Ignore '$' attribute (used by xml2js parser)

panga · Dec 17, 2019 · 3d7c135 · 3d7c135
1 parent 49a7ec6
commit 3d7c135
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/dist/Shield.js b/dist/Shield.js
@@ -6,7 +6,7 @@ class Shield {
     static traverse(obj, opts) {
         let error;
         for (const k in obj) {
-            if (opts.mongo && Utils_1.default.isString(k) && k.indexOf('$') === 0) {
+            if (opts.mongo && Utils_1.default.isString(k) && k.indexOf('$') === 0 && k.length > 1) {
                 error = new ShieldError_1.default('Mongo $ injection found', 'mongo_error', obj);
                 break;
             }

diff --git a/src/Shield.ts b/src/Shield.ts
@@ -10,7 +10,7 @@ export class Shield {
   private static traverse(obj: any, opts: ShieldOptions): ShieldError | undefined {
     let error;
     for (const k in obj) {
-      if (opts.mongo && Utils.isString(k) && k.indexOf('$') === 0) {
+      if (opts.mongo && Utils.isString(k) && k.indexOf('$') === 0 && k.length > 1) {
         error = new ShieldError('Mongo $ injection found', 'mongo_error', obj);
         break;
       }

diff --git a/test/Shield.test.ts b/test/Shield.test.ts
@@ -130,6 +130,17 @@ describe('Shield', () => {
       });
     });
 
+    it('should not block "$" attribute', (done) => {
+      const payload = {
+        $: {
+          id: 1,
+        },
+      };
+      shield.evaluate(payload, {
+        mongo: true,
+      }, done);
+    });
+
     it('should not block __proto__ object', (done) => {
       const payload = JSON.parse('{ "__proto__": { "admin": true } }');
       shield.evaluate(payload, {