3 ms·
This relies on javascript to be passed to $where. There is no excuse for not sanitizing your inputs.
by optymizer 14y ago
This relies on javascript to be passed to $where. There is no excuse for not sanitizing your inputs.
- ajross 14y agoThe same thing could be said of SQL injection attacks, yet...
- optymizer 14y ago... no one is pointing fingers at MySQL, like they are at MongoDB, as if this is some kind of security flaw in MongoDB. It's a feature, not a bug. The docs make it clear that $where can run JavaScript, so if you know what you're doing, you're not going to allow JavaScript to flow through your software as if it's valid input.