patch: prevent nosql injection for metric resources

[petruki]

This pull request improves the handling and validation of query parameters for metric-related API endpoints and enhances input sanitization before querying the database. The main changes include stricter validation of request parameters, improved type handling, and the introduction of input formatting to prevent inconsistent or unsafe values.

API request validation improvements:

• Added stricter validation for query parameters in /metric/data/ and /metric/statistics/ endpoints, including type checks and length constraints for key, environment, component, and group, as well as ISO8601 validation for date filters. [1] [2]
• Improved the type handling for the page parameter by converting it to a Number and checking for NaN using Number.isNaN.

Input sanitization and consistency:

• Introduced the formatInput helper in buildMetricsFilter to sanitize and normalize the environment, component, and group query parameters before using them in database queries, reducing the risk of inconsistent or unsafe values. [1] [2]
• Ensured that the result query parameter is explicitly converted to a boolean value before use.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud