Security: verify NoSQL query-operator injection risk on /auth/login (no input sanitization found)

Summary

Could not find express-mongo-sanitize or any equivalent request-sanitization middleware anywhere in the backend. Login credentials are parsed from JSON via body-parser and handed to passport-local-mongoose's authenticate(), which builds its lookup query from the raw parsed field.

Status

Not yet confirmed exploitable — this needs an actual live test (e.g. sending a payload where email/password are objects containing Mongo query operators instead of strings, against a throwaway/seeded test account) before treating it as a live finding. Flagging so it doesn't get lost, since the absence of any sanitization layer is itself worth fixing regardless of whether this specific login path turns out to be exploitable.

Suggested fix

Add express-mongo-sanitize (or equivalent manual type-checking on req.body fields expected to be strings) as global middleware in backend/index.js, and verify the login path specifically once that's in place.

Start in backend/index.js and trace the /auth/login path through body-parser and passport-local-mongoose's authenticate(). Test object-valued email and password inputs containing Mongo query operators against a throwaway or seeded account. Done means the exploitability is documented and the login inputs are sanitized or type-checked, with the login path verified afterward.