Is the express-mongo-sanitize functionality up and running?

Question

Is the express-mongo-sanitize functionality up and running?

Currently, I am in the process of implementing security middleware for my modest MERN web application. Specifically, I have opted to utilize helmet and express-mongo-sanitize to safeguard against NoSQL injection attacks.

In my server.js file, I have configured it as shown below:

const express = require('express')
const helmet = require('helmet')
const mongoSanitize = require('express-mongo-sanitize')

...

app.use(mongoSanitize())
app.use(helmet())

// Routes below

...

To verify its effectiveness, I attempted a simulated sign-up with the following details:

username: {"$gt": ""} password: 'TestPassword'

This resulted in the following req.body:

{
    username: '{"$gt": ""}',
    password: 'TestPassword'
}

However, despite this input, express-mongo-sanitize did not detect any issues and the data was still passed through to the database. Could it be that I am misunderstanding something? Perhaps the value assigned to the username key is already in the correct format? I acknowledge that I may lack certain knowledge on the subject and appreciate your patience as I continue to learn.

javascript mongodb security sql-injection mern

Answer 1

Answer №1

Express-mongo-sanitize acts to sanitize any keys that begin with a dollar symbol.

username: '{"$gt": ""}' --> This example does not demonstrate a key starting with a dollar sign. In fact, the value of username is simply a string.

Consider sending this object instead:

{

"username": { "$gt": "" }

}

Answer 2

Express-mongo-sanitize acts to sanitize any keys that begin with a dollar symbol.

username: '{"$gt": ""}' --> This example does not demonstrate a key starting with a dollar sign. In fact, the value of username is simply a string.

Consider sending this object instead:

{

"username": { "$gt": "" }

}

Answer 3

Answer №2

Encountered a similar issue and found a solution by first parsing the incoming request body before utilizing the mongoSanitize package. Here's how I did it...

const express = require("express")
const mongoSanitize = require("express-mongo-sanitize')

const app = express()

app.use(express.json())
app.use(mongoSanitize())

Answer 4

Encountered a similar issue and found a solution by first parsing the incoming request body before utilizing the mongoSanitize package. Here's how I did it...

const express = require("express")
const mongoSanitize = require("express-mongo-sanitize')

const app = express()

app.use(express.json())
app.use(mongoSanitize())

Answer 5

Answer №3

In my analysis of the code and debugging process, I discovered that the sanitization function targets keys with symbols like $ or a dot in key=value pairs from query and post parameters. It also aims to sanitize keys found in the body and header of the request.

Even the JSON data shared by the previous user was not exempt from this sanitization process.

For instance, a URL like https://your-domain/?$user=json would have its key sanitized to just "user=json".

Interestingly, it does not remove the $ symbol from parameter values as expected, posing potential security risks for both keys and values. I reached out to the creator on GitHub for clarification and await their response. Ideally, full protection should be applied to both keys and values, especially if only the value is being saved in MongoDB.

To enhance security, the sanitization script scans various HTTP sections such as 'body', 'params', 'headers', and 'query' to eliminate any potentially harmful $ or . characters.

Answer 6

In my analysis of the code and debugging process, I discovered that the sanitization function targets keys with symbols like $ or a dot in key=value pairs from query and post parameters. It also aims to sanitize keys found in the body and header of the request.

Even the JSON data shared by the previous user was not exempt from this sanitization process.

For instance, a URL like https://your-domain/?$user=json would have its key sanitized to just "user=json".

Interestingly, it does not remove the $ symbol from parameter values as expected, posing potential security risks for both keys and values. I reached out to the creator on GitHub for clarification and await their response. Ideally, full protection should be applied to both keys and values, especially if only the value is being saved in MongoDB.

To enhance security, the sanitization script scans various HTTP sections such as 'body', 'params', 'headers', and 'query' to eliminate any potentially harmful $ or . characters.

Answer 7

Answer №4

Take a close look at the guidelines

This special tool scans for any keys in objects that start with a $ symbol or have a dot, within req.body, req.query or req.params. It then has the option to either:

completely eliminate these keys and related data from the object, or

substitute the restricted characters with another permitted character.

It focuses on finding KEYS, not values. For instance

{ username: '{"$gt": ""}', password: 'TestPassword'}

the $ symbol is present in the value of username key, not in the key itself. This is why express-mongo-sanitize does not detect it.

To grasp this better, consider this scenario

// req.body
{ 
    "username": "{'$gt': ''}", 
    "password": "TestPassword",
    "$ne": "1",
    "$gt": "",
}

// the default functionality of express-mongo-sanitize will erase 
// the last two keys and keep the first one.
// Therefore, right after applying the middleware you will see this 
{ 
    username: "{'$gt': ''}", 
    password: "TestPassword",
}

Answer 8

Take a close look at the guidelines

This special tool scans for any keys in objects that start with a $ symbol or have a dot, within req.body, req.query or req.params. It then has the option to either:

completely eliminate these keys and related data from the object, or

substitute the restricted characters with another permitted character.

It focuses on finding KEYS, not values. For instance

{ username: '{"$gt": ""}', password: 'TestPassword'}

the $ symbol is present in the value of username key, not in the key itself. This is why express-mongo-sanitize does not detect it.

To grasp this better, consider this scenario

// req.body
{ 
    "username": "{'$gt': ''}", 
    "password": "TestPassword",
    "$ne": "1",
    "$gt": "",
}

// the default functionality of express-mongo-sanitize will erase 
// the last two keys and keep the first one.
// Therefore, right after applying the middleware you will see this 
{ 
    username: "{'$gt': ''}", 
    password: "TestPassword",
}

Answer 9

Answer №5

It seems that the solution provided by @A10n is accurate, implying that 'express-mongo-sanitize' may only offer a partial remedy. To further enhance security, I have devised a quick-and-dirty method to eliminate curly brackets from all req.body/params objects in order to mitigate most NoSQL attacks:

// Middleware function that switches {} with [] to prevent NoSQL attacks
    const removeCurlies = (req, res, next) => {
      Object.keys(req.body).forEach((key) => {
        req.body[key] = _.replace(req.body[key], "{", "[");
        req.body[key] = _.replace(req.body[key], "}", "]");
      });
      Object.keys(req.params).forEach((key) => {
        req.params[key] = _.replace(req.params[key], "{", "[");
        req.params[key] = _.replace(req.params[key], "}", "]");
      });
      next();
    };

Add the following code before your routes:

    app.use(removeCurlies);

Answer 10

It seems that the solution provided by @A10n is accurate, implying that 'express-mongo-sanitize' may only offer a partial remedy. To further enhance security, I have devised a quick-and-dirty method to eliminate curly brackets from all req.body/params objects in order to mitigate most NoSQL attacks:

// Middleware function that switches {} with [] to prevent NoSQL attacks
    const removeCurlies = (req, res, next) => {
      Object.keys(req.body).forEach((key) => {
        req.body[key] = _.replace(req.body[key], "{", "[");
        req.body[key] = _.replace(req.body[key], "}", "]");
      });
      Object.keys(req.params).forEach((key) => {
        req.params[key] = _.replace(req.params[key], "{", "[");
        req.params[key] = _.replace(req.params[key], "}", "]");
      });
      next();
    };

Add the following code before your routes:

    app.use(removeCurlies);

Is the express-mongo-sanitize functionality up and running?

Answer №1

Answer №2

Answer №3

Answer №4

Answer №5

Similar questions

Customizable text editing tool using Jquery

Display a specific template in the detail grid of the Kendo Grid depending on certain conditions

Utilize the Webpack library and libraryTarget settings to establish our own custom library as a global variable

The ng-repeat function is iterating through the array multiple times

Best practices for logging error objects in JavaScript

The module at 'D:Education odemonin odemon.js' could not be located by Node

Storing and Manipulating a JavaScript Object with Vuex: A New Perspective

Root location for offline and pre-production in the Backbone boilerplate router

Tips for sending a file array together with other string/int variables from JavaScript to PHP

What is the best way to eliminate the nesting in this ternary operation?

Automatically reset the form after submission in CakePHP 1.3

What impact does turning off Javascript have on ASP.NET?

HTML form with a dropdown menu

What is the best way to create a selection input using buttons and save the chosen option in the state?

JavaScript file creation and opening issue in Firefox

Crop the contents of an array between two specified characters

What is the best way to include attributes in an HTML element?

Error: Unable to locate module - The specified file cannot be resolved when utilizing an external JavaScript library

The border color of the text input is not changing as expected when in focus

Position the vertical bar directly adjacent to the form input field

Is the express-mongo-sanitize functionality up and running?

Answer №1

Answer №2

Answer №3

Answer №4

Answer №5

Similar questions

Customizable text editing tool using Jquery

Display a specific template in the detail grid of the Kendo Grid depending on certain conditions

Utilize the Webpack library and libraryTarget settings to establish our own custom library as a global variable

The ng-repeat function is iterating through the array multiple times

Best practices for logging error objects in JavaScript

The module at 'D:Education odemonin odemon.js' could not be located by Node

Storing and Manipulating a JavaScript Object with Vuex: A New Perspective

Root location for offline and pre-production in the Backbone boilerplate router

Tips for sending a file array together with other string/int variables from JavaScript to PHP

What is the best way to eliminate the nesting in this ternary operation?

Automatically reset the form after submission in CakePHP 1.3

What impact does turning off Javascript have on ASP.NET?

HTML form with a dropdown menu

What is the best way to create a selection input using buttons and save the chosen option in the state?

JavaScript file creation and opening issue in Firefox

Crop the contents of an array between two specified characters

What is the best way to include attributes in an HTML element?

Error: Unable to locate module - The specified file cannot be resolved when utilizing an external JavaScript library

The border color of the text input is not changing as expected when in focus

Position the vertical bar directly adjacent to the form input field

The module at 'D:Education odemonin odemon.js' could not be located by Node