Merge pull request OWASP#204 from karlhorky/patch-1

Fix NoSQL injection solution
angelwn · Jul 9, 2020 · 58cbbe2 · 58cbbe2
2 parents 823d27b + 38de373
commit 58cbbe2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/data/allocations-dao.js b/app/data/allocations-dao.js
@@ -70,7 +70,7 @@ const AllocationsDAO = function(db){
                 const parsedThreshold = parseInt(threshold, 10);
                 
                 if (parsedThreshold >= 0 && parsedThreshold <= 99) {
-                    return {$where: `this.userId == ${parsedUserId} && this.stocks > ${threshold}`};
+                    return {$where: `this.userId == ${parsedUserId} && this.stocks > ${parsedThreshold}`};
                 }
                 throw `The user supplied threshold: ${parsedThreshold} was not valid.`;
                 */