README.md

MongoDB need to be installed and running on localhost (otherwise, edit the value of MONGO_URL in server.js).

For Sqreen to work, create a new application on https://my.sqreen.io and add the sqreen.json file to the root of the project.

Start the server with node server.js

Perform an attack with:

$ curl -X POST \
  http://localhost:3000/login \
  -H 'content-type: application/json' \
  -d '{
	"username": {"$gt": "" }
}'

package.json

{
  "name": "mon",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "body-parser": "^1.18.2",
    "express": "^4.16.2",
    "mongodb": "^2.2.33",
    "sqreen": "^1.22.0"
  }
}

server.js

'use strict';
require('sqreen');
const app = require('express')();
const Mongo = require('mongodb');
const BodyParser = require('body-parser');

const MONGO_URL = 'mongodb://localhost:27017/test_injections';
const COLLECTION_NAME = 'users';
const SEED = [{ username: 'a' }, { username: 'b' }, { username: 'c' }];

let database = null;

const log = (req, res, next) => {
    console.log(`${req.method} ${req.url}`);
    req.body && console.log(req.body);
    return next();
};

app.post('/login', BodyParser.json(), log, (req, res, next) => {
    const query = { username: req.body.username };
    if (database === null) {
        return next(new Error('Database not instantiated'));
    }
    const collection = database.collection(COLLECTION_NAME);
    return collection.find(query).toArray((err, doc) => {

        if (err) return next(err);
        if (!doc) {
            res.statusCode = 404;
            return res.json(null)
        }
        return res.json(doc);
    });
});

Mongo.MongoClient.connect(MONGO_URL, (err, db) => {
    if (err) throw err;
    database = db;
    db.dropDatabase((err) => {
        if (err) throw err;
        db.collection(COLLECTION_NAME).insertMany(SEED, (err) => {
            if (err) throw err;
            app.listen(3000, (err) => {
                if (err) throw err;
                console.log('App listenning on http://localhost:3000/');
            });
        });
    });
});