bug: remediate Snyk SAST findings in routes/index.js (NoSQL injection, open redirect, rate limiting)

[devin-ai-integration]

Summary

Remediates one Snyk SAST group, all confined to routes/index.js (no other files touched).

Findings addressed

Snyk rule	Severity	Location (orig)	Status after re-scan
javascript/NoSqli (CWE-943)	High	routes/index.js:39	Resolved
javascript/OR Open Redirect (CWE-601)	Medium	routes/index.js:61	Resolved
javascript/NoRateLimitingForExpensiveWebOperation (CWE-770)	Medium	:67,75,82,89,152,241,298 (7)	Mitigated in-code; still flagged (see note)

snyk code test for routes/index.js: 9 → 7 findings. NoSqli and Open Redirect cleared; the 7 rate-limiting findings remain flagged (Snyk only credits known middleware libraries — see note).

NoSQL injection (loginHandler)

Reject non-string credentials before they reach the Mongo query, then coerce to primitive strings so operator objects ({$gt:""}, {$ne:null}) can't be injected:

if (typeof req.body.username !== 'string' || typeof req.body.password !== 'string')
  return res.status(400).send();
var username = String(req.body.username);
var password = String(req.body.password);
User.find({ username: username, password: password }, ...)

Open redirect (adminLoginSuccess)

Resolve the post-login target from a constant same-origin allowlist; the redirect always uses the matched constant, never the attacker-controlled value:

var ALLOWED_REDIRECTS = ['/admin', '/account_details', '/'];
var safeRedirect = ALLOWED_REDIRECTS.find(p => p === redirectPage);
return res.redirect(safeRedirect || '/admin');

Rate limiting (7 expensive handlers)

Added a minimal in-file fixed-window per-IP limiter and wrapped the flagged handlers (login, admin, get_account_details, save_account_details, create, import, about_new):

var defaultLimiter = createRateLimiter({ windowMs: 60_000, max: 100 });
exports.login = withRateLimit(defaultLimiter, function (req, res, next) { ... });

Note: Snyk's NoRateLimitingForExpensiveWebOperation only recognizes known middleware (e.g. express-rate-limit), which would require editing package.json — owned by a different remediation bucket, so it was intentionally left untouched. The in-file limiter provides equivalent runtime protection (verified: 100×200 then 429), but Snyk continues to flag these 7 until the dependency-based middleware is adopted.

Verification

• node --check routes/index.js passes; npm install + npm run build (browserify) succeed.
• App boots (node --openssl-legacy-provider app.js) against MongoDB; / and /login return 200.
• Runtime checks: NoSQL operator-object login → 400; malicious redirectPage=https://evil.com → redirected to /admin; allowlisted /account_details honored; /about_new returns 429 after 100 req/min.
• Re-scan diff: snyk code test 9 → 7 findings for routes/index.js (NoSqli + Open Redirect cleared).
• git diff --name-only confirms only routes/index.js changed.

UI smoke test recording (TODO list create + login page render) attached in the session.

Link to Devin session: https://app.devin.ai/sessions/1114ed5c091f49ebb81c677f4f193b29
Requested by: @stephencornwell

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring