fix: HIGH+MEDIUM bugs from full audit - listen error, JWT, upload, mailer, webhook

backend/middleware/security.js

@@ -33,13 +33,14 @@ function sanitize(value) {
 }
 
 function sanitizeBody(req, res, next) {
-  if (req.body) {
-    for (const key of Object.keys(req.body)) {
-      if (typeof req.body[key] === 'string') {
-        req.body[key] = sanitize(req.body[key]);
-      }
+  function walk(obj) {
+    if (!obj || typeof obj !== 'object') return;
+    for (const key of Object.keys(obj)) {
+      if (typeof obj[key] === 'string') obj[key] = sanitize(obj[key]);
+      else if (typeof obj[key] === 'object') walk(obj[key]);
     }
   }
+  walk(req.body);
   next();
 }