Fix NoSQL injection in threshold parameter (allocations-dao.js)

[legit-app-ci]

Summary

Fixed a NoSQL injection vulnerability in app/data/allocations-dao.js (lines 56-114) where the threshold parameter was directly interpolated into a MongoDB $where clause without sanitization.

What changed

Replaced the vulnerable $where operator with native MongoDB comparison operators. The threshold parameter is now:

1. Parsed to an integer (parseInt(threshold, 10))
2. Validated to be in the range 0-99
3. Used in a safe query: {userId: parsedUserId, stocks: {$gt: parsedThreshold}}

The original code allowed attackers to inject arbitrary JavaScript (e.g., 0';while(true){}' or 1'; return 1 == '1) that would execute server-side in MongoDB. The fix eliminates JavaScript execution entirely by using MongoDB's native $gt operator, which treats the threshold as data rather than executable code.

Review notes

The commented fix block in the original code has been uncommented and applied. The $where clause with string interpolation has been removed.

[sonarqubecloud]

Quality Gate failed

Failed conditions
E Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!