Hacker News Reader

Comment by hayksaakian | Hacker News Reader

Does something similar affect mongodb or am I OK?

Depending on your ODM, similar vulnerabilities may exist. For example, if you have a user finder that expects an ID parameter

    id=1
    User.where(:id => params[:id]).first
    User.where(:id => 1).first

Then I could construct a hash in the param:

    id[$gt]=0

This would perform the following find:

    User.where(:id => params[:id]).first
    User.where(:id => {"$gt" => 0}).first

Which will return the first user record (probably).

You should be performing casts (usually to strings) before you pass your data to your ODM.

    id[$gt]=0
    User.where(:id => params[:id].to_s).first
    User.where(:id => "{:$gt=>0}").first

This will correctly fail to a find a document.

This is an ActiveRecord issue...MongoDB uses its own ORM (Mongoid/Mongomapper)

That's what I was referring to. Do mongomapper and mongoid have this problem?

On the bright side you need not fear this bug for your apps using MongoDB. Mongoid and MongoMapper do not use SQL, so there should be no SQL injection problems using those two options.

I'm aware they don't use SQL, but someone on HN once told me there was some kind of JavaScript injection you could do in theory. Was wondering how mongoid would handle this technique.

Example: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...

The root cause of the bug here is not sql injection. Its that one of the query functions is overloaded to do different things depending on what datatype you pass to it and that the user can manipulate that datatype (for example, by passing an object in a part of a JSON message that would usully conatin a string). Of course, this is only really serious if one of the overloads gices too much power (in this vulnerability's case it would let you run an arbitrary query)

Reply on news.ycombinator.com