Figma Fiesta certificates - #156
Conversation
… API handler to validate email field
Refactor EmailDialogue component to use email instead of name; update API handler to validate email field
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // error: `No certificate found for email: ${email}` | ||
| // }); | ||
| // } | ||
| const userData = await User.findOne({ email }); |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
The best way to fix this is to ensure that the email variable passed into the Mongo query is a primitive string, not an object or other structure. This can be done by either (a) enforcing the use of the $eq operator (making MongoDB treat it as a literal value), or (b) using explicit type-checking before querying. The fix should be added at/just before the query on line 72. For completeness, returning a 400 Bad Request on invalid type increases robustness.
Steps:
- Before using
emailin the query, check thattypeof email === "string". - If not, respond with a 400 error and do not perform any query.
- If you want to be certain, you may additionally trim or validate the email string.
- Alternatively, and/or in addition, use the
{ email: { $eq: email } }query form on line 72, forcibly treatingemailas a value in the query.
No new imports are needed.
| @@ -18,6 +18,10 @@ | ||
| .json({ success: false, error: "All fields are required." }); | ||
| } | ||
|
|
||
| if (typeof email !== "string") { | ||
| return res.status(400).json({ success: false, error: "Invalid email format." }); | ||
| } | ||
|
|
||
| //only for ossome hacks 2 | ||
| // if (!name || !event || !type) { | ||
| // return res | ||
| @@ -69,7 +73,7 @@ | ||
| }); | ||
|
|
||
| const User = db.model(eventData.collection[type], userSchema); | ||
| const userData = await User.findOne({ email }); | ||
| const userData = await User.findOne({ email: { $eq: email } }); | ||
|
|
||
| //only for ossome hacks 2 | ||
| // const userData = await User.findOne({ |
2 participants
No description provided.