[LEGIT] Fix - js/code-injection

[liorn-test-app]

🔍 The problem

Code injection
See issue in Legit

🔒 Fix Details

Fixed a NoSQL injection vulnerability in the getByUserIdAndThreshold method. The original code used MongoDB's $where operator with string interpolation, allowing attackers to inject arbitrary JavaScript code through the threshold parameter (e.g., 0';while(true){}').

The fix replaces the dangerous $where clause with native MongoDB query operators ($gt for threshold comparison). The threshold parameter is now parsed to an integer and validated to be within the 0-99 range before being used in a structured query object. This eliminates JavaScript evaluation entirely, preventing code injection while maintaining the same query logic.

--- a/app/data/allocations-dao.js
+++ b/app/data/allocations-dao.js
@@ -74,8 +74,13 @@
                 }
                 throw `The user supplied threshold: ${parsedThreshold} was not valid.`;
                 */
+                const parsedThreshold = parseInt(threshold, 10);
+                if (isNaN(parsedThreshold) || parsedThreshold < 0 || parsedThreshold > 99) {
+                    throw new Error(`Invalid threshold value: ${threshold}`);
+                }
                 return {
-                    $where: `this.userId == ${parsedUserId} && this.stocks > '${threshold}'`
+                    userId: parsedUserId,
+                    stocks: { $gt: parsedThreshold }
                 };
             }
             return {

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud