fix: address codeql database query using user controlled source

finos · Mar 21, 2024 · f6a8382 · f6a8382
1 parent f16f025
commit f6a8382
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/src/db/mongo/repo.js b/src/db/mongo/repo.js
@@ -12,7 +12,7 @@ exports.getRepos = async (query = {}) => {
 
 exports.getRepo = async (name) => {
   const collection = await connect(cnName);
-  return collection.findOne({ name: name });
+  return collection.findOne({ name: { $eq: name } });
 };
 
 exports.createRepo = async (repo) => {

diff --git a/src/db/mongo/users.js b/src/db/mongo/users.js
@@ -3,7 +3,7 @@ const usersCollection = 'users';
 
 exports.findUser = async function (username) {
   const collection = await connect(usersCollection);
-  return collection.findOne({ username: username });
+  return collection.findOne({ username: { $eq: username } });
 };
 
 exports.getUsers = async function (query) {