Fix code scanning alert #3: Database query built from user-controlled…

… sources Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
tweag · Sep 21, 2024 · 249c93d · 249c93d
1 parent e5b35c0
commit 249c93d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/part2/VulnerableAppTwo/src/VulnerableAppTwo.js b/part2/VulnerableAppTwo/src/VulnerableAppTwo.js
@@ -29,8 +29,8 @@ app.post('/api/submit', (req, res) => {
 // Route: SQL (NoSQL) Injection
 app.post('/api/login', async (req, res) => {
   const { username, password } = req.body;
-  // Unsafe query
-  const user = await User.findOne({ username: username, password: password });
+  // Safe query using $eq operator
+  const user = await User.findOne({ username: { $eq: username }, password: { $eq: password } });
   if (user) {
     res.send('Login successful');
   } else {