nosql injection in meteor.js application

NOSQL INJECTION IN APPS

Vietnam

WWW.DESIGNVELOPER.COM

1.INTRODUCTION


Hello!I am Son Leo At Designveloper for > 2

yearso Work with Meteor for > a

year

You can find me at:@sonlexqt

Required: familiarity with


Don’t get me wrong !

is NOT INSECURE


SQL InjectionQueries use STRINGs as the control mechanism.


Exploits of a Mom

// queryINSERT INTO Students VALUES ( '$Name' )// inputRobert'); DROP TABLE Students; --// resultINSERT INTO Students VALUES ( 'Robert' ); DROP TABLE Students; --' )

source: https://xkcd.com/327


https://xkcd.com/327

SQL Injection - One more example// querySELECT * FROM users WHERE username='peter’AND (password= ('$PWD'))// input' OR '1'='1’// resultSELECT * FROM users WHERE username='peter' AND (password='' OR '1'='1')


NoSQL InjectionQueries use OBJECTs as the control mechanism.


2.DEMO TIME

Meteor-shop web application


Let’s play a role of a hacker !With NoSQL Injection skill.


3.SOLUTIONS


“MAKE

ASSERTIONS ON USER

INPUT DATA


CHECK to the rescuehttps://atmospherejs.com/meteor/check

Check whether a value matches a

pattern$ meteor add check

check(slug, String);

ERROR: Expected String, got Object


https://atmospherejs.com/meteor/check

https://atmospherejs.com/meteor/check

CHECK-CHECKERhttps://atmospherejs.com/east5th/check-checker Scan the code to detect methods / publish

functions which haven’t checked for its input data.

$ meteor add east5th:check-checker


https://atmospherejs.com/east5th/check-checker

Thanks!Any questions?

o meteor-shop demo application https://github.com/sonlexqt/meteor-shop


nosql injection in meteor.js application

Software