Catch an injection attempt

Runs the sample. Generated for this page; it reads the connection string from the environment and first remakes the sample database from sample-schema.json.

using ArxSamples.MongoDb;
using ArxSamples.MongoDb.Operations.Delete.RealCases;

// The connection string comes from the environment, never from the code (see "Configure the connection").
var connectionString = Environment.GetEnvironmentVariable("ARX_SAMPLES_MONGODB")
    ?? throw new InvalidOperationException("Set the ARX_SAMPLES_MONGODB environment variable to your MongoDB connection string.");

var dbContext = new SampleContext(connectionString);

// Every run starts from the sample data: this deletes and makes again what sample-schema.json lists
// (save the file in the project folder, see Get started).
await dbContext.Direct.ResetAsync();

await new RealCase1_CatchAnInjectionAttempt().RunAsync(dbContext);

The sample, as it is in the repository.

using ARX.SDK;
using ARX.SDK.Models;
using ARX.SDK.MongoDb.Services;
using ARX.SDK.Services;

using static ArxSamples.MongoDb.SampleOutput;

namespace ArxSamples.MongoDb.Operations.Delete.RealCases;

/// <summary>
/// Two attacks on a "delete by" endpoint: a match field named like an operator, and a match value built to match every
/// document. Neither deletes anything.
/// </summary>
/// <remarks>
/// A document with operator keys given as a match value would run as a query in MongoDB's shorthand equality; ARX wraps it
/// in <c>$eq</c>, so it is compared as data and finds nothing.
/// </remarks>
public sealed class RealCase1_CatchAnInjectionAttempt : ISample
{
    public string Name => "delete-real-1-catch-an-injection-attempt";

    public string Title => "Catch an injection attempt";

    public async Task RunAsync(SampleContext dbContext)
    {
        var contact = new ArxEntity("contact");
        contact["email"] = "victim-m921@example.com";
        contact["segment"] = "M92";
        await dbContext.Service.CreateAsync(contact);

        await Scenario1_AnOperatorAsAMatchFieldAsync(dbContext.Service);

        await Scenario2_AMatchBuiltToFindEverythingAsync(dbContext.Service);
    }

    /// <summary>1. "Delete where $where": ARX1017 before anything is sent.</summary>
    private static async Task Scenario1_AnOperatorAsAMatchFieldAsync(ArxMongoDbService service)
    {
        Step("1. An operator as a match field");

        var match = new ArxEntity("contact");
        match["$where"] = "true";

        try
        {
            await service.DeleteAsync(match, new ArxDeleteOptions { Match = ArxMatch.Columns("$where") });
        }
        catch (ArxValidationException exception) when (exception.Code == ArxErrorCode.SuspectedInjection)
        {
            ShowError(exception);
        }

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * db.contact.countDocuments({ segment: "M92" })
         * -- Expect: 1.
         * ===========================================================
         */
    }

    /// <summary>2. A segment posted as <c>{ "$exists": true }</c>: compared as data, it deletes nothing.</summary>
    private static async Task Scenario2_AMatchBuiltToFindEverythingAsync(ArxMongoDbService service)
    {
        Step("2. A match built to find everything");

        var match = new ArxEntity("contact");
        match["segment"] = new ArxJsonB { SerializedValue = "{ \"$exists\": true }" };

        int deleted = await service.DeleteAsync(match, new ArxDeleteOptions { Match = ArxMatch.Columns("segment") });

        Show($"{deleted} documents deleted");

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * db.contact.countDocuments({ segment: "M92" })
         * -- Expect: 1: the victim is still there.
         * ===========================================================
         */
    }
}

  > 1. An operator as a match field
      caught ArxValidationException: ARX1017 SuspectedInjection: Attribute name '$where' looks like an SQL injection attempt (contains '$' (a MongoDB operator)). ARX refused it before sending anything to the database. Names must come from your code or a fixed list, never from user input.
  > 2. A match built to find everything
      0 documents deleted