Skip to content

Conversation

opsysdebug
Copy link

Ticket 🎟️ #135

Fix the issue need to eliminate the use of eval and ensure that the query value is processed in a secure manner. Instead of dynamically executing the query string, we can parse and validate the input to ensure it adheres to a predefined structure or set of allowed operations. This can be achieved by:

  1. Defining a whitelist of allowed operations or query types.
  2. Parsing the query value and validating it against the whitelist.
  3. Executing the validated query using MongoDB's API directly, without relying on eval.

The changes will involve:

  • Removing the eval call.
  • Adding validation logic for the query input.
  • Executing the query securely using MongoDB's API.

@opsysdebug opsysdebug requested a review from a team as a code owner June 11, 2025 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants