* Confirm that all parameters are a string and not an array. * This helps prevent NoSQL injection since NoSQL will honor arrays as parameters. * @param {*} req The Express request.query object representing the GET parameters.
(params)
| 29 | * @param {*} req The Express request.query object representing the GET parameters. |
| 30 | */ |
| 31 | function is_valid_strings(params) { |
| 32 | for (var prop in params) { |
| 33 | if (Object.hasOwn(params, prop)) { |
| 34 | if (typeof params[prop] != "string") { |
| 35 | return false; |
| 36 | } |
| 37 | if (params[prop].includes("[") || params[prop].includes["$"] || params[prop].includes["{"]) { |
| 38 | return false; |
| 39 | } |
| 40 | } |
| 41 | } |
| 42 | return true; |
| 43 | } |
| 44 | |
| 45 | |
| 46 | /** |