Fix NoSQL/SQL injection, prototype pollution and vulnerable dependencies - #283

Summary

Audit of the app for injection (SQL/NoSQL), prototype pollution and vulnerable dependencies, with one regression test file per fix (npm run test:unit, uses node:test, no DB required). Every exploit below was reproduced against main and confirmed closed against this branch with the app running.

1. NoSQL operator injection — POST /login (routes/index.js loginHandler)

Exploit: bodyParser.json() lets the client send objects instead of strings, so
{"username":"admin@snyk.io","password":{"$gt":""}} (or {"$gt":""} for both fields, no username needed) became User.find({ username, password: { $gt: "" } }) and matched the admin record → session loggedIn = 1.

Fix: require both fields to be typeof 'string' before touching the DB, and query with equality-only operators so nothing the client sends can ever be interpreted as an operator:

User.find({ username: { $eq: username }, password: { $eq: password } })

Test: tests/nosql-injection.test.js (asserts the DB is never queried for operator payloads and that the filter is exactly $eq).

2. Prototype pollution → privilege escalation — PUT /chat (routes/index.js chat.add/chat.delete)

Exploit: _.merge(message, req.body.message, ...) with lodash 4.17.4 walks __proto__, so
{"auth":{"name":"user","password":"pwd"},"message":{"__proto__":{"canDelete":true}}} set Object.prototype.canDelete = true. The regular user (who has no canDelete) then passed !user.canDelete and could DELETE /chat.

Fix: _.merge on untrusted input replaced with sanitizeMessage() (own keys only, __proto__/constructor/prototype skipped, string values only) + Object.assign; server-owned fields (id, timestamp, userName) are applied last so the client can't override them. chat.delete uses hasOwnProperty('canDelete') so an inherited value can never grant delete. lodash bumped to 4.18.1 as defense in depth.
Test: tests/prototype-pollution-chat.test.js.

3. Prototype pollution → SQL injection via TypeORM — POST /users / GET /users (routes/users.js)

Exploit (see exploits/prototype-pollution-typeorm.md): repo.save({ address: req.body.address }) with typeorm 0.2.24 deep-merged {"address":{"__proto__":{"where":{"id":"2","where":null}}}} into Object.prototype. The subsequent repo.find({ id: 1 }) then picked up the inherited where and returned arbitrary rows; the same primitive is the SQL injection in GHSA for typeorm ≤0.2.24 (CVE-2020-8158).

Fix: pickUserFields() whitelists name/address/role, requires own, string-valued properties, and returns 400 otherwise, so no nested object reaches the ORM. GET /users now passes an explicit find({ where: { id: 1 } }) (own property, so a polluted prototype can't shadow it). typeorm upgraded 0.2.24 → 0.3.31 (createConnection/getConnection → exported DataSource in typeorm-db.js).
Test: tests/typeorm-injection.test.js (stubs the DataSource; also asserts find still receives where: {id: 1} even with Object.prototype.where pre-polluted).

4. Insecure dependencies

Code adapted for mongoose 8 (callback API removed → promises; todo.remove(cb) → findByIdAndDelete). Two related hardening changes in create: content must be a string (400 otherwise — closes the Buffer memory-exposure path independent of the mongoose version), and exec('identify ' + url) → execFile('identify', [url]) with validator.isURL so a crafted image URL can no longer inject shell commands.
Tests: tests/vulnerable-dependencies.test.js (minimum-version assertions + live _.merge pollution check) and tests/todo-create.test.js.

Verification

• npm run test:unit → 22/22 pass.
• App boots against a local mongod (MySQL absent → logs the same connection error as before); /, /about_new, /login, /chat, /create, /users exercised with the payloads from exploits/ → all return 400/401/403 and Object.prototype stays clean.
• npm audit --omit=dev: 76 → 36 vulnerable packages; typeorm/mongoose/lodash/express/body-parser/qs/dust are clean.

Out of scope / follow-ups (still flagged by npm audit, not injection/proto-pollution related)

adm-zip (zip-slip), st (path traversal), ms/humanize-ms/moment/validator/marked (ReDoS/XSS), ejs/ejs-locals/hbs (template RCE), express-fileupload, cfenv, npmconf, errorhandler, morgan, jquery. Note this is Snyk's vulnerable-by-design demo app, so some of these may be intentionally retained.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/f5d251a253b048c8b80ea73e0eec29d6
Open in Devin Desktop: https://app.devin.ai/desktop/session/f5d251a253b048c8b80ea73e0eec29d6?variant=devin
Requested by: @rushcromer