fix: nosql injection in customer password reset

[peleg-development]

Security Fixes

Severity	Issue	File	What's wrong	Fixed
CRITICAL	NoSQL injection in customer password reset	routes/customer.js:51,511,521	Three findOne/updateOne calls use unsanitized req.body.email. Attacker sends {"email": {"$gt": ""}} ...	✅

Fix details

NoSQL injection in customer password reset

--- a/routes/customer.js
+++ b/routes/customer.js
@@ -51 +51 @@
-    const customer = await db.customers.findOne({ email: req.body.email });
+    const customer = await db.customers.findOne({ email: mongoSanitize(req.body.email) });
@@ -511 +511 @@
-    const customer = await db.customers.findOne({ email: req.body.email });
+    const customer = await db.customers.findOne({ email: mongoSanitize(req.body.email) });
@@ -521 +521 @@
-    await db.customers.updateOne({ email: req.body.email }, { $set: { resetToken: passwordToken, resetTokenExpiry: tokenExpiry } }, { multi: false });
+    await db.customers.updateOne({ email: mongoSanitize(req.body.email) }, { $set: { resetToken: passwordToken, resetTokenExpiry: tokenExpiry } }, { multi: false });