@@ -16,8 +16,13 @@ const emailAdapter = {
16
16
const appName = 'test' ;
17
17
const publicServerURL = 'http://localhost:8378/1' ;
18
18
19
- describe ( 'Regex Vulnerabilities' , function ( ) {
20
- beforeEach ( async function ( ) {
19
+ describe ( 'Regex Vulnerabilities' , ( ) => {
20
+ let objectId ;
21
+ let sessionToken ;
22
+ let partialSessionToken ;
23
+ let user ;
24
+
25
+ beforeEach ( async ( ) => {
21
26
await reconfigureServer ( {
22
27
maintenanceKey : 'test2' ,
23
28
verifyUserEmails : true ,
@@ -38,13 +43,13 @@ describe('Regex Vulnerabilities', function () {
38
43
39
44
} ) ,
40
45
} ) ;
41
- this . objectId = signUpResponse . data . objectId ;
42
- this . sessionToken = signUpResponse . data . sessionToken ;
43
- this . partialSessionToken = this . sessionToken . slice ( 0 , 3 ) ;
46
+ objectId = signUpResponse . data . objectId ;
47
+ sessionToken = signUpResponse . data . sessionToken ;
48
+ partialSessionToken = sessionToken . slice ( 0 , 3 ) ;
44
49
} ) ;
45
50
46
- describe ( 'on session token' , function ( ) {
47
- it ( 'should not work with regex' , async function ( ) {
51
+ describe ( 'on session token' , ( ) => {
52
+ it ( 'should not work with regex' , async ( ) => {
48
53
try {
49
54
await request ( {
50
55
url : `${ serverURL } /users/me` ,
@@ -53,7 +58,7 @@ describe('Regex Vulnerabilities', function () {
53
58
body : JSON . stringify ( {
54
59
...keys ,
55
60
_SessionToken : {
56
- $regex : this . partialSessionToken ,
61
+ $regex : partialSessionToken ,
57
62
} ,
58
63
_method : 'GET' ,
59
64
} ) ,
@@ -65,43 +70,43 @@ describe('Regex Vulnerabilities', function () {
65
70
}
66
71
} ) ;
67
72
68
- it ( 'should work with plain token' , async function ( ) {
73
+ it ( 'should work with plain token' , async ( ) => {
69
74
const meResponse = await request ( {
70
75
url : `${ serverURL } /users/me` ,
71
76
method : 'POST' ,
72
77
headers,
73
78
body : JSON . stringify ( {
74
79
...keys ,
75
- _SessionToken : this . sessionToken ,
80
+ _SessionToken : sessionToken ,
76
81
_method : 'GET' ,
77
82
} ) ,
78
83
} ) ;
79
- expect ( meResponse . data . objectId ) . toEqual ( this . objectId ) ;
80
- expect ( meResponse . data . sessionToken ) . toEqual ( this . sessionToken ) ;
84
+ expect ( meResponse . data . objectId ) . toEqual ( objectId ) ;
85
+ expect ( meResponse . data . sessionToken ) . toEqual ( sessionToken ) ;
81
86
} ) ;
82
87
} ) ;
83
88
84
- describe ( 'on verify e-mail' , function ( ) {
89
+ describe ( 'on verify e-mail' , ( ) => {
85
90
beforeEach ( async function ( ) {
86
91
const userQuery = new Parse . Query ( Parse . User ) ;
87
- this . user = await userQuery . get ( this . objectId , { useMasterKey : true } ) ;
92
+ user = await userQuery . get ( objectId , { useMasterKey : true } ) ;
88
93
} ) ;
89
94
90
- it ( 'should not work with regex' , async function ( ) {
91
- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
95
+ it ( 'should not work with regex' , async ( ) => {
96
+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
92
97
await request ( {
93
98
url :
`${ serverURL } /apps/test/[email protected] &token[$regex]=` ,
94
99
method : 'GET' ,
95
100
} ) ;
96
- await this . user . fetch ( { useMasterKey : true } ) ;
97
- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
101
+ await user . fetch ( { useMasterKey : true } ) ;
102
+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
98
103
} ) ;
99
104
100
- it_id ( '92bbb86d-bcda-49fa-8d79-aa0501078044' ) ( 'should work with plain token' , async function ( ) {
101
- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
105
+ it_id ( '92bbb86d-bcda-49fa-8d79-aa0501078044' ) ( 'should work with plain token' , async ( ) => {
106
+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
102
107
const current = await request ( {
103
108
method : 'GET' ,
104
- url : `http://localhost:8378/1/classes/_User/${ this . user . id } ` ,
109
+ url : `http://localhost:8378/1/classes/_User/${ user . id } ` ,
105
110
json : true ,
106
111
headers : {
107
112
'X-Parse-Application-Id' : 'test' ,
@@ -115,18 +120,18 @@ describe('Regex Vulnerabilities', function () {
115
120
url :
`${ serverURL } /apps/test/[email protected] &token=${ current . _email_verify_token } ` ,
116
121
method : 'GET' ,
117
122
} ) ;
118
- await this . user . fetch ( { useMasterKey : true } ) ;
119
- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( true ) ;
123
+ await user . fetch ( { useMasterKey : true } ) ;
124
+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( true ) ;
120
125
} ) ;
121
126
} ) ;
122
127
123
- describe ( 'on password reset' , function ( ) {
124
- beforeEach ( async function ( ) {
125
- this . user = await Parse . User . logIn ( '[email protected] ' , 'somepassword' ) ;
128
+ describe ( 'on password reset' , ( ) => {
129
+ beforeEach ( async ( ) => {
130
+ user = await Parse . User . logIn ( '[email protected] ' , 'somepassword' ) ;
126
131
} ) ;
127
132
128
- it ( 'should not work with regex' , async function ( ) {
129
- expect ( this . user . id ) . toEqual ( this . objectId ) ;
133
+ it ( 'should not work with regex' , async ( ) => {
134
+ expect ( user . id ) . toEqual ( objectId ) ;
130
135
await request ( {
131
136
url : `${ serverURL } /requestPasswordReset` ,
132
137
method : 'POST' ,
@@ -137,7 +142,7 @@ describe('Regex Vulnerabilities', function () {
137
142
138
143
} ) ,
139
144
} ) ;
140
- await this . user . fetch ( { useMasterKey : true } ) ;
145
+ await user . fetch ( { useMasterKey : true } ) ;
141
146
const passwordResetResponse = await request ( {
142
147
url :
`${ serverURL } /apps/test/[email protected] &token[$regex]=` ,
143
148
method : 'GET' ,
@@ -162,8 +167,8 @@ describe('Regex Vulnerabilities', function () {
162
167
}
163
168
} ) ;
164
169
165
- it ( 'should work with plain token' , async function ( ) {
166
- expect ( this . user . id ) . toEqual ( this . objectId ) ;
170
+ it ( 'should work with plain token' , async ( ) => {
171
+ expect ( user . id ) . toEqual ( objectId ) ;
167
172
await request ( {
168
173
url : `${ serverURL } /requestPasswordReset` ,
169
174
method : 'POST' ,
@@ -176,7 +181,7 @@ describe('Regex Vulnerabilities', function () {
176
181
} ) ;
177
182
const current = await request ( {
178
183
method : 'GET' ,
179
- url : `http://localhost:8378/1/classes/_User/${ this . user . id } ` ,
184
+ url : `http://localhost:8378/1/classes/_User/${ user . id } ` ,
180
185
json : true ,
181
186
headers : {
182
187
'X-Parse-Application-Id' : 'test' ,
@@ -204,7 +209,7 @@ describe('Regex Vulnerabilities', function () {
204
209
} ,
205
210
} ) ;
206
211
const userAgain = await Parse . User . logIn ( '[email protected] ' , 'newpassword' ) ;
207
- expect ( userAgain . id ) . toEqual ( this . objectId ) ;
212
+ expect ( userAgain . id ) . toEqual ( objectId ) ;
208
213
} ) ;
209
214
} ) ;
210
215
} ) ;
0 commit comments