Security patch 2

src/notes/notes.service.ts

@@ -12,7 +12,7 @@ export class NotesService {
 	}
 
 	async findOne(id: string): Promise<Note> {
-		return await this.noteModel.findOne({ _id: id });
+		return await this.noteModel.findOne({ _id: { $eq: id } });
 	}
 
 	async create(note: Note): Promise<Note> {
@@ -21,10 +21,11 @@ export class NotesService {
 	}
 
 	async delete(id: string): Promise<Note> {
-		return await this.noteModel.findByIdAndRemove(id);
+		return await this.noteModel.findByIdAndRemove({ $eq: id });
 	}
 
 	async update(id: string, note: Note) {
-		return await this.noteModel.findByIdAndUpdate(id, note, { new: false });
+		// TODO: sanitize the update note
+		return await this.noteModel.findByIdAndUpdate({ $eq: id }, note, { new: false });
 	}
 }

src/users/users.service.ts

@@ -12,7 +12,7 @@ export class UsersService {
 	}
 
 	async findOne(username: string): Promise<User> {
-		return await this.userModel.findOne({ username: username });
+		return await this.userModel.findOne({ username: { $eq: username } });
 	}
 
 	async create(user: User): Promise<User> {
@@ -21,12 +21,12 @@ export class UsersService {
 	}
 
 	async delete(username: string): Promise<User> {
-		return await this.userModel.findOneAndRemove({ username: username });
+		return await this.userModel.findOneAndRemove({ username: { $eq: username } });
 	}
 
 	async update(username: string, user: User) {
 		return await this.userModel.findOneAndUpdate(
-			{ username: username },
+			{ username: { $eq: username } },
 			user,
 			{ new: false },
 		);