array ( 0 => 'index.php', 1 => 'PHP Manual', ), 'head' => array ( 0 => 'UTF-8', 1 => 'de', ), 'this' => array ( 0 => 'mongodb.security.request_injection.php', 1 => 'Request Injection Attacks', ), 'up' => array ( 0 => 'mongodb.security.php', 1 => 'Security', ), 'prev' => array ( 0 => 'mongodb.security.php', 1 => 'Security', ), 'next' => array ( 0 => 'mongodb.security.script_injection.php', 1 => 'Script Injection Attacks', ), 'alternatives' => array ( ), 'source' => array ( 'lang' => 'en', 'path' => 'reference/mongodb/security.xml', ), ); $setup["toc"] = $TOC; $setup["toc_deprecated"] = $TOC_DEPRECATED; $setup["parents"] = $PARENTS; manual_setup($setup); ?>
If you are passing $_GET
(or $_POST
)
parameters to your queries, make sure that they are cast to strings first.
Users can insert associative arrays in GET and POST requests, which could
then become unwanted $-queries.
A fairly innocuous example: suppose you are looking up a user's information
with the request http://www.example.com?username=bob.
Your application creates the query
$q = new \MongoDB\Driver\Query( [ 'username' => $_GET['username'] ])
.
Someone could subvert this by getting
http://www.example.com?username[$ne]=foo, which PHP
will magically turn into an associative array, turning your query into
$q = new \MongoDB\Driver\Query( [ 'username' => [ '$ne' => 'foo' ] ] )
,
which will return all users not named "foo" (all of your users, probably).
This is a fairly easy attack to defend against: make sure $_GET and $_POST parameters are the type you expect before you send them to the database. PHP has the filter_var() function to assist with this.
Note that this type of attack can be used with any database interaction that locates a document, including updates, upserts, deletes, and findAndModify commands.
See » the main documentation for more information about SQL-injection-like issues with MongoDB.