From d6b66e5982f6660923b70030f3f7b7c47a84b740 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 09:05:36 +0000 Subject: [PATCH] bug: fix jssecurity:S5147 NoSQL injection in routes/index.js (SonarQube AZhSVLrd4wErqc9Ey1Y3) Co-Authored-By: Joao Esteves --- routes/index.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/routes/index.js b/routes/index.js index 6b5455f03e4..41f145a6f7a 100644 --- a/routes/index.js +++ b/routes/index.js @@ -35,8 +35,8 @@ exports.index = function (req, res, next) { }; exports.loginHandler = function (req, res, next) { - if (validator.isEmail(req.body.username)) { - User.find({ username: req.body.username, password: req.body.password }, function (err, users) { + if (typeof req.body.username === 'string' && typeof req.body.password === 'string' && validator.isEmail(req.body.username)) { + User.find({ username: { $eq: req.body.username }, password: { $eq: req.body.password } }, function (err, users) { if (users.length > 0) { const redirectPage = req.body.redirectPage const session = req.session