fix: Unverified auth provider identity accepted on password login for code-based auth adapters (GHSA-mr43-w6c2-mvjq)

[mtrezza]

Issue

Unverified auth provider identity accepted on password login for code-based auth adapters (GHSA-mr43-w6c2-mvjq)

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, code comments)
• Add security check
• Add new Parse Error codes to Parse JS SDK

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 9a5b8910-f149-4de0-8120-611af96fc232

📥 Commits

Reviewing files that changed from the base of the PR and between 09009e5 and 82e0aec.

📒 Files selected for processing (2)

• spec/vulnerabilities.spec.js
• src/Routers/UsersRouter.js

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

GitHub authentication now validates provider identities during login and challenge lookup. Regression tests cover authorization-code requirements, identity binding, duplicate linking, account takeover prevention, and valid challenge resolution.

Changes

GitHub authentication validation

Layer / File(s)	Summary
Provider identity validation src/Routers/UsersRouter.js, spec/vulnerabilities.spec.js	Login and challenge lookups invoke adapter beforeFind hooks. Login rejects credentials linked to another user. Regression tests verify authorization-code validation, provider identity binding, duplicate-link prevention, and valid challenge flows.

Priority: ⬆️ High

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 82e0a

The GitHub identity-validation fix and its regression coverage appear merge-ready with normal checks.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Description check	❌ Error	The pull request has no description. It does not include the required Issue, Approach, or Tasks information from the repository template.	Add a pull request description that explains the affected issue, summarizes the authentication changes, and completes the applicable Tasks checklist, including the added regression tests and security check.
Security Check	⚠️ Warning	The new password-login check can still accept an unverified code-based provider identity. The changed call passes user.authData as currentUserAuthData. In Auth.findUsersWithAuthData, an incoming…	Do not pass the password-authenticated user's authData as the currentUserAuthData argument when checking login credentials. Run findUsersWithAuthData(req.config, authData, true) so code-based adapters always run beforeFind during pa…

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Engage In Review Feedback	✅ Passed	No review feedback existed for this pull request. The authoritative range contains one commit (82e0aec, directly on base 09009e5). GitHub reports zero submitted reviews and zero inline review comments…
Title check	✅ Passed	The title begins with the allowed prefix "fix:" and the first letter of the title text after the prefix is capitalized. It accurately describes the authentication vulnerability fix.

Full details: Security Check

Explanation

The new password-login check can still accept an unverified code-based provider identity. The changed call passes user.authData as currentUserAuthData. In Auth.findUsersWithAuthData, an incoming provider object is treated as unchanged when its keys are a subset of the stored provider object. Therefore { github: { id: storedId } } skips BaseCodeAuthAdapter.beforeFind, even though beforeFind requires and verifies the authorization code. BaseCodeAuthAdapter.validateLogin then returns the ID without credential validation, so the login succeeds and can overwrite persisted auth data. The password lookup returns raw authData, and _sanitizeAuthData does not remove this identity. The added tests cover an attacker account with no existing provider identity, but not this existing-identity path. The challenge change correctly calls the lookup without current auth data.

Resolution

Do not pass the password-authenticated user's authData as the currentUserAuthData argument when checking login credentials. Run findUsersWithAuthData(req.config, authData, true) so code-based adapters always run beforeFind during password login. Add a regression test for a user with an already-linked code-based provider who submits only the persisted provider ID during password login; the request must be rejected and must not modify authData.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[mtrezza]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.82%. Comparing base (09009e5) to head (82e0aec).

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10662   +/-   ##
=======================================
  Coverage   93.82%   93.82%           
=======================================
  Files         192      192           
  Lines       16863    16866    +3     
  Branches      252      252           
=======================================
+ Hits        15821    15824    +3     
  Misses       1020     1020           
  Partials       22       22           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mtrezza]

@coderabbitai resolve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.

[parseplatformorg]

🎉 This change has been released in version 9.10.1-alpha.10