3 ms·
This isn't injection at all. No commands other than the find are being performed. Little Bobby Tables (Little Bobby Collections?) will not have any luck here.
by asher_ 10y ago
This isn't injection at all. No commands other than the find are being performed. Little Bobby Tables (Little Bobby Collections?) will not have any luck here.
In addition to the fact that you can't execute arbitrary commands with this example, the example itself is flawed. If the programmer's intention was to exclude "secret projects" from all searches, then they should have written the query to do that. They didn't, and allowed multiple other ways of accessing those records.
Writing some code that does something different to what you intended it to do is not a NoSQL injection, it's just bad code.
- asher_ 10y agoTo expand on this.. You could use $exists, $gt, $eq, $ne, $in, $nin, regex, and all kinds of other ways to query what you want. If the programmer wanted to exclude "secret projects" the query should have had a form similar to { $and: [{ type: { $ne: 'secret projects' }}, <rest of query>] }