Skip to content

fix: nosql injection vulnerabilities #3 - #593

Merged
petruki merged 1 commit into
masterfrom
staging
Nov 1, 2026
Merged

petruki merged 1 commit into
masterfrom
staging

Conversation

@petruki

@petruki petruki commented Nov 1, 2026

Copy link
Copy Markdown
Member

This pull request addresses several type consistency issues across the codebase, ensuring that IDs and other fields are consistently converted to strings before being used in database queries. This helps prevent potential bugs related to type mismatches when querying MongoDB.

Type consistency improvements:

  • src/aggregator/configuration-resolvers.js: In resolveComponents, component IDs are now explicitly converted to strings before querying with getComponents, ensuring reliable lookups.
  • src/services/metric.js: In deleteMetrics, both domain and config IDs are converted to strings in the Metric.deleteMany query, preventing issues with mixed types.
  • src/services/slack.js: In hasSlackTicket, all relevant fields from ticket_content (environment, group, switcher, and status) are converted to strings before querying SlackTicket, improving query accuracy and robustness.

@petruki petruki added this to the v1.4.1 milestone Nov 1, 2026
@petruki petruki self-assigned this Nov 1, 2026
@petruki petruki added security Vulnerability detected patch Updating dependencies labels Nov 1, 2026
@sonarqubecloud

sonarqubecloud Bot commented Nov 1, 2026

Copy link
Copy Markdown

@petruki
petruki merged commit 0ce54ab into master Nov 1, 2026
5 checks passed
@petruki
petruki deleted the staging branch November 1, 2026 22:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

patch Updating dependencies security Vulnerability detected

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant