Description/Steps to reproduce
MongoDB $where operator allows the execution of Javascript code for greater flexibility. This can be a security problem since this connector allows the $where operator to be defined on every filter param exposed by loopback and by doing so exposing the $where filter to the public.
This is valid for every model that extends PersistedModel since the usual CRUD endpoint are created with the filter query param for every GET request.
Something like this:
GET /api/brands?filter={"where": {"$where": "if(typeof fzzzuvz==='undefined'){var a=new Date();do{var b=new Date();}while(b-a<5000);fzzzuvz=1;}"}}
Allows everyone to delay their request by 5 seconds. Other versions can even cause infinite loop (more information on here
As a workaround we can disable javascript evaluation in the $where operator on the database it self (here) but we lose this functionality on the server as well.
A better solution would be that these operators are parsed or not exposed on the endpoints. This way they remain useful on the API side but disabled from the outside
Description/Steps to reproduce
MongoDB
$whereoperator allows the execution of Javascript code for greater flexibility. This can be a security problem since this connector allows the$whereoperator to be defined on everyfilterparam exposed by loopback and by doing so exposing the$wherefilter to the public.This is valid for every model that extends
PersistedModelsince the usual CRUD endpoint are created with thefilterquery param for everyGETrequest.Something like this:
Allows everyone to delay their request by 5 seconds. Other versions can even cause infinite loop (more information on here
As a workaround we can disable javascript evaluation in the
$whereoperator on the database it self (here) but we lose this functionality on the server as well.A better solution would be that these operators are parsed or not exposed on the endpoints. This way they remain useful on the API side but disabled from the outside