4 ms·
Great example of how to introduce a sql/mongo query injection in your code. The string interpolation in findById will open up your whole database to the world,
by st3fan 7y ago
Great example of how to introduce a sql/mongo query injection in your code.
The string interpolation in findById will open up your whole database to the world, possibly even allowing remote command execution.
Same for the other functions that access MongoDB.
Do not copy / paste random code until you fully understand it.
- jaywalk 7y agoPretty sure you're incorrect, and there's no danger in what's being done here.
- sdinsn 7y ago> in findById No, I'm pretty sure that's fine. findById takes an ID, not anything else or any type of query.
- st3fan 7y agoThe code was updated after my comment.
- hombre_fatal 7y agoIf you follow the code, you'll see it just adds a filter: Filters.eq("_id", id) to the underlying query. Just like how { _id: { $eq: id }} is safe.
- st3fan 7y agoThe code was updated after my comment.