3 ms·
re: 1), I assume you mean by passing an array with $operators into code that gets executed naively? If so, that's not just a Ruby problem; it's possible in any
by cheald 16y ago
re: 1), I assume you mean by passing an array with $operators into code that gets executed naively? If so, that's not just a Ruby problem; it's possible in any language, especially if you're working with a framework that automatically parses query variables and you don't typecheck/typecast before passing user data to your database.
- mike_esspe 16y agoNope, PHP silently converts URL parameters into arrays (and if you don't expect this, than you can get a nasty NOSQL inject) http://www.php.net/manual/en/mongo.security.php http://www.php.net/manual/en/mongo.security.php
- cheald 16y agoYeah, that's a problem in lots of languages/frameworks. Rack automatically parses URL parameters like that, too. The solution is to cast your parameters to a string before using them.