Merge pull request #50 from beginwebdev2002/alert-autofix-3

Potential fix for code scanning alert no. 3: Database query built from user-controlled sources

Author: beginwebdev2002

backend/src/modules/inventory/infrastructure/repositories/inventory.repository.ts

@@ -39,8 +39,26 @@ export class InventoryRepository {
     id: string,
     updateData: Partial<Inventory>,
   ): Promise<Inventory | null> {
+    if (!id || !id.match(/^[0-9a-fA-F]{24}$/)) {
+      return null;
+    }
+
+    const sanitizedUpdate: Partial<
+      Pick<Inventory, 'itemName' | 'quantity' | 'location'>
+    > = {};
+
+    if (typeof updateData.itemName === 'string') {
+      sanitizedUpdate.itemName = updateData.itemName;
+    }
+    if (typeof updateData.quantity === 'number') {
+      sanitizedUpdate.quantity = updateData.quantity;
+    }
+    if (typeof updateData.location === 'string') {
+      sanitizedUpdate.location = updateData.location;
+    }
+
     const doc = await this.inventoryModel
-      .findByIdAndUpdate(id, { $set: updateData }, { new: true })
+      .findByIdAndUpdate(id, { $set: sanitizedUpdate }, { new: true })
       .exec();
     return doc ? this.toDomain(doc) : null;
   }