Node.jsにおけるMass Assignment脆弱性を防ぐ

1npm init

1npm i mongoose
2npm i express

1const mongoose = require('mongoose');
2
3const Schema = mongoose.Schema;
4
5const userSchema = new Schema({
6
7    first_name: String,
8    last_name: String,
9    email: String,
10    password: String,
11    isAdmin: {
12        type: Boolean,
13        protect: true,
14        default: false
15    }
16
17});
18
19const User = mongoose.model("User", userSchema);
20
21module.exports = User;
22

1    const express = require("express");
2    const userModel = require("../models/newUser");
3
4    const app = express();
5
6    app.post("/add_user", async (request, response) => {
7        const user = new userModel(request.body);
8
9        try {
10          await user.save();
11          response.send(user);
12        } catch (error) {
13          response.status(500).send(error);
14        }
15    });
16
17module.exports = app;

1const express = require("express");
2const mongoose = require("mongoose");
3const Router = require("./routes/routes")
4
5const app = express();
6
7app.use(express.json());
8
9const username = "<USER>";
10const password = "<USER_PASSWORD>";
11const cluster = "<CLUSTER>";
12const dbname = "<DATABSE_NAME>";
13
14mongoose.connect(
15  `mongodb+srv://${username}:${password}@${cluster}.<APP_ID>.mongodb.net/${dbname}?retryWrites=true&w=majority`,
16  {
17    useNewUrlParser: true,
18    useUnifiedTopology: true
19  }
20);
21
22const db = mongoose.connection;
23db.on("error", console.error.bind(console, "connection error: "));
24db.once("open", function () {
25  console.log("Connected successfully");
26});
27
28app.use(Router);
29
30app.listen(3000, () => {
31  console.log("Server is running at port 3000");
32});
33

1curl --location --request POST 'http://localhost:3000/add_user' \
2--header 'Content-Type: application/json' \
3--data-raw '{
4    "first_name": "Mike",
5    "last_name": "Jones",
6    "email": "mikejones@hmail.com",
7    "isAdmin":"true"
8}'

1const mongoose = require("mongoose");
2
3// create a schema
4var userSchema = new mongoose.Schema({
5	first_name: String,
6	last_name: String,
7	email: String,
8	password: String
9
10	//NB: there is no isAdmin field
11
12});
13
14const User = mongoose.model("User", userSchema);
15
16module.exports = User;

1npm install underscore

1const express = require("express");
2const userModel = require("../models/newUser");
3var _ = require('underscore');
4
5const app = express();
6
7app.post("/add_user", async (request, response) => {
8    const user = new userModel( _.pick(request.body, 'first_name', 'last_name', 'email', 'password'));
9
10    try {
11      await user.save();
12      response.send(user);
13    } catch (error) {
14      response.status(500).send(error);
15    }
16});
17
18module.exports = app;

1import { z, AnyZodObject } from "zod";
2import express, { Request, Response, NextFunction } from 'express';
3
4const app = express();
5
6app.use(express.json());
7
8const dataSchema = z.object({
9    body: z.object({
10        first_name: z.string({
11            required_error: "First name is required",
12            invalid_type_error: "First name must be a string",
13        }),
14        last_name: z.string({
15            required_error: "Last name is required",
16            invalid_type_error: "Last name must be a string",
17        }),
18        password: z.string({
19            required_error: "Password is required",
20        }),
21        email: z
22            .string({
23                required_error: "Email is required",
24            })
25            .email("Not a valid email"),
26    }),
27});
28
29const validate =
30    (schema: AnyZodObject) =>
31    async (req: Request, res: Response, next: NextFunction) => {
32        try {
33            await schema.parseAsync({
34                body: req.body,
35                query: req.query,
36                params: req.params,
37            });
38            return next();
39        } catch (error) {
40            return res.status(400).json(error);
41        }
42    };
43
44app.post("/create",
45    validate(dataSchema),
46    (req: Request, res: Response): Response => {
47        return res.json({
48            ...req.body
49        });
50    }
51);

1const { Sequelize } = require("sequelize");
2
3const User = sequelize.define("users", {
4    username: {
5        type: DataTypes.STRING,
6        allowNull: false
7    },
8
9    email: {
10        type: DataTypes.STRING,
11        allowNull: false
12    },
13
14    password: {
15        type: DataTypes.STRING,
16        allowNull: false
17    },
18
19    is_verified: {
20        type: DataTypes.BOOLEAN,
21        allowNull: false,
22        default: false
23    },
24
25 });

1// Create a User
2const user = {
3    username: req.body.username,
4    email: req.body.email,
5    password: req.body.password,
6    is_verified: false
7  };
8
9//Save User in the database
10User.create(user)
11.then(data => {
12    res.send(data);
13})
14.catch(err => {
15    res.status(500).send({
16    message:
17        err.message || "Error occurred. User not created!"
18    });
19});

1// Create a User
2const user = {
3    username: req.body.username,
4    email: req.body.email,
5    password: req.body.password
6  };

1model User {
2    id      		Int    @id @default(autoincrement())
3    username        String
4    email       	String
5    Role    		Boolean    @default(USER)
6  }
7
8enum Role {
9    USER
10    ADMIN
11}

1const { PrismaClient } = require("@prisma/client");
2const express = require("express");
3const prisma = new PrismaClient();
4
5const app = express();
6
7app.use(express.json());
8
9app.post('/add_user', async (req, res) => {
10    const user = await prisma.user.create({ data: req.body });
11    res.json(user);
12  });

1model User {
2    id      		Int    @id @default(autoincrement())
3    username        String
4    email       	String
5  }

1// Defining the user data
2let user = {
3    username: req.body.username,
4    email: req.body.email,
5    password: req.body.password,
6    isAdmin: req.body.role
7};

1// Saving user details
2app.post('/add_user',(req, res) => {
3
4let myQuery = "INSERT INTO users SET ?";
5
6    let query = connection.query(myQuery, user,(err, results) => {
7        if(err) throw err;
8        res.send(apiResponse(results));
9    });
10
11});

1// Defining the user data
2let user = {
3    username: req.body.username,
4    email: req.body.email,
5    password: req.body.password
6};

1ALTER TABLE users ALTER isAdmin SET DEFAULT ‘false’;