nosql_prescan report — 1 file(s), 14 finding(s)

HIGH   NQ-MASS-ASSIGN   hostile.js:14  whole request object written into model — attacker sets any field
       | const u = await User.create(req.body);
HIGH   NQ-MASS-ASSIGN   hostile.js:20  whole request object written into model — attacker sets any field
       | await User.findByIdAndUpdate(req.user.id, req.body);
HIGH   NQ-REQ-QUERY     hostile.js:31  whole request object used as query/filter — operator injection surface
       | res.json(await User.find(req.query));
HIGH   NQ-WHERE-NONLIT  hostile.js:48  server-side JS query operator fed request data
       | res.json(await db.users.find({ $where: req.body.f }));
MEDIUM NQ-FIELD-REQ     hostile.js:7  request value in query field position — operator-object injection possible when body is JSON
       | const user = await User.findOne({ email: req.body.email, password: req.body.password });
MEDIUM NQ-FIELD-REQ     hostile.js:26  request value in query field position — operator-object injection possible when body is JSON
       | res.json(await User.find({ name: new RegExp(req.query.q) }));
MEDIUM NQ-REGEX-REQ     hostile.js:26  request-sourced regex in query — operator injection + ReDoS surface
       | res.json(await User.find({ name: new RegExp(req.query.q) }));
MEDIUM NQ-PROTO-MERGE   hostile.js:36  request object deep-merged into a server object — prototype-pollution surface
       | _.merge(cfg.preferences, req.body);
MEDIUM NQ-PROTO-KEY     hostile.js:42  property keyed by request value or __proto__/constructor name — prototype-pollution sink
       | store[req.body.key] = req.body.value;
MEDIUM NQ-FIELD-REQ     hostile.js:48  request value in query field position — operator-object injection possible when body is JSON
       | res.json(await db.users.find({ $where: req.body.f }));
MEDIUM NQ-FIELD-REQ     hostile.js:60  request value in update field position — operator-object injection review
       | await User.findByIdAndUpdate(req.user.id, { displayName: req.body.name });
LOW    NQ-MASS-ASSIGN   hostile.js:53  whole request object written into model — attacker sets any field
       | const u = await User.create(_.pick(req.body, ['name', 'email']));
LOW    NQ-FIELD-REQ     hostile.js:57  request value in query field position — operator-object injection possible when body is JSON
       | res.json(await User.find({ name: new RegExp(escapeRegExp(req.query.q)) }));
LOW    NQ-REGEX-REQ     hostile.js:57  request-sourced regex in query — operator injection + ReDoS surface
       | res.json(await User.find({ name: new RegExp(escapeRegExp(req.query.q)) }));

scope: deterministic pre-scan — flags patterns for review; not an audit, clean != injection-safe