new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

nosql/injection

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

NoSQL Injection via string-based filter building

Unsafe NoSQL injection occurs when building query objects from untrusted input using string concatenation and eval(). For example, concatenating req.query.name into a query string like "{ name: '" + req.query.name + "' }" and then using eval() to parse it is dangerous and allows injection attacks.

Safe NoSQL query construction with driver query objects

Prevent NoSQL injection by using driver query objects instead of string-based construction. Let the driver handle query structure. For example, use const filter = { name: req.query.name }; db.collection('users').find(filter) instead of building query strings.

Disallow operator injection in NoSQL

Reject operator injection by disallowing $ in keys or operator values. For example, check if JSON.stringify(req.body).includes('"$') and throw an error if detected. This prevents client-controlled injection of operators.

Do not accept raw JSON fragments for NoSQL query execution

Do not accept raw JSON fragments from clients to execute as queries. Disallow client-controlled query operators like $where, $regex, or $expr unless strictly required and validated.

Dangerous NoSQL pattern: $where operator

Allowing a client to submit { "$where": "this.balance > 0" } enables remote code execution or heavy CPU consumption attacks.

Dangerous NoSQL pattern: shell commands for DB tools

Concatenating user input into query language strings or shell commands for database tools enables injection attacks.

Do not accept raw JSON queries from NoSQL clients

Do not accept raw JSON queries from clients or eval untrusted strings for NoSQL execution.

Give your agent this brain