added nosql sanitization

Author: yash-pouranik

backend/routes/data.js

@@ -4,6 +4,22 @@ const mongoose = require('mongoose');
 const { ObjectId } = require('mongodb');
 const verifyApiKey = require('../middleware/verifyApiKey');
 
+
+//  sanitizer to remove keys starting with $
+const sanitize = (obj) => {
+    const clean = {};
+    for (const key in obj) {
+        if (!key.startsWith('$')) {
+            clean[key] = obj[key];
+        }
+    }
+    return clean;
+};
+
+
+
+
+
 // Dynamic POST Route
 // Example: POST /api/data/products
 router.post('/:collectionName', verifyApiKey, async (req, res) => {
@@ -43,6 +59,9 @@ router.post('/:collectionName', verifyApiKey, async (req, res) => {
             }
         }
 
+        const safeData = sanitize(cleanData);
+        cleanData = safeData;
+
         // --- NEW: CHECK DB LIMIT ---
         // Calculate approx size in bytes
         const docSize = Buffer.byteLength(JSON.stringify(cleanData));
@@ -214,7 +233,11 @@ router.put('/:collectionName/:id', verifyApiKey, async (req, res) => {
             }
             // String check is loose in JS, usually fine.
         }
-        // ---------------------------------------
+
+
+        const safeData = sanitize(incomingData);
+        incomingData = safeData;
+
 
         const finalCollectionName = `${project._id}_${collectionName}`;
 

backend/tests/auth.test.js

@@ -3,7 +3,7 @@ const mongoose = require('mongoose');
 const app = require('../app');
 const Developer = require('../models/Developer');
 const bcrypt = require('bcryptjs');
-require('dotenv').config(); 
+require('dotenv').config();
 
 // --- SETUP ---
 beforeAll(async () => {
@@ -13,17 +13,14 @@ beforeAll(async () => {
         throw new Error("TEST_MONGO_URL not defined in .env");
     }
 
-    // Disconnect any existing connection first
     await mongoose.disconnect();
     await mongoose.connect(uri);
 });
 
 afterAll(async () => {
-    // Clean up and close connection
     await mongoose.connection.close();
 });
 
-// --- TESTS ---
 describe('Auth API Security', () => {
 
     // Har test se pehle database saaf karein