5 ms·
On the bright side you need not fear this bug for your apps using MongoDB. Mongoid and MongoMapper do not use SQL, so there should be no SQL injection problems
by amorphid 14y ago
On the bright side you need not fear this bug for your apps using MongoDB. Mongoid and MongoMapper do not use SQL, so there should be no SQL injection problems using those two options.
- hayksaakian 14y agoI'm aware they don't use SQL, but someone on HN once told me there was some kind of JavaScript injection you could do in theory. Was wondering how mongoid would handle this technique.
- nbpoole 14y agoExample: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/ http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
- ufo 14y agoThe root cause of the bug here is not sql injection. Its that one of the query functions is overloaded to do different things depending on what datatype you pass to it and that the user can manipulate that datatype (for example, by passing an object in a part of a JSON message that would usully conatin a string). Of course, this is only really serious if one of the overloads gices too much power (in this vulnerability's case it would let you run an arbitrary query)