Empresas
Empregos
  • Sobre nós
  • Soluções
    • Publicação de vagas
      Publique sua vaga e receba candidatos qualificados em 48h.
    • Avaliações de candidatos
      Mais de 500 testes técnicos e psicológicos, mais anti-fraude.
    • Headhunting
      Busca executiva personalizada do início ao fim.
    • Folha de Pagamento + EOR
      Dispersão de folha e EOR em mais de 15 países da LATAM.
  • Preços
  • Empregos

0

384
Visualizações
How to treat custom MongoDB queries in NodeJS

I'm porting a webserver from python to node.js and one of the capabilities that server must have is to receive a POST containing information about a MongoDB query, and send the result of the query to the webpage. The query may or may not contain a filter, a projection, a limit and a sort. In python we can do it like this:

(In the examples below command_name equals to 'find')

command = getattr(collection, command_name)

cmd_filter = loads(filter_str) if filter_str else None
projection = loads(projection_str) if projection_str else None
limit = loads(limit_str) if limit_str else 0
sort = [(elt['key'], elt['order']) for elt in loads(sort_str)] if sort_str else None

response = command(filter=cmd_filter, projection=projection, sort=sort, limit=limit)

But I'm having trouble finding a way to do it in node.js, I've tried stuff like this:

command_name = req.body['command']
command = collection[command_name]

command = filter_str != undefined ? collection[command_name](JSON.parse(filter_str)) : collection[command_name]
command = projection_str != undefined ? command['project'](JSON.parse(projection_str)) : command
command = sort_str != undefined ? command['sort'](JSON.parse(sort_str)) : command
command = limit_str != undefined ? command['limit'](JSON.parse(limit_str)) : command

response = command.toArray(function(err, result) {
    if (err) throw err

    console.log(result)
})

But it doesn't work. I get a MongoError: Can't canonicalize query: BadValue bad order array [2]

about 4 years ago · Santiago Trujillo
1 Respostas
Responde à pergunta

0

Your code not working is the least of your problems here. I don't know if you realize but a user may execute any command on the database with your API. I don't know if there is such a name but you have a Mongo injection vulnerability. I have never seen anything like that before, explicitly running user provided random methods with random data on a live database.

Search for Mongoose pagination, sorting etc. for REST APIs in Node and you will find a lot of info on how to do it properly.

There are some modules that can help you with that:

  • https://www.npmjs.com/package/mongoose-paginate
  • https://www.npmjs.com/package/mongoose-paginator
  • https://github.com/expressjs/express-paginate
about 4 years ago · Santiago Trujillo Relatório
Responde à pergunta
Encontrar trabalhos remotos

Descubra a nova forma de encontrar um emprego!

melhores empregos
Principais categorias de trabalho
Empresas
Postar vaga Preços Comercial
Jurídico
Termos e Condições Política de privacidade
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Recomende algumas ofertas para mim
Preciso de ajuda