bug: prevent NoSQL operator injection in loginHandler

[devin-ai-integration]

Summary

exports.loginHandler passed req.body.username / req.body.password straight into User.find({ username, password }), so a JSON body like {"username":"admin@snyk.io","password":{"$gt":""}} authenticated as admin (CWE-943). validator.isEmail also misbehaves on non-string input.

-if (validator.isEmail(req.body.username)) {
-  User.find({ username: req.body.username, password: req.body.password }, cb)
+if (typeof username !== 'string' || typeof password !== 'string' || !validator.isEmail(username)) {
+  return res.status(401).send()
+}
+User.find({ username: { $eq: username }, password: { $eq: password } }, cb)

Native typeof === 'string' guards (not _.isString, which static analyzers don't recognize as a barrier) plus explicit $eq wrapping force both values to be compared as literals. Also propagates the query error via next(err) instead of dereferencing users on failure.

README and exploits/nosql-exploits.sh are updated so the operator-injection demo documents the now-blocked behavior. tests/login-nosql-injection.spec.js covers $gt/$ne payloads, wrong password, and a valid login (4/4 with tap).

Devin-Org: engineering

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review