From cf4e41743c792c84e6890e913a0f4993128a2e4b Mon Sep 17 00:00:00 2001
From: petruki <31597636+petruki@users.noreply.github.com>
Date: Sun, 1 Nov 2026 14:30:01 -0800
Subject: [PATCH] fix: nosql injection vulnerabilities #3

---
 src/aggregator/configuration-resolvers.js | 3 ++-
 src/services/metric.js                    | 2 +-
 src/services/slack.js                     | 6 +++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/aggregator/configuration-resolvers.js b/src/aggregator/configuration-resolvers.js
index e3b0a7a..e6845cf 100644
--- a/src/aggregator/configuration-resolvers.js
+++ b/src/aggregator/configuration-resolvers.js
@@ -160,6 +160,7 @@ export async function resolveFlatDomain(_source, context) {
 }
 
 export async function resolveComponents(source) {
-    const components = await getComponents({ _id: { $in: source.components } });
+    const componentIds = source.components.map(component => component._id.toString());
+    const components = await getComponents({ _id: { $in: componentIds } });
     return components.length ? components.map(component => component.name) : [];
 }
\ No newline at end of file
diff --git a/src/services/metric.js b/src/services/metric.js
index d65d8f3..2e62aeb 100644
--- a/src/services/metric.js
+++ b/src/services/metric.js
@@ -63,7 +63,7 @@ export async function deleteMetrics(req) {
     }
 
     config = await verifyOwnership(req.admin, config, config.domain, ActionTypes.DELETE, RouterTypes.ADMIN);
-    await Metric.deleteMany({ domain: config.domain, config: config._id.toString() }).exec();
+    await Metric.deleteMany({ domain: config.domain.toString(), config: config._id.toString() }).exec();
 }
 
 async function aggreagateReasons(aggregate, result) {
diff --git a/src/services/slack.js b/src/services/slack.js
index 3e2998a..d3ef56d 100644
--- a/src/services/slack.js
+++ b/src/services/slack.js
@@ -62,9 +62,9 @@ async function hasSlackTicket(slack, ticket_content) {
     const tickets = await SlackTicket.find({ 
         slack: slack._id.toString(),
         domain: slack.domain.toString(),
-        environment: ticket_content.environment,
-        group: ticket_content.group,
-        switcher: ticket_content.switcher,
+        environment: ticket_content.environment.toString(),
+        group: ticket_content.group.toString(),
+        switcher: ticket_content.switcher?.toString(),
         status: ticket_content.status.toString(),
     });