Fix CodeQL alerts

Author: mnarulabuilds

backend/package-lock.json

@@ -51,7 +51,7 @@
     "@babel/preset-env": "^7.15.8",
     "chai": "^4.3.4",
     "cypress": "^9.2.0",
-    "eslint": "^8.57.0",
+    "eslint": "^8.6.0",
     "eslint-config-airbnb-base": "^15.0.0",
     "eslint-plugin-import": "^2.25.3",
     "eslint-plugin-mocha": "^8.0.0",

backend/package.json

@@ -15,7 +15,7 @@ const resetPassword = async (req, res) => {
       });
     }
     const user = await User.findOne({
-      resetToken: token,
+      resetToken: { $eq: token },
       resetTokenExpiry: { $gt: Date.now() },
     });
     if (!user) {

backend/src/controllers/auth/resetPassword.js

@@ -8,7 +8,7 @@ const googleCallback = async (req, res) => {
 
   try {
     // Check if the user already exists in the database
-    let existingUser = await User.findOne({ email: user.email });
+    let existingUser = await User.findOne({ email: { $eq: user.email } });
 
     if (!existingUser) {
       // Create a new user if not found
@@ -39,7 +39,7 @@ const githubCallback = async (req, res) => {
   const user = req.user;
 
   try {
-    let existingUser = await User.findOne({ email: user.email });
+    let existingUser = await User.findOne({ email: { $eq: user.email } });
 
     if (!existingUser) {
       existingUser = new User({
@@ -67,7 +67,7 @@ const facebookCallback = async (req, res) => {
   const user = req.user;
 
   try {
-    let existingUser = await User.findOne({ email: user.email });
+    let existingUser = await User.findOne({ email: { $eq: user.email } });
 
     if (!existingUser) {
       existingUser = new User({

backend/src/controllers/auth/sso.js

@@ -5,7 +5,7 @@ const verifyEmail = async (req, res) => {
   const { token } = req.query;
 
   try {
-    const user = await User.findOne({ verificationToken: token });
+    const user = await User.findOne({ verificationToken: { $eq: token } });
     if (!user) {
       return res.status(400).json({ error: "Invalid verification token" });
     }

backend/src/controllers/auth/verifyEmail.js

@@ -1,13 +1,16 @@
 const fs = require("fs");
+const path = require("path");
 const textUtils = require("../../utils/text");
 const audioUtils = require("../../utils/audio");
 
+const ROOT_DIR = "src/utils/audio/audios/";
+
 const generateAudioSummary = async (req, res) => {
   try {
     const { audioData } = req.body;
 
     // check if valid audioData provided
-    if (!audioData || !audioData.audioFilePath || !audioData.format) {
+    if (!audioData || !audioData.audioFileName || !audioData.format) {
       return res.status(400).json({ error: "Invalid audio data provided." });
     }
 
@@ -17,13 +20,13 @@ const generateAudioSummary = async (req, res) => {
     }
 
     // Check if the audio file exists
-    if (!fs.existsSync(audioData.audioFilePath)) {
+    if (!fs.existsSync(path.resolve(ROOT_DIR, audioData.audioFileName))) {
       return res.status(400).json({ error: "Audio file not found." });
     }
 
     // Convert audio to text asynchronously
     const textFromAudio = await audioUtils.convertAudioToText(
-      audioData.audioFilePath,
+      audioData.audioFileName,
       audioData.format
     );
 

backend/src/controllers/summary/generateAudioSummary.js

@@ -56,7 +56,7 @@ userSchema.methods.generateVerificationToken = function () {
 
 // Static method to find by email
 userSchema.statics.findByEmail = function (email) {
-  return this.findOne({ email });
+  return this.findOne({ email: { $eq: email } });
 };
 
 module.exports = mongoose.model("User", userSchema);

backend/src/models/User.js

@@ -1,10 +1,12 @@
 const DeepSpeech = require("deepspeech");
 const convertMP3toWAV = require("./convertMP3toWAV");
 const fs = require("fs");
+const path = require("path");
+const ROOT_DIR = "src/utils/audio/audios/";
 
 const wavOutputPath = "src/utils/audio/audios/output.wav";
 
-async function convertAudioToText(audioFilePath, audioFormat) {
+async function convertAudioToText(audioFileName, audioFormat) {
   let audioData = Buffer.from("");
 
   // Load the DeepSpeech model without specifying model and scorer paths
@@ -13,6 +15,8 @@ async function convertAudioToText(audioFilePath, audioFormat) {
   // Load the language model scorer without specifying scorer path
   model.enableExternalScorer();
 
+  const audioFilePath = path.resolve(ROOT_DIR, audioFileName);
+
   if (audioFormat === "mp3") {
     await convertMP3toWAV(audioFilePath, wavOutputPath);
     audioData = fs.readFileSync(wavOutputPath);

backend/src/utils/audio/convertAudioToText.js

@@ -33,7 +33,7 @@ describe("Summary Controller - Audio Content", () => {
 
     it("should return error if audio file not found", async () => {
       req.body.audioData = {
-        audioFilePath: "invalid/path/to/audio.mp3",
+        audioFileName: "invalid/path/to/audio.mp3",
         format: "mp3",
       };
       sinon.stub(fs, "existsSync").returns(false);
@@ -45,7 +45,7 @@ describe("Summary Controller - Audio Content", () => {
 
     it("should return error if audio format not supported", async () => {
       req.body.audioData = {
-        audioFilePath: "valid/path/to/audio.mp3",
+        audioFileName: "valid/path/to/audio.mp3",
         format: "unsupported_format",
       };
       sinon.stub(fs, "existsSync").returns(true);
@@ -57,7 +57,7 @@ describe("Summary Controller - Audio Content", () => {
 
     it("should return error if no text found in the audio", async () => {
       req.body.audioData = {
-        audioFilePath: "src/utils/audio/audios/no-speech.mp3",
+        audioFileName: "no-speech.mp3",
         format: "mp3",
       };
       sinon.stub(fs, "existsSync").returns(true);
@@ -71,7 +71,7 @@ describe("Summary Controller - Audio Content", () => {
 
     it("should generate summary from text", async () => {
       req.body.audioData = {
-        audioFilePath: "valid/path/to/audio.mp3",
+        audioFileName: "valid/path/to/audio.mp3",
         format: "mp3",
       };
       sinon.stub(fs, "existsSync").returns(true);
@@ -90,7 +90,7 @@ describe("Summary Controller - Audio Content", () => {
 
     it("should handle internal server error", async () => {
       req.body.audioData = {
-        audioFilePath: "valid/path/to/audio.mp3",
+        audioFileName: "valid/path/to/audio.mp3",
         format: "mp3",
       };
       sinon.stub(fs, "existsSync").returns(true);