[LEGIT] Fix - js/code-injection

[liorn-test-app]

🔍 The problem

Code injection
See issue in Legit

🔒 Fix Details

Fixed NoSQL injection vulnerability in allocation query

The original code used MongoDB's $where operator with unsanitized user input (threshold), allowing attackers to inject arbitrary JavaScript code into the database query. Payloads like 0';while(true){}' could execute malicious code on the server.

The fix replaces the dangerous $where clause with standard MongoDB query operators (userId and $gt). The threshold parameter is now parsed to an integer and validated to ensure it falls within the acceptable range (0-99). If invalid, an error is thrown before the query is constructed.

This eliminates the JavaScript execution surface entirely while preserving the intended query logic of finding allocations where stocks exceed the threshold.

--- a/app/data/allocations-dao.js
+++ b/app/data/allocations-dao.js
@@ -60,22 +60,15 @@
         const searchCriteria = () => {
 
             if (threshold) {
-                /*
-                // Fix for A1 - 2 NoSQL Injection - escape the threshold parameter properly
-                // Fix this NoSQL Injection which doesn't sanitze the input parameter 'threshold' and allows attackers
-                // to inject arbitrary javascript code into the NoSQL query:
-                // 1. 0';while(true){}'
-                // 2. 1'; return 1 == '1
-                // Also implement fix in allocations.html for UX.                             
                 const parsedThreshold = parseInt(threshold, 10);
                 
-                if (parsedThreshold >= 0 && parsedThreshold <= 99) {
-                    return {$where: `this.userId == ${parsedUserId} && this.stocks > ${parsedThreshold}`};
+                if (isNaN(parsedThreshold) || parsedThreshold < 0 || parsedThreshold > 99) {
+                    throw new Error(`The user supplied threshold: ${threshold} was not valid.`);
                 }
-                throw `The user supplied threshold: ${parsedThreshold} was not valid.`;
-                */
+                
                 return {
-                    $where: `this.userId == ${parsedUserId} && this.stocks > '${threshold}'`
+                    userId: parsedUserId,
+                    stocks: { $gt: parsedThreshold }
                 };
             }
             return {

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud