Potential fix for code scanning alert no. 5: Database query built from user-controlled sources

[yynss21]

Potential fix for https://github.com/byRespect/tracker-hub/security/code-scanning/5

To fix this problem, only allow fields that are explicitly permitted for update to be passed to findByIdAndUpdate. This is typically achieved by creating a whitelist of allowed update fields and then constructing a new object that contains only those fields from updateSessionDto. This process is called "whitelisting" or "picking" fields.

• How to fix:
  Create a helper function (e.g., pick) that takes the incoming object and a list of allowed fields, and returns a new object with only those fields present.
  Use this function on the updateSessionDto before passing it to Mongoose's findByIdAndUpdate.

• Where to change:
  In packages/backend/src/sessions/sessions.service.ts, inside the update method, immediately before the database call, use the helper to pick only allowed fields.

• What is needed:

  • Add a pick function using plain TypeScript/JavaScript.
  • Define an array of allowed field names to be updated.
  • Apply this filter before the call to findByIdAndUpdate.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.