From 20b79772c89023cc386e4294c6259c29f1a9087e Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sat, 15 Aug 2026 09:04:11 +0000 Subject: [PATCH] fix(security): bug - prevent NoSQL injection in loginHandler (SonarQube jssecurity:S5147) Co-Authored-By: Joao Esteves --- routes/index.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/routes/index.js b/routes/index.js index 6b5455f03e4..745c7e69b24 100644 --- a/routes/index.js +++ b/routes/index.js @@ -35,8 +35,12 @@ exports.index = function (req, res, next) { }; exports.loginHandler = function (req, res, next) { + if (typeof req.body.username !== 'string' || typeof req.body.password !== 'string') { + return res.status(401).send() + } + if (validator.isEmail(req.body.username)) { - User.find({ username: req.body.username, password: req.body.password }, function (err, users) { + User.find({ username: String(req.body.username), password: String(req.body.password) }, function (err, users) { if (users.length > 0) { const redirectPage = req.body.redirectPage const session = req.session