This document discusses NoSQL injections in Node.js applications using MongoDB. It provides examples of how request body parameters can be used to alter MongoDB queries and presents best practices for validating user input to prevent injection attacks. These include using middleware to validate request data matches expected types and structures, or using libraries like Joi and Celebrate for schema-based validation. The document emphasizes that input validation is crucial to secure MongoDB queries from manipulation through user-supplied values.

1. NoSQL INJECTIONS IN NODE.JS
The case of MongoDB
Vladimir de Turckheim
5 DEC 2016

2. </> IN PRACTICEapp.post(‘/documents/find’, (req, res) => {
const query = { };
if (req.body.desiredType) query.type = req.body.desiredType;
if (!query.type) return res.json([ ]);
Document.find(query).exec()
.then((r) => res.json(r));
1
2
3
4
5
6

3. </> IN PRACTICEapp.post(‘/documents/find’, (req, res) => {
const query = { };
if (req.body.desiredType) query.type = req.body.desiredType;
if (!query.type) return res.json([ ]);
Document.find(query).exec()
.then((r) => res.json(r));
1
2
3
4
5
6

4. </> IN PRACTICEapp.post(‘/documents/find’, (req, res) => {
const query = { };
if (req.body.desiredType) query.type = req.body.desiredType;
if (!query.type) return res.json([ ]);
Document.find(query).exec()
.then((r) => res.json(r));
1
2
3
4
5
6
req.body
query
outcome
{ desiredType: ‘blog’ }
{ type: ‘blog’ }
All documents which field ‘type’ equals ‘blog’

5. </> IN PRACTICEapp.post(‘/documents/find’, (req, res) => {
const query = { };
if (req.body.desiredType) query.type = req.body.desiredType;
if (!query.type) return res.json([ ]);
Document.find(query).exec()
.then((r) => res.json(r));
1
2
3
4
5
6
req.body
query
outcome
{ desiredType: }
{ type: }

6. </> IN PRACTICEapp.post(‘/documents/find’, (req, res) => {
const query = { };
if (req.body.desiredType) query.type = req.body.desiredType;
if (!query.type) return res.json([ ]);
Document.find(query).exec()
.then((r) => res.json(r));
1
2
3
4
5
6
req.body
query
outcome
{ desiredType: { $ne: 0 } }
{ type: }

7. </> IN PRACTICEapp.post(‘/documents/find’, (req, res) => {
const query = { };
if (req.body.desiredType) query.type = req.body.desiredType;
if (!query.type) return res.json([ ]);
Document.find(query).exec()
.then((r) => res.json(r));
1
2
3
4
5
6
req.body
query
outcome
{ desiredType: { $ne: 0 } }
{ type: { $ne: 0 } }

8. </> IN PRACTICEapp.post(‘/documents/find’, (req, res) => {
const query = { };
if (req.body.desiredType) query.type = req.body.desiredType;
if (!query.type) return res.json([ ]);
Document.find(query).exec()
.then((r) => res.json(r));
1
2
3
4
5
6
req.body
query
outcome
{ desiredType: { $ne: 0 } }
{ type: { $ne: 0 } }
All documents which field ‘type’ does not equal 0

9. WAIT, THERE IS WORST
{ $where:’this.amount > 0’ }

10. In MongoDB < 2.4, it is possible to perform all operations
on a database from an injection (including dropDatabase).

11. VALIDATE WHAT GETS INSIDE
YOUR APPLICATION
hapi
on a route, use config.validate
express
add a data validation middleware
It can be a custom one
It can use a third party library
See tutorial online

12. </> EXPRESS: CUSTOM DATA VALIDATION MIDDLEWARE
app.post('/documents/find', validate, (req, res) => ...);
const validate = function (req, res, next) {
const body = req.body;
if (body.desiredType && !(typeof body.desiredType==='string')){
return next(new Error('title must be a string'));
}
next();
};
1
2
3
4
5
6
7

13. </> EXPRESS: USING JOI AND CELEBRATE TO VALIDATE DATA
app.post('/documents/find', validate, (req, res) => ...);
const validate = Celebrate({
body: Joi.object.keys({
desiredType: Joi.string().optional()
})
});
1
2
3
4
5

14. THANKS FOR YOUR ATTENTION !
Contact me at
vladimir@sqreen.io