4 ms·

Does something similar affect mongodb or am I OK?

by hayksaakian 14y ago

danso 14y ago
This is an ActiveRecord issue...MongoDB uses its own ORM (Mongoid/Mongomapper)
- hayksaakian 14y ago
  That's what I was referring to. Do mongomapper and mongoid have this problem?
  - amorphid 14y ago
    On the bright side you need not fear this bug for your apps using MongoDB. Mongoid and MongoMapper do not use SQL, so there should be no SQL injection problems using those two options.
    - hayksaakian 14y ago
      I'm aware they don't use SQL, but someone on HN once told me there was some kind of JavaScript injection you could do in theory. Was wondering how mongoid would handle this technique.
      - nbpoole 14y ago
        Example: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/ http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
    - ufo 14y ago
      The root cause of the bug here is not sql injection. Its that one of the query functions is overloaded to do different things depending on what datatype you pass to it and that the user can manipulate that datatype (for example, by passing an object in a part of a JSON message that would usully conatin a string). Of course, this is only really serious if one of the overloads gices too much power (in this vulnerability's case it would let you run an arbitrary query)
cheald 14y ago
Depending on your ODM, similar vulnerabilities may exist. For example, if you have a user finder that expects an ID parameter id=1 User.where(:id => params[:id]).first User.where(:id => 1).first Then I could construct a hash in the param: id[$gt]=0 This would perform the following find: User.where(:id => params[:id]).first User.where(:id => {"$gt" => 0}).first Which will return the first user record (probably). You should be performing casts (usually to strings) before you pass your data to your ODM. id[$gt]=0 User.where(:id => params[:id].to_s).first User.where(:id => "{:$gt=>0}").first This will correctly fail to a find a document.

Does something similar affect mongodb or am I OK?

danso 14y ago

This is an ActiveRecord issue...MongoDB uses its own ORM (Mongoid/Mongomapper)

hayksaakian 14y ago
That's what I was referring to. Do mongomapper and mongoid have this problem?
- amorphid 14y ago
  On the bright side you need not fear this bug for your apps using MongoDB. Mongoid and MongoMapper do not use SQL, so there should be no SQL injection problems using those two options.
  - hayksaakian 14y ago
    I'm aware they don't use SQL, but someone on HN once told me there was some kind of JavaScript injection you could do in theory. Was wondering how mongoid would handle this technique.
    - nbpoole 14y ago
      Example: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/ http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
  - ufo 14y ago
    The root cause of the bug here is not sql injection. Its that one of the query functions is overloaded to do different things depending on what datatype you pass to it and that the user can manipulate that datatype (for example, by passing an object in a part of a JSON message that would usully conatin a string). Of course, this is only really serious if one of the overloads gices too much power (in this vulnerability's case it would let you run an arbitrary query)

cheald 14y ago

Depending on your ODM, similar vulnerabilities may exist. For example, if you have a user finder that expects an ID parameter id=1 User.where(:id => params[:id]).first User.where(:id => 1).first Then I could construct a hash in the param: id[$gt]=0 This would perform the following find: User.where(:id => params[:id]).first User.where(:id => {"$gt" => 0}).first Which will return the first user record (probably). You should be performing casts (usually to strings) before you pass your data to your ODM. id[$gt]=0 User.where(:id => params[:id].to_s).first User.where(:id => "{:$gt=>0}").first This will correctly fail to a find a document.