mirror of
https://github.com/github/codeql.git
synced 2025-12-21 03:06:31 +01:00
114984bd8c
currently we do not:
- recognize the pattern
`{'author': {"$eq": author}}` as protected
- recognize arguements to `$where` (and friends)
as vulnerable
17 lines
345 B
Python
17 lines
345 B
Python
from pymongo import MongoClient
|
|
client = MongoClient()
|
|
|
|
db = client.test_database
|
|
|
|
import datetime
|
|
post = {
|
|
"author": "Mike",
|
|
"text": "My first blog post!",
|
|
"tags": ["mongodb", "python", "pymongo"],
|
|
"date": datetime.datetime.now(tz=datetime.timezone.utc),
|
|
}
|
|
|
|
posts = db.posts
|
|
post_id = posts.insert_one(post).inserted_id
|
|
post_id
|