Uploaded image for project: 'Documentation'
  1. Documentation
  2. DOCS-9649

Comment on: "manual/faq/fundamentals.txt"

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major - P3 Major - P3
    • None
    • None
    • None

    Description

      Hi,

      Previously official mongodb documentation instructed developers to replace "." (dot) and "$" (dollar sign) in user supplied input with unicode equivalents. This was relevant for update() and where() queries, to prevent "NoSQL Injection". I can no longer find this section of the mongodb docs. I now see that there is instead a section describing constructing a BSON object representing the query, using a mongodb client library. Is the previous explanation of replacing "$" and "." with unicode equivalents not necessary because if the query is constructed by formatting a BSON object special characters are escaped? How is this different from passing a JSON object to the query function? To the best of my knowledge creating BSON objects has been supported by client libraries for some time, was the old strategy simply inferior and so it has been removed, or did something change? Thank you for the support!

      Attachments

        Activity

          People

            kay.kim@mongodb.com Kay Kim (Inactive)
            lwcolton@gmail.com colton leekley-winslow
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              6 years, 8 weeks, 6 days ago