) => {
  const { info, config } = context;
  if (!info || !info.sessionToken) {
    throw new Parse.Error(
      Parse.Error.INVALID_SESSION_TOKEN,
      'Invalid session token'
    );
  }
  const sessionToken = info.sessionToken;
  const selectedFields = getFieldNames(queryInfo)
    .filter(field => field.startsWith(keysPrefix))
    .map(field => field.replace(keysPrefix, ''));

  const keysAndInclude = extractKeysAndInclude(selectedFields);
  const { keys } = keysAndInclude;
  let { include } = keysAndInclude;

  if (userId && !keys && !include) {
    return {
      sessionToken,
    };
  } else if (keys && !include) {
    include = 'user';
  }

  if (userId) {
    // We need to re create the auth context
    // to avoid security breach if userId is provided
    context.auth = new Auth({
      config,
      isMaster: context.auth.isMaster,
      user: { id: userId },
    });
  }

  const options = {};
  if (keys) {
    options.keys = keys
      .split(',')
      .map(key => `${key}`)
      .join(',');
  }
  if (include) {
    options.include = include
      .split(',')
      .map(included => `${included}`)
      .join(',');
  }

  const response = await rest.find(
    config,
    context.auth,
    '_User',
    // Get the user it self from auth object
    { objectId: context.auth.user.id },
    options,
    info.clientVersion,
    info.context
  );
  if (!response.results || response.results.length == 0) {
    throw new Parse.Error(
      Parse.Error.INVALID_SESSION_TOKEN,
      'Invalid session token'
    );
  } else {
    const user = response.results[0];
    return {
      sessionToken,
      user,
    };
  }
};
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.