Fix NoSQL operator injection in login handler

[devin-ai-integration]

Summary

POST /login passed req.body.username / req.body.password straight into User.find(...), so a JSON body could smuggle Mongo query operators and authenticate as admin without a password ({"username":"admin@snyk.io","password":{"$gt":""}}). CWE-943.

loginHandler now rejects any credential that is not a primitive string before querying, and wraps both values in explicit $eq comparisons so an object payload can never be interpreted as a query operator:

if (typeof username !== 'string' || typeof password !== 'string' || !validator.isEmail(username)) return res.status(401).send()
User.find({ username: { $eq: username }, password: { $eq: password } }, ...)

err from the query is now propagated to next instead of being ignored.

tests/login-nosql-injection.spec.js covers $gt / $ne / $regex / array payloads on both fields (all 401, no session), a wrong password, and a successful real login. The README and exploits/nosql-exploits.sh notes for these payloads were updated to say they are now rejected.

Note: the scan finding was filed against COG-GTM/2025-Federal-Agency-AI-Use-Case-Inventory, but that repo contains only CSV/XLSX inventory data — the referenced code (CSV vulnerability inventory, repo nodejs-goof, vuln_id 81) lives here, so the fix is opened against nodejs-goof.

Written by Devin

Devin-Org: engineering

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review