Code Security Finding: NoSQL Injection (CWE-943, High Severity) in user-dao.js:104

[joshn-whitesource-app]

Code Security Finding

This finding was first detected on 2024-02-07 07:19pm GMT and is still present in the last scan performed on 2024-02-07 07:19pm GMT:

Severity	Vulnerability Type	CWE	File	Data Flows
High	NoSQL Injection	CWE-943	user-dao.js:104	1
Vulnerable Code NodeGoat/app/data/user-dao.js Lines 99 to 104 in be11d1e _id: parseInt(userId) }, callback); }; this.getUserByUserName = (userName, callback) => { usersCol.findOne({ 1 Data Flow/s detected NodeGoat/app/routes/index.js Line 38 in be11d1e app.post("/signup", sessionHandler.handleSignup); NodeGoat/app/routes/session.js Line 189 in be11d1e this.handleSignup = (req, res, next) => { NodeGoat/app/routes/session.js Line 193 in be11d1e userName, NodeGoat/app/routes/session.js Line 206 in be11d1e if (validateSignup(userName, firstName, lastName, password, verify, email, errors)) { NodeGoat/app/routes/session.js Line 138 in be11d1e const validateSignup = (userName, firstName, lastName, password, verify, email, errors) => { NodeGoat/app/routes/session.js Line 206 in be11d1e if (validateSignup(userName, firstName, lastName, password, verify, email, errors)) { NodeGoat/app/routes/session.js Line 208 in be11d1e userDAO.getUserByUserName(userName, (err, user) => { NodeGoat/app/data/user-dao.js Line 103 in be11d1e this.getUserByUserName = (userName, callback) => { NodeGoat/app/data/user-dao.js Line 105 in be11d1e userName: userName NodeGoat/app/data/user-dao.js Line 104 in be11d1e usersCol.findOne({ 🏴 Suppress Finding ... as False Alarm ... as Acceptable Risk