fix: Database query built from user-controlled sources #896
Conversation
…om user-controlled sources Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files |
✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.
|
JamieSlome
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -57,7 +57,7 @@ | |||
| const options = { upsert: true }; | |||
| const collection = await connect(cnName); | |||
| delete data._id; | |||
| await collection.updateOne({ id: data.id }, { $set: data }, options); | |||
| await collection.updateOne({ id: { $eq: data.id } }, { $set: data }, options); | |||
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources High
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 5 days ago
To fix the problem, we need to ensure that the user input is properly sanitized or validated before it is used in the database query. For MongoDB, we can use the $eq operator to ensure that the user input is interpreted as a literal value and not as a query object. This will prevent any potential NoSQL injection attacks.
We will modify the writeAudit function in src/db/mongo/pushes.js to use the $eq operator when updating the database. Additionally, we will add a check to ensure that the id field in the data object is a string before using it in the query.
| @@ -59,2 +59,5 @@ | ||
| delete data._id; | ||
| if (typeof data.id !== 'string') { | ||
| throw new Error('Invalid id'); | ||
| } | ||
| await collection.updateOne({ id: { $eq: data.id } }, { $set: data }, options); |
JamieSlome
committed this autofix suggestion 5 days ago.
…om user-controlled sources Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for https://github.com/finos/git-proxy/security/code-scanning/83
To fix the problem, we need to ensure that the user-provided
idis treated as a literal value in the MongoDB query. This can be achieved by using the$eqoperator, which ensures that the value is interpreted as a literal and not as a query object. Additionally, we should validate that theidis a string before using it in the query.Suggested fixes powered by Copilot Autofix. Review carefully before merging.