hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Made grammar changes

Browse Source
This commit is contained in:
thank_you
2021-04-06 13:42:57 -04:00
parent 6ade120983
commit ac31260fed
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
python/ql/src/experimental/Security/CWE-943/NoSQLInjection.qhelp
View File

@@ -12,14 +12,14 @@
<p>
Because a user-controlled source is directly injected into the query, the malicious user can have complete control over the query itself.
When the query is executed they can commit different types of actions like bypass role restrictions or access and modify restricted data in the MongoDB database.
When the query is executed they can commit different types of actions like bypassing role restrictions or accessing and modifying restricted data in the MongoDB database.
</p>
</overview>
<recommendation>
<p>
NoSQL injection can be prevented by escaping the user input of special characters that is passed into the NoSQL query.
Alternatively using a sanitize library such as MongoSanitizer to sanitize user input will ensure that users who attempt to construct malicious queries in the user-supplied source is not executed.
NoSQL injections can be prevented by escaping user-input's special characters that are passed into the NoSQL query from the user-supplied source.
Alternatively using a sanitize library such as MongoSanitizer will ensure that user-supplied sources can not act as a malicious query.
</p>
<recommendation>
@@ -31,8 +31,7 @@
<example>
<references>
<li>OWASP NoSQL injection : <a href="https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf"></a>/>> </li>
<li>Security Stack Exchange Discussion : <a href="https://security.stackexchange.com/questions/83231/mongodb-nosql-injection-in-python-code"></a>/>> </li>
<li>OWASP: <a href="https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf">NoSQL Injection</a></li>
<li>Security Stack Exchange Discussion: <a href="https://security.stackexchange.com/questions/83231/mongodb-nosql-injection-in-python-code">Question 83231</a></li>
</references>
</qhelp>