mirror of
https://github.com/github/codeql.git
synced 2026-02-16 15:03:41 +01:00
41 lines
2.2 KiB
XML
41 lines
2.2 KiB
XML
<!DOCTYPE qhelp PUBLIC
|
|
"-//Semmle//qhelp//EN"
|
|
"qhelp.dtd">
|
|
<qhelp>
|
|
|
|
<overview>
|
|
<p>
|
|
Passing user-controlled sources into NoSQL queries can result in a NoSQL injection flaw.
|
|
This tainted NoSQL query containing a user-controlled source can then execute a malicious query in a NoSQL database such as MongoDB.
|
|
In order for the user-controlled source to taint the NoSQL query, the user-controller source must be converted into a Python object using something like <code>json.loads</code> or <code>xmltodict.parse</code>.
|
|
</p>
|
|
<p>
|
|
Because a user-controlled source is passed into the query, the malicious user can have complete control over the query itself.
|
|
When the tainted query is executed, the malicious user can commit malicious actions such as bypassing role restrictions or accessing and modifying restricted data in the NoSQL database.
|
|
</p>
|
|
</overview>
|
|
|
|
<recommendation>
|
|
<p>
|
|
NoSQL injections can be prevented by escaping user-input's special characters that are passed into the NoSQL query from the user-supplied source.
|
|
Alternatively, using a sanitize library such as MongoSanitizer will ensure that user-supplied sources can not act as a malicious query.
|
|
</p>
|
|
</recommendation>
|
|
|
|
<example>
|
|
<p>In the example below, the user-supplied source is passed to a MongoDB function that queries the MongoDB database.</p>
|
|
<sample src="examples/NoSQLInjection-bad.py" />
|
|
<p> This can be fixed by using a sanitizer library like MongoSanitizer as shown in this annotated code version below.</p>
|
|
<sample src="examples/NoSQLInjection-good.py" />
|
|
</example>
|
|
|
|
<references>
|
|
<li>Mongoengine: <a href="http://mongoengine.org/">Documentation</a>.</li>
|
|
<li>Flask-Mongoengine: <a href="http://docs.mongoengine.org/projects/flask-mongoengine/en/latest/">Documentation</a>.</li>
|
|
<li>PyMongo: <a href="https://pypi.org/project/pymongo/">Documentation</a>.</li>
|
|
<li>Flask-PyMongo: <a href="https://flask-pymongo.readthedocs.io/en/latest/">Documentation</a>.</li>
|
|
<li>OWASP: <a href="https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf">NoSQL Injection</a>.</li>
|
|
<li>Security Stack Exchange Discussion: <a href="https://security.stackexchange.com/questions/83231/mongodb-nosql-injection-in-python-code">Question 83231</a>.</li>
|
|
</references>
|
|
</qhelp>
|