Skip to content

fix: nosql injection vulnerabilities #2 - #592

Merged
petruki merged 1 commit into
masterfrom
staging
Oct 31, 2026
Merged

petruki merged 1 commit into
masterfrom
staging

Conversation

@petruki

@petruki petruki commented Oct 31, 2026

Copy link
Copy Markdown
Member

This pull request focuses on improving consistency when handling MongoDB ObjectIds by ensuring they are always converted to strings before being used in queries and operations. This helps prevent potential type mismatches and related bugs when interacting with the database.

ObjectId to String Conversion Consistency:

  • Ensured that domain is passed as a string in the Services.getComponents call within src/routers/component.js.
  • Updated leaveDomain in src/services/admin.js to convert admin.id to a string before using it in team queries and member operations.
  • Modified the deleteMetrics function in src/services/metric.js to convert config._id to a string in the Metric.deleteMany query.
  • Changed the buildMetricsFilter function in src/services/metric.js to convert req.query.domainid to a string before using it in aggregation queries.
  • Updated hasSlackTicket in src/services/slack.js to convert slack.domain to a string before querying SlackTicket.

@petruki petruki added this to the v1.4.1 milestone Oct 31, 2026
@petruki petruki self-assigned this Oct 31, 2026
@petruki petruki added security Vulnerability detected patch Updating dependencies labels Oct 31, 2026
@sonarqubecloud

Copy link
Copy Markdown

@petruki
petruki merged commit 09276ac into master Oct 31, 2026
5 checks passed
@petruki
petruki deleted the staging branch October 31, 2026 23:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

patch Updating dependencies security Vulnerability detected

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant