From 10186339091614e4c15d209f050f2571a148cac0 Mon Sep 17 00:00:00 2001 From: cubap Date: Thu, 24 Sep 2026 11:40:44 -0500 Subject: [PATCH] fix: use $eq for history.prime query in getAllVersions Wrap the user-derived @id in a MongoDB $eq operator so it is treated as a literal value rather than a query object, closing the NoSQL injection code-scanning alert (js/sql-injection) in getAllVersions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- controllers/utils.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/controllers/utils.js b/controllers/utils.js index e0fc4f26..8fe9ab7b 100644 --- a/controllers/utils.js +++ b/controllers/utils.js @@ -445,7 +445,7 @@ async function getAllVersions(obj) { throw new Error("Object has no valid history.prime value") } //All the children of this object will have its @id in __rerum.history.prime - ls_versions = await db.find({ "__rerum.history.prime": rootObj['@id'] }).toArray() + ls_versions = await db.find({ "__rerum.history.prime": { $eq: rootObj['@id'] } }).toArray() //The root object is a version, prepend it in ls_versions.unshift(rootObj) return ls_versions