@@ -16,8 +16,13 @@ const emailAdapter = {
1616const appName = 'test' ;
1717const publicServerURL = 'http://localhost:8378/1' ;
1818
19- describe ( 'Regex Vulnerabilities' , function ( ) {
20- beforeEach ( async function ( ) {
19+ describe ( 'Regex Vulnerabilities' , ( ) => {
20+ let objectId ;
21+ let sessionToken ;
22+ let partialSessionToken ;
23+ let user ;
24+
25+ beforeEach ( async ( ) => {
2126 await reconfigureServer ( {
2227 maintenanceKey : 'test2' ,
2328 verifyUserEmails : true ,
@@ -38,13 +43,13 @@ describe('Regex Vulnerabilities', function () {
3843 email : 'someemail@somedomain.com' ,
3944 } ) ,
4045 } ) ;
41- this . objectId = signUpResponse . data . objectId ;
42- this . sessionToken = signUpResponse . data . sessionToken ;
43- this . partialSessionToken = this . sessionToken . slice ( 0 , 3 ) ;
46+ objectId = signUpResponse . data . objectId ;
47+ sessionToken = signUpResponse . data . sessionToken ;
48+ partialSessionToken = sessionToken . slice ( 0 , 3 ) ;
4449 } ) ;
4550
46- describe ( 'on session token' , function ( ) {
47- it ( 'should not work with regex' , async function ( ) {
51+ describe ( 'on session token' , ( ) => {
52+ it ( 'should not work with regex' , async ( ) => {
4853 try {
4954 await request ( {
5055 url : `${ serverURL } /users/me` ,
@@ -53,7 +58,7 @@ describe('Regex Vulnerabilities', function () {
5358 body : JSON . stringify ( {
5459 ...keys ,
5560 _SessionToken : {
56- $regex : this . partialSessionToken ,
61+ $regex : partialSessionToken ,
5762 } ,
5863 _method : 'GET' ,
5964 } ) ,
@@ -65,43 +70,43 @@ describe('Regex Vulnerabilities', function () {
6570 }
6671 } ) ;
6772
68- it ( 'should work with plain token' , async function ( ) {
73+ it ( 'should work with plain token' , async ( ) => {
6974 const meResponse = await request ( {
7075 url : `${ serverURL } /users/me` ,
7176 method : 'POST' ,
7277 headers,
7378 body : JSON . stringify ( {
7479 ...keys ,
75- _SessionToken : this . sessionToken ,
80+ _SessionToken : sessionToken ,
7681 _method : 'GET' ,
7782 } ) ,
7883 } ) ;
79- expect ( meResponse . data . objectId ) . toEqual ( this . objectId ) ;
80- expect ( meResponse . data . sessionToken ) . toEqual ( this . sessionToken ) ;
84+ expect ( meResponse . data . objectId ) . toEqual ( objectId ) ;
85+ expect ( meResponse . data . sessionToken ) . toEqual ( sessionToken ) ;
8186 } ) ;
8287 } ) ;
8388
84- describe ( 'on verify e-mail' , function ( ) {
89+ describe ( 'on verify e-mail' , ( ) => {
8590 beforeEach ( async function ( ) {
8691 const userQuery = new Parse . Query ( Parse . User ) ;
87- this . user = await userQuery . get ( this . objectId , { useMasterKey : true } ) ;
92+ user = await userQuery . get ( objectId , { useMasterKey : true } ) ;
8893 } ) ;
8994
90- it ( 'should not work with regex' , async function ( ) {
91- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
95+ it ( 'should not work with regex' , async ( ) => {
96+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
9297 await request ( {
9398 url : `${ serverURL } /apps/test/verify_email?username=someemail@somedomain.com&token[$regex]=` ,
9499 method : 'GET' ,
95100 } ) ;
96- await this . user . fetch ( { useMasterKey : true } ) ;
97- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
101+ await user . fetch ( { useMasterKey : true } ) ;
102+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
98103 } ) ;
99104
100- it_id ( '92bbb86d-bcda-49fa-8d79-aa0501078044' ) ( 'should work with plain token' , async function ( ) {
101- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
105+ it_id ( '92bbb86d-bcda-49fa-8d79-aa0501078044' ) ( 'should work with plain token' , async ( ) => {
106+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( false ) ;
102107 const current = await request ( {
103108 method : 'GET' ,
104- url : `http://localhost:8378/1/classes/_User/${ this . user . id } ` ,
109+ url : `http://localhost:8378/1/classes/_User/${ user . id } ` ,
105110 json : true ,
106111 headers : {
107112 'X-Parse-Application-Id' : 'test' ,
@@ -115,18 +120,18 @@ describe('Regex Vulnerabilities', function () {
115120 url : `${ serverURL } /apps/test/verify_email?username=someemail@somedomain.com&token=${ current . _email_verify_token } ` ,
116121 method : 'GET' ,
117122 } ) ;
118- await this . user . fetch ( { useMasterKey : true } ) ;
119- expect ( this . user . get ( 'emailVerified' ) ) . toEqual ( true ) ;
123+ await user . fetch ( { useMasterKey : true } ) ;
124+ expect ( user . get ( 'emailVerified' ) ) . toEqual ( true ) ;
120125 } ) ;
121126 } ) ;
122127
123- describe ( 'on password reset' , function ( ) {
124- beforeEach ( async function ( ) {
125- this . user = await Parse . User . logIn ( 'someemail@somedomain.com' , 'somepassword' ) ;
128+ describe ( 'on password reset' , ( ) => {
129+ beforeEach ( async ( ) => {
130+ user = await Parse . User . logIn ( 'someemail@somedomain.com' , 'somepassword' ) ;
126131 } ) ;
127132
128- it ( 'should not work with regex' , async function ( ) {
129- expect ( this . user . id ) . toEqual ( this . objectId ) ;
133+ it ( 'should not work with regex' , async ( ) => {
134+ expect ( user . id ) . toEqual ( objectId ) ;
130135 await request ( {
131136 url : `${ serverURL } /requestPasswordReset` ,
132137 method : 'POST' ,
@@ -137,7 +142,7 @@ describe('Regex Vulnerabilities', function () {
137142 email : 'someemail@somedomain.com' ,
138143 } ) ,
139144 } ) ;
140- await this . user . fetch ( { useMasterKey : true } ) ;
145+ await user . fetch ( { useMasterKey : true } ) ;
141146 const passwordResetResponse = await request ( {
142147 url : `${ serverURL } /apps/test/request_password_reset?username=someemail@somedomain.com&token[$regex]=` ,
143148 method : 'GET' ,
@@ -162,8 +167,8 @@ describe('Regex Vulnerabilities', function () {
162167 }
163168 } ) ;
164169
165- it ( 'should work with plain token' , async function ( ) {
166- expect ( this . user . id ) . toEqual ( this . objectId ) ;
170+ it ( 'should work with plain token' , async ( ) => {
171+ expect ( user . id ) . toEqual ( objectId ) ;
167172 await request ( {
168173 url : `${ serverURL } /requestPasswordReset` ,
169174 method : 'POST' ,
@@ -176,7 +181,7 @@ describe('Regex Vulnerabilities', function () {
176181 } ) ;
177182 const current = await request ( {
178183 method : 'GET' ,
179- url : `http://localhost:8378/1/classes/_User/${ this . user . id } ` ,
184+ url : `http://localhost:8378/1/classes/_User/${ user . id } ` ,
180185 json : true ,
181186 headers : {
182187 'X-Parse-Application-Id' : 'test' ,
@@ -204,7 +209,7 @@ describe('Regex Vulnerabilities', function () {
204209 } ,
205210 } ) ;
206211 const userAgain = await Parse . User . logIn ( 'someemail@somedomain.com' , 'newpassword' ) ;
207- expect ( userAgain . id ) . toEqual ( this . objectId ) ;
212+ expect ( userAgain . id ) . toEqual ( objectId ) ;
208213 } ) ;
209214 } ) ;
210215} ) ;
0 commit comments