NoSQL Injection: MarsDB

Constructing a dynamic NoSQL statement with input from an untrusted source might enable an attacker to modify the statement's meaning or execute arbitrary NoSQL commands.

NoSQL injection errors occur when user input is improperly sanitized and directly included in database queries, enabling attackers to manipulate the query logic and access unauthorized data. This can happen with operators such as $where, $gt, $lt, and $ne. To prevent such attacks, avoid using these operators with user input whenever possible, and always ensure proper validation and sanitization of user input.

Example 1: The following code dynamically constructs and executes a NoSQL query that searches for items that match a specified name. The query restricts the items displayed to those where the owner matches the user name of the currently-authenticated user.

    ...
    function getItemsByOwner(username: string) {
      db.items.find({ $where: `this.owner === '${username}'` }).then((orders: any) => {
        console.log(orders);
      }).catch((err: any) => {
        console.error(err);
      });
    }
    ...

If the `username` is `john'; return true; //`, the query becomes:

    db.items.find({ $where: `this.owner === 'john'; return true; //` })

This returns all documents in the items collection.