fix: Account takeover via empty password in LDAP auth adapter (GHSA-863r-39r9-vfcf)

[mtrezza]

Issue

Account takeover via empty password in LDAP auth adapter (GHSA-863r-39r9-vfcf)

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, code comments)
• Add security check
• Add new Parse Error codes to Parse JS SDK

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6933e020-837e-40a6-87af-4ce35279ae44

📥 Commits

Reviewing files that changed from the base of the PR and between 19611b7 and 849843c.

📒 Files selected for processing (3)

• spec/LdapAuth.spec.js
• spec/support/MockLdapServer.js
• src/Adapters/Auth/ldap.js

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

LDAP authentication now rejects missing, empty, null, and non-string passwords before directory contact. Tests verify the rejection and track LDAP bind attempts.

Changes

LDAP password validation

Layer / File(s)	Summary
Password validation and contract src/Adapters/Auth/ldap.js	LDAP authentication requires a non-empty string password and rejects invalid values before LDAP client creation or binding.
Bind tracking and rejection tests spec/support/MockLdapServer.js, spec/LdapAuth.spec.js	The mock server records bind attempts and supports an anonymous-bind control case. Tests cover empty, missing, null, numeric, object, array, and boolean passwords.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 84984

This localized authentication change has no actionable merge-blocking risk identified at the current head and is merge-ready after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant LDAPAuthSpec
  participant validateAuthData
  participant LDAPClient
  participant MockLDAPServer
  LDAPAuthSpec->>validateAuthData: provide password
  alt valid non-empty string
    validateAuthData->>LDAPClient: create client
    LDAPClient->>MockLDAPServer: attempt bind
    MockLDAPServer-->>LDAPAuthSpec: record bind attempt
  else invalid password
    validateAuthData-->>LDAPAuthSpec: return wrong-credentials error
    LDAPAuthSpec->>MockLDAPServer: inspect bindAttempts
    MockLDAPServer-->>LDAPAuthSpec: return no attempts
  end

Loading

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Description check	❌ Error	No pull request description was provided. The required Issue, Approach, and Tasks information is missing.	Add a pull request description that follows the repository template. Describe the issue addressed by GHSA-863r-39r9-vfcf, summarize the implementation and tests, and mark applicable Tasks as completed.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	No security vulnerability is introduced. The production change rejects missing, empty, and non-string passwords before ldapjs.createClient and client.bind. The added tests verify that no bind atte…
Engage In Review Feedback	✅ Passed	PASS: The pull request has no review feedback to engage with. GitHub API evidence shows zero submitted reviews and zero inline review comments. The four issue comments are bot acknowledgments, the aut…
Title check	✅ Passed	The title begins with the required fix: prefix, uses a capitalized first letter after the prefix, and accurately describes the LDAP empty-password security fix.

Full details: Security Check

Explanation

No security vulnerability is introduced. The production change rejects missing, empty, and non-string passwords before ldapjs.createClient and client.bind. The added tests verify that no bind attempt occurs. The unauthenticated-bind behavior and credential recording exist only in spec/support/MockLdapServer.js, which is excluded from the published package.

Full details: Engage In Review Feedback

Explanation

PASS: The pull request has no review feedback to engage with. GitHub API evidence shows zero submitted reviews and zero inline review comments. The four issue comments are bot acknowledgments, the author's request to start CodeRabbit, and CodeRabbit's processing notice. No feedback comment was ignored or resolved without discussion.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[mtrezza]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.48%. Comparing base (bc863d7) to head (849843c).
⚠️ Report is 1 commits behind head on release-8.x.x.

Additional details and impacted files

@@                Coverage Diff                @@
##           release-8.x.x   #10644      +/-   ##
=================================================
- Coverage          92.49%   92.48%   -0.02%     
=================================================
  Files                192      192              
  Lines              16211    16213       +2     
  Branches             234      234              
=================================================
  Hits               14995    14995              
- Misses              1196     1198       +2     
  Partials              20       20              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mtrezza]

@coderabbitai resolve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.

[parseplatformorg]

🎉 This change has been released in version 8.6.88