mongoDB injection
code-injection, java, mongodb
Solution
Use one of the supported drivers. Don't deserialize strings as JSON and pass them as queries, e.g. dont' do this (in Ruby):
collection.send(query_type, JSON.parse(parameters))
where `query_type` and `parameters` are strings coming from a form. You would have to be criminally stupid to do this though.
Since there's no query language as such there's not the same room for injection. Part of the reason that SQL injection attacks are possible is that the action to take (`SELECT`, `UPDATE`, `DELETE`, etc.) is part of the query string. MongoDB, and many other newer databases, don't work like that, instead the action is a part of the API. Where SQL drivers only have `query` and in some cases `exec`, MongoDB has `find`, `update`, `insert` and `remove`.
Problem
is there a common pattern in Java to avoid mongoDB injection attacks? Thanks