Skip to content

Commit 3544e2c

Browse files
fix(security): remediate NoSQL injection vulnerability (bug S5147)
Co-Authored-By: Joao Esteves <joao.esteves@cognition.ai>
1 parent d240896 commit 3544e2c

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

routes/index.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,9 @@ exports.index = function (req, res, next) {
3636

3737
exports.loginHandler = function (req, res, next) {
3838
if (validator.isEmail(req.body.username)) {
39-
User.find({ username: req.body.username, password: req.body.password }, function (err, users) {
39+
var username = String(req.body.username);
40+
var password = String(req.body.password);
41+
User.find({ username: username, password: password }, function (err, users) {
4042
if (users.length > 0) {
4143
const redirectPage = req.body.redirectPage
4244
const session = req.session

0 commit comments

Comments
 (0)