[LEGIT] Fix - js/code-injection

[liorn-test-app]

🔍 The problem

Code injection
See issue in Legit

🔒 Fix Details

Fixed NoSQL injection vulnerability in threshold parameter

The code was vulnerable to NoSQL injection because the threshold parameter was directly interpolated into a MongoDB $where clause without sanitization. An attacker could inject arbitrary JavaScript code (e.g., 0';while(true){}') that would execute on the database server.

The fix replaces the dangerous $where operator with MongoDB's native query operators ($gt for greater-than comparison). The threshold is now parsed as an integer and validated to be within the expected range (0-99). If validation fails, an error is thrown. This eliminates JavaScript execution entirely and ensures only safe, numeric comparisons are performed in the database query.

--- a/app/data/allocations-dao.js
+++ b/app/data/allocations-dao.js
@@ -60,23 +60,13 @@
         const searchCriteria = () => {
 
             if (threshold) {
-                /*
-                // Fix for A1 - 2 NoSQL Injection - escape the threshold parameter properly
-                // Fix this NoSQL Injection which doesn't sanitze the input parameter 'threshold' and allows attackers
-                // to inject arbitrary javascript code into the NoSQL query:
-                // 1. 0';while(true){}'
-                // 2. 1'; return 1 == '1
-                // Also implement fix in allocations.html for UX.                             
                 const parsedThreshold = parseInt(threshold, 10);
                 
-                if (parsedThreshold >= 0 && parsedThreshold <= 99) {
-                    return {$where: `this.userId == ${parsedUserId} && this.stocks > ${parsedThreshold}`};
+                if (isNaN(parsedThreshold) || parsedThreshold < 0 || parsedThreshold > 99) {
+                    throw new Error(`Invalid threshold value: ${threshold}`);
                 }
-                throw `The user supplied threshold: ${parsedThreshold} was not valid.`;
-                */
-                return {
-                    $where: `this.userId == ${parsedUserId} && this.stocks > '${threshold}'`
-                };
+                
+                return { userId: parsedUserId, stocks: { $gt: parsedThreshold } };
             }
             return {
                 userId: parsedUserId

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud