* Confirm that all parameters are a string and not an array. * This helps prevent NoSQL injection since NoSQL will honor arrays as parameters. * @param {*} req The Express request.query object representing the GET parameters.
(params)
| 57 | * @param {*} req The Express request.query object representing the GET parameters. |
| 58 | */ |
| 59 | function is_valid_strings(params) { |
| 60 | for (var prop in params) { |
| 61 | if (Object.hasOwn(params, prop)) { |
| 62 | if (typeof params[prop] != "string") { |
| 63 | return false; |
| 64 | } |
| 65 | if (params[prop].includes("[") || params[prop].includes["$"] || params[prop].includes["{"]) { |
| 66 | return false; |
| 67 | } |
| 68 | } |
| 69 | } |
| 70 | return true; |
| 71 | } |
| 72 | |
| 73 | /** |
| 74 | * @swagger |