Merge pull request #9850 from weseek/fix/codeql-problems

fix: CodeQL problems

apps/app/src/server/middlewares/inject-reset-order-by-token-middleware.ts

@@ -15,14 +15,14 @@ export type ReqWithPasswordResetOrder = Request & {
 
 // eslint-disable-next-line import/no-anonymous-default-export
 export default async(req: ReqWithPasswordResetOrder, res: Response, next: NextFunction): Promise<void> => {
-  const token = req.params.token || req.body.token;
+  const token: string = req.params.token || req.body.token;
 
   if (token == null) {
     logger.error('Token not found');
     return next(createError(400, 'Token not found', { code: forgotPasswordErrorCode.TOKEN_NOT_FOUND }));
   }
 
-  const passwordResetOrder = await PasswordResetOrder.findOne({ token });
+  const passwordResetOrder = await PasswordResetOrder.findOne({ token: { $eq: token } });
 
   // check if the token is valid
   if (passwordResetOrder == null || passwordResetOrder.isExpired() || passwordResetOrder.isRevoked) {

apps/app/src/server/models/password-reset-order.ts

@@ -2,7 +2,7 @@ import crypto from 'crypto';
 
 import { addMinutes } from 'date-fns/addMinutes';
 import type { Model, Document } from 'mongoose';
-import mongoose, {
+import {
   Schema,
 } from 'mongoose';
 import uniqueValidator from 'mongoose-unique-validator';

apps/app/src/server/routes/apiv3/page/index.ts

@@ -880,7 +880,7 @@ module.exports = (crowi) => {
     try {
       const revisionIdForFind = revisionId ?? page.revision;
 
-      revision = await Revision.findById(revisionIdForFind);
+      revision = await Revision.findOne({ id: { $eq: revisionIdForFind } });
       pagePath = page.path;
 
       // Error if pageId and revison's pageIds do not match

apps/app/src/server/routes/apiv3/personal-setting.js

@@ -528,7 +528,11 @@ module.exports = (crowi) => {
       if (user.password == null && count <= 1) {
         return res.apiv3Err('disassociate-ldap-account-failed');
       }
-      const disassociateUser = await ExternalAccount.findOneAndRemove({ providerType, accountId, user });
+      const disassociateUser = await ExternalAccount.findOneAndRemove({
+        providerType: { $eq: providerType },
+        accountId: { $eq: accountId },
+        user,
+      });
 
       const parameters = { action: SupportedAction.ACTION_USER_LDAP_ACCOUNT_DISCONNECT };
       activityEvent.emit('update', res.locals.activity._id, parameters);