fix(security): resolve type confusion in query and body parameters

[Abhishek2005-ard]

Overview

This PR resolves a Type Confusion vulnerability across several controllers that could lead to Application Crashes (Unhandled Exceptions). Previously, endpoints assumed that incoming request properties (like password, email, and title) were strings. If an attacker supplied an array or object instead, executing string-specific methods like .test(), .trim(), or .toLowerCase() triggered TypeError exceptions that crashed the server process or returned unhandled 500 Server Errors.

Changes Made

Added strict typeof === "string" checks to validate payload types before executing string methods.

• authController.js:
  • signup: Added type checks to ensure password is a valid string.
  • login: Validated that email and password are strings before querying the database and verifying hashes.
  • updateProfile: Enforced string types for name, currentPassword, and newPassword.
• taskController.js:
  • createTask: Added a strict type check to ensure the title parameter is a valid string before attempting to check its length or escape it.

Testing Performed

• Verified that providing arrays (e.g., {"email": ["test@test.com"]}) or objects safely returns a 400 Bad Request instead of crashing the server.
• Verified that standard requests using valid strings continue to process normally.

close #1568

[Abhishek2005-ard]

@aryandas2911
Pls review the pr when you have time