* Confirm that all parameters are a string and not an array. * This helps prevent NoSQL injection since NoSQL will honor arrays as parameters. * @param {*} req The Express request.query object representing the GET parameters.
(params)
| 89 | * @param {*} req The Express request.query object representing the GET parameters. |
| 90 | */ |
| 91 | function is_valid_strings(params) { |
| 92 | for (var prop in params) { |
| 93 | if (Object.hasOwn(params, prop)) { |
| 94 | if (typeof params[prop] != "string") { |
| 95 | return false; |
| 96 | } |
| 97 | if (params[prop].includes("[") || params[prop].includes["$"] || params[prop].includes["{"]) { |
| 98 | return false; |
| 99 | } |
| 100 | } |
| 101 | } |
| 102 | return true; |
| 103 | } |
| 104 | |
| 105 | /** |
| 106 | * @swagger |