Fix CodeQL alert (Database query built from user-controlled sources)

apps/app/src/server/routes/apiv3/page/index.ts

@@ -229,7 +229,7 @@ module.exports = (crowi) => {
       let pages;
       try {
         if (isSharedPage) {
-          const shareLink = await ShareLink.findOne({ _id: shareLinkId });
+          const shareLink = await ShareLink.findOne({ _id: { $eq: shareLinkId } });
           if (shareLink == null) {
             throw new Error('ShareLink is not found');
           }

apps/app/src/server/routes/apiv3/share-links.js

@@ -156,7 +156,7 @@ module.exports = (crowi) => {
       }
 
       try {
-        const shareLinksResult = await ShareLink.find({ relatedPage }).populate({ path: 'relatedPage', select: 'path' });
+        const shareLinksResult = await ShareLink.find({ relatedPage: { $eq: relatedPage } }).populate({ path: 'relatedPage', select: 'path' });
         return res.apiv3({ shareLinksResult });
       }
       catch (err) {
@@ -292,7 +292,8 @@ module.exports = (crowi) => {
       }
 
       try {
-        const deletedShareLink = await ShareLink.remove({ relatedPage });
+        console.log('ああああ', relatedPage);
+        const deletedShareLink = await ShareLink.remove({ relatedPage: { $eq: relatedPage } });
 
         activityEvent.emit('update', res.locals.activity._id, { action: SupportedAction.ACTION_SHARE_LINK_DELETE_BY_PAGE });
 

apps/app/src/server/routes/apiv3/user-group.js

@@ -197,7 +197,7 @@ module.exports = (crowi) => {
       const { groupId } = req.query;
 
       try {
-        const userGroup = await UserGroup.findById(groupId);
+        const userGroup = await UserGroup.findOne({ _id: { $eq: groupId } });
         const ancestorUserGroups = await UserGroup.findGroupsWithAncestorsRecursively(userGroup);
         return res.apiv3({ ancestorUserGroups });
       }
@@ -370,7 +370,7 @@ module.exports = (crowi) => {
       const { groupId } = req.query;
 
       try {
-        const userGroup = await UserGroup.findById(groupId);
+        const userGroup = await UserGroup.findOne({ _id: { $eq: groupId } });
 
         const descendantGroups = await UserGroup.findGroupsWithDescendantsRecursively([userGroup], []);
         const descendantGroupIds = descendantGroups.map(userGroups => userGroups._id.toString());
@@ -423,7 +423,7 @@ module.exports = (crowi) => {
       const { groupId } = req.query;
 
       try {
-        const userGroup = await UserGroup.findById(groupId);
+        const userGroup = await UserGroup.findOne({ _id: { $eq: groupId } });
 
         const [ancestorGroups, descendantGroups] = await Promise.all([
           UserGroup.findGroupsWithAncestorsRecursively(userGroup, []),