Mongodb security in node.js
There is specific issue for NodeJS, MongoDB (and some others NoSQL databases that heavily use javascript): serverside javascript injection. Look here and here (pdf) for details. It is more like SQL injection than XSS.
Shortly, that is when attacker sends javascript to your nodejs or mongodb when you're expecting just JSON. So theoretically bad guy can bring your service down (DOS), access your data and even filesystem.
To prevent such attacks you have to:
- Avoid creating “ad-hoc” JavaScript commands by concatenating scriptwith user input.
- Validate user input used in SSJS commands with regular expressions.
- Avoid use of the JavaScript eval command. In particular, when parsing JSON input, use a safer alternative such asJSON.parse.