Function updateCLP

spec/vulnerabilities.spec.js:2550–2564

(permissions)

  describe('(GHSA-4m9m-p9j9-5hjw) User enumeration via signup endpoint', () => {
    async function updateCLP(permissions) {
      const response = await fetch(Parse.serverURL + '/schemas/_User', {
        method: 'PUT',
        headers: {
          'X-Parse-Application-Id': Parse.applicationId,
          'X-Parse-Master-Key': Parse.masterKey,
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({ classLevelPermissions: permissions }),
      });
      const body = await response.json();
      if (body.error) {
        throw body;
      }
    }

    it('does not reveal existing username when public create CLP is disabled', async () => {
      const user = new Parse.User();