Details
-
Bug
-
Resolution: Won't Fix
-
Major - P3
-
None
-
None
-
None
Description
Description from contributor PR: https://github.com/mongodb/mongo-csharp-driver/pull/401
You can make any comparsion by an equal operator if you compare to BsonDocument for example:
Example
IMongoCollection<BsonDocument> collection;
|
var value = new BsonDocument { { "$gt", 3 } }; |
var query = collection.Find(x => x["field"] == value); |
|
|
//it will execute:
|
//find({ "field" : { "$gt" : 3 } }) |
I think it can cause security vulnerability for unaware developer, who trust, that equal operator always will test for equality:
public List<BsonDocument> GetObjectByUser(IMongoCollection<BsonDocument> collection, BsonValue data) |
{
|
return collection.Find(x => x["userId"] == data["userId"]).ToList(); |
}
|
public void Attack(IMongoCollection<BsonDocument> collection) |
{
|
var data = GetObjectByUser(collection, new BsonDocument { { "userId", new BsonDocument { { "$ne", ObjectId.Empty } } } }); |
}
|