patch: NoSQL injection vulnerabilities introduced by GraphQL resolvers

[petruki]

This pull request refactors several resolver functions in src/aggregator/resolvers.js to improve input validation and ensure proper data types when querying MongoDB. The main changes involve converting string IDs to ObjectId, formatting input fields, and enforcing enum values for certain arguments. These updates help prevent errors and ensure consistency across database queries.

Input validation and transformation improvements:

• All _id fields in resolver functions are now explicitly converted to Types.ObjectId before being used in MongoDB queries, reducing the risk of type-related errors. [1] [2] [3] [4]
• The key and name fields are now formatted using the formatInput helper to enforce consistent casing, underscores, and allowed spaces as appropriate for each resolver. [1] [2] [3]

Enum enforcement:

• The strategy and operation arguments in resolveConfigStrategy are now validated against the StrategiesType and OperationsType enums, ensuring only valid values are used in queries.

Imports update:

• Added imports for Types, OperationsType, StrategiesType, and formatInput to support the above changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
72.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud