92.61%   92.61%           
=======================================
  Files         192      192           
  Lines       16256    16258    +2     
  Branches      190      190           
=======================================
+ Hits        15055    15057    +2     
  Misses       1188     1188           
  Partials       13       13           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/Auth.js (1)

451-457: ⚠️ Potential issue | 🟠 Major

Fix the authData.id type guard to support numeric IDs from OAuth providers.

The new typeof providerAuthData.id !== 'string' check at line 455–457 will reject authentication from real-world OAuth providers. GitHub's API (and others like Spotify, Line, etc.) return numeric user IDs, not strings. These numeric IDs flow through adapter.beforeFind() without type conversion — for example, BaseCodeAuthAdapter at line 58 assigns authData.id = user.id directly. The new guard will then throw INVALID_VALUE and break login/signup.

Additionally, the earlier if (!providerAuthData?.id) check still treats falsy non-strings like 0 or false as absent, so the invariant is not enforced consistently.

Please either:

• Normalize provider IDs to strings immediately after adapter.beforeFind() (e.g., providerAuthData.id = String(providerAuthData.id))
• Replace the type check with an explicit null/undefined check and reject only objects/operators that could cause injection (e.g., if (typeof providerAuthData.id === 'object' || ...))

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/Auth.js` around lines 451 - 457, The type guard rejects numeric provider
IDs; change the logic around providerAuthData/id (after adapter.beforeFind() and
before the current typeof check) to normalize IDs to strings (e.g., set
providerAuthData.id = String(providerAuthData.id)) or alternatively replace the
falsy check and typeof guard with an explicit null/undefined check (e.g., if
(providerAuthData.id == null) return null) and reject only object/operator types
(check typeof providerAuthData.id === 'object' or
Array.isArray(providerAuthData.id')) to avoid rejecting valid numeric IDs;
update the checks near providerAuthData, adapter.beforeFind(), and
BaseCodeAuthAdapter usage accordingly so numeric IDs are accepted or converted
consistently.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@src/Auth.js`:
- Around line 451-457: The type guard rejects numeric provider IDs; change the
logic around providerAuthData/id (after adapter.beforeFind() and before the
current typeof check) to normalize IDs to strings (e.g., set providerAuthData.id
= String(providerAuthData.id)) or alternatively replace the falsy check and
typeof guard with an explicit null/undefined check (e.g., if
(providerAuthData.id == null) return null) and reject only object/operator types
(check typeof providerAuthData.id === 'object' or
Array.isArray(providerAuthData.id')) to avoid rejecting valid numeric IDs;
update the checks near providerAuthData, adapter.beforeFind(), and
BaseCodeAuthAdapter usage accordingly so numeric IDs are accepted or converted
consistently.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 117c2637-ba3e-4826-8242-d2686ddfb97c

📥 Commits

Reviewing files that changed from the base of the PR and between ad826e1 and dc98abf.

📒 Files selected for processing (2)

• spec/RegexVulnerabilities.spec.js
• src/Auth.js

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[parseplatformorg]

🎉 This change has been released in version 9.6.0-alpha.12

[parseplatformorg]

🎉 This change has been released in version 9.6.0