fix(jssecurity:S5147): NoSQL injection in routes/index.js

[devin-ai-integration]

Summary

loginHandler built the MongoDB query straight from req.body:

User.find({ username: req.body.username, password: req.body.password }, ...)

Express' body parser yields objects for JSON (or bracketed form) payloads, so {"username": {"$gt": ""}, "password": {"$gt": ""}} injects MongoDB query operators and authenticates as the first matching user without knowing any credentials — an auth bypass.

Fix: coerce both fields to strings (non-strings become '', which fails validator.isEmail and returns 401 as before) before they reach the query, so only primitive values can enter it.

-if (validator.isEmail(req.body.username)) {
-  User.find({ username: req.body.username, password: req.body.password }, ...)
+var username = typeof req.body.username === 'string' ? req.body.username : '';
+var password = typeof req.body.password === 'string' ? req.body.password : '';
+if (validator.isEmail(username)) {
+  User.find({ username: username, password: password }, ...)

Behavior for legitimate string logins is unchanged. Verified with node --check; the repo's npm test is a Snyk scan requiring auth, so it was skipped.

SonarQube issue key: AZhSVLrd4wErqc9Ey1Y3 (rule jssecurity:S5147, BLOCKER, routes/index.js:39).

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/a15ec2b7b1f44efaaf9ffbaa5ed04570
Requested by: @joao-cognition

---

Note

Devin errored when opening this Pull Request as joao-cognition.
As a fallback, Devin opened this PR as itself.

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

SonarQube issue AZhSVLrd4wErqc9Ey1Y3 — rule jssecurity:S5147 (NoSQL injection, BLOCKER), routes/index.js:39

What was vulnerable: exports.loginHandler passed req.body.username and req.body.password directly into User.find({ username: ..., password: ... }). Because the body parser turns JSON/bracketed-form payloads into objects, a request like {"username": {"$gt": ""}, "password": {"$gt": ""}} injects MongoDB query operators into the filter, matching an arbitrary user and bypassing authentication.

What changed: both values are coerced to strings before the query is built:

var username = typeof req.body.username === 'string' ? req.body.username : '';
var password = typeof req.body.password === 'string' ? req.body.password : '';
if (validator.isEmail(username)) {
  User.find({ username: username, password: password }, ...)

Non-string input becomes '', fails validator.isEmail, and returns the same 401 as before, so no operator object can reach the query. Legitimate string logins behave identically.

Scope: single minimal edit in routes/index.js; no refactoring or other findings touched. Validated with node --check; npm test in this repo is a Snyk scan requiring auth, so it was not run.

Written by Devin