Log file Viewer

[18:10:08] <QuanRan> hi, we use mongoengine in our python backend to manage our mongo documents. We have this code: "Doc.objects(__raw__=raw_input)" that allows our api users to provide their queries to the db. is it possible with raw mongodb to aggregate documents outside the Doc collection ?

[18:20:49] <GothAlice> QuanRan: I can not assist with your overall… question… but must warn against permitting user-supplied structured query data like this if there is any risk involved in exposing an "oracle", or if it is in any way security-sensitive. From https://www.owasp.org/images/e/ed/GOD16-NOSQL.pdf a simple example would be: a login form with form data: user=god&password[$ne]=anything, or, if expanding as keyword arguments e.g.

[18:20:49] <GothAlice> Document.objects(**filter), then user=god&password__ne=anything becomes the bypass.

[18:21:36] <GothAlice> However, to answer your specific question, yes. Within an aggregate query — https://docs.mongodb.com/manual/aggregation/ — you can use a $lookup stage as a way to pull in LEFT OUTER relationships — https://docs.mongodb.com/manual/reference/operator/aggregation/lookup/

[18:23:10] <GothAlice> So, never mind then, there's your answer. Yes. But for the love of baby Romulus and Remus, be careful with this. User-supplied data must not be trusted; validate it before using it within any pipeline, please.

[21:54:47] <octav1a> StephenLynx, just was your message from yesterday.

[21:55:36] <octav1a> Do you know if the chunk-file relation is handled entirely by the driver, or also by the server binary? Thinking about hacking it for my use case.