search

buunguyen / mongoose-deep-populate

Mongoose plugin to enable deep population of nested models ⛺
MIT License
469 stars 44 forks source link

Question - how safe is deep-populate to use with unchecked input? #43

Closed hasufell closed 8 years ago

hasufell commented 8 years ago

I am considering to write a REST API that by default just maps the database to the json object, e.g.

/products/<product-id>

Since there are a lot of object references it makes sense in some cases to allow deep population based on parameters, e.g.

/products/<product-id>?details=price,catalogue.store,catalogue.store.leadingMedia

where this would end up somewhat like:

foo.deepPopulate(['price', 'catalogue.store', 'catalogue.store.leadingMedia']);

Can this lead to stuff like sql injection or is deepPopulate safe in that regard?

buunguyen commented 8 years ago

You should whitelist the fields. So it should be safe.