From c8e8d4a079a12c7eeae62a899a32b63749dd31c5 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 09:05:20 +0000 Subject: [PATCH] bug(jssecurity:S5147): prevent NoSQL operator injection in login query Coerce username/password to strings before building the User.find query so object payloads cannot inject MongoDB query operators. SonarQube AZhSVLrd4wErqc9Ey1Y3. Co-Authored-By: Joao Esteves --- routes/index.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/routes/index.js b/routes/index.js index 6b5455f03e4..1f92739ee95 100644 --- a/routes/index.js +++ b/routes/index.js @@ -35,8 +35,10 @@ exports.index = function (req, res, next) { }; exports.loginHandler = function (req, res, next) { - if (validator.isEmail(req.body.username)) { - User.find({ username: req.body.username, password: req.body.password }, function (err, users) { + var username = typeof req.body.username === 'string' ? req.body.username : ''; + var password = typeof req.body.password === 'string' ? req.body.password : ''; + if (validator.isEmail(username)) { + User.find({ username: username, password: password }, function (err, users) { if (users.length > 0) { const redirectPage = req.body.redirectPage const session = req.session