Node.js, Express.js and MongoDB - Security about user input with find and insert

Question

Node.js, Express.js and MongoDB - Security about user input with find and insert

I created a set of REST services based on Express.js to find some results stored in a Mongo Database. A very minimal version of the code for one of the services could be something like:

var express = require('express');
var app = express();
var bodyParser = require('body-parser');
var mongoClient = require('mongodb').MongoClient;

app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

app.get('/results/:name', function(req, res){
    var name = req.params.name;
    mongoClient.connect('mongodb://localhost/test', function (err, db) {
        var collection = db.collection('results');
        collection.find({ name: name }).toArray( function (err, docs) {
            res.json({results: docs});
        });
    });
});

app.listen(3000);

I'm coming from Java and I've been beaten by SQL injections in the past. So I'm not at all comfortable with using the user's input directly in the find request. With my very thin knowledge of the subject, I tried several special characters ( } ) " ' ; and so on) but I've not been able to produce any weird result.

What could go wrong here? What kind of validations or checks should I implement to make sure that it is not possible to inject code or to make the program fail?

Now, let's do something stupid and let's trust the user to input a correct record:

app.post('/results/', function(req, res){
    var record = req.body;
    if( record.name ) {
        mongoClient.connect('mongodb://localhost/test', function (err, db) {
            var collection = db.collection('results');
            collection.insert( record, function(err, doc){});
            res.json({message: 'ok'});
        });
    }
});

How can I validate the schema of the input? And apart from filling the DB with thousand of gigantic inputs, is it possible to exploit this code to inject some code? If yes, how to prevent that?

Thanks a lot!

node.js
mongodb
security
express
sql-injection

Answer 1

I would have put this as a comment but since I'm not yet allowed to do that i'll just put it as a responce.

I go into the details since I'm not the expert here but here is an article I've found to be really interresting about vulnerability when using mongo and node.js.

For validating the model, I use mongoose as a client to my mongoDB, it helps a lot as it has its own validators and you can as well make your own.

I hope it helps you into your search.

Answer 2

Mongodb access is api-based, as oposed to SQL that is language-based. SQL is a language, and if you let inputs from users to be inserted in the language, then it is easy to make code injection and do almost everything to your database.

MongoDB has a different approach, when you are doing a search, you call an API function to do the search, and this API function can only do searchs.

If you let the user choose the fields and the values, then he can make searchs that you don't expect, but that's all.

The same applies for inserts, updates and deletes, be careful of not letting the user to choose the fields and the values, because he can choose ones that you do not expects nor wants.