[{"data":1,"prerenderedAt":975},["ShallowReactive",2],{"post-nosql-injection":3},{"id":4,"title":5,"body":6,"description":961,"extension":962,"meta":963,"navigation":734,"path":971,"seo":972,"stem":973,"__hash__":974,"dateDisplay":969,"image":970,"tags":965,"badge":964,"readingTime":238},"posts\u002Fposts\u002FNoSQL-Injection.md","NoSQL Injection",{"type":7,"value":8,"toc":945},"minimark",[9,14,21,25,43,47,108,112,117,278,287,296,300,307,315,325,329,335,341,345,379,385,389,430,437,441,455,459,559,563,804,900,904,941],[10,11,13],"h2",{"id":12},"_1-định-nghĩa-ngắn","1. Định nghĩa ngắn",[15,16,17,20],"p",{},[18,19,5],"strong",{}," là lỗi xảy ra trên các cơ sở dữ liệu NoSQL (MongoDB, CouchDB, Redis, Cassandra, …) khi ứng dụng cho phép chèn dữ liệu không tin cậy mà ảnh hưởng trực tiếp tới cấu trúc truy vấn của DB NoSQL, cho phép attacker thao túng truy vấn để đọc\u002Fghi\u002Fxóa dữ liệu hoặc thực thi mã (tuỳ hệ). NoSQL thường dùng truy vấn dạng document \u002F JSON-like, nên vector tấn công khác SQL cổ điển — attacker lợi dụng các toán tử ($ne, $gt, $where, $regex, $exists, ...) hoặc object injection.",[10,22,24],{"id":23},"_2-vì-sao-nosqli-thường-bị-bỏ-qua","2. Vì sao NoSQLi thường bị bỏ qua",[26,27,28,32,40],"ul",{},[29,30,31],"li",{},"Lập trình viên quen phòng SQLi (prepared statements) nhưng chưa hiểu query builder \u002F driver NoSQL.",[29,33,34,35,39],{},"NoSQL query thường là object\u002FJSON, nên attacker có thể gửi object thay vì string (ví dụ ",[36,37,38],"code",{},"id[$ne]=null",").",[29,41,42],{},"Một số driver ngầm hiểu JSON\u002Fobjects, khiến input dạng JSON\u002Fobject được parse thành truy vấn.",[10,44,46],{"id":45},"_3-các-dạng-nosqli-phổ-biến-với-ý-tưởng","3. Các dạng NoSQLi phổ biến (với ý tưởng)",[48,49,50,70,80,90,96,102],"ol",{},[29,51,52,55,56,59,60,59,63,59,66,69],{},[18,53,54],{},"Query Operator Injection",": chèn toán tử MongoDB (ví dụ ",[36,57,58],{},"$ne",", ",[36,61,62],{},"$gt",[36,64,65],{},"$in",[36,67,68],{},"$regex",") để thay đổi điều kiện.",[29,71,72,75,76,79],{},[18,73,74],{},"Type\u002FStructure Injection (Object Injection)",": attacker gửi object\u002Farray thay vì string (ví dụ PHP ",[36,77,78],{},"foo[$ne]=1","), dẫn đến filter khác.",[29,81,82,85,86,89],{},[18,83,84],{},"JavaScript\u002FCode Injection",": dùng ",[36,87,88],{},"$where"," (MongoDB) hoặc chèn code để DB thực thi JavaScript (rất nguy hiểm).",[29,91,92,95],{},[18,93,94],{},"Regex Injection \u002F ReDoS",": dùng regex phức tạp để gây Denial of Service do backtracking.",[29,97,98,101],{},[18,99,100],{},"Authentication Bypass",": thao túng query login (username\u002Fpassword) để bypass auth.",[29,103,104,107],{},[18,105,106],{},"Blind & Time-based NoSQLi",": tương tự SQLi — dùng side-channel, delays hoặc khác biệt phản hồi để dò.",[10,109,111],{"id":110},"_4-ví-dụ-minh-hoạ-mongodb-nodejs-express","4. Ví dụ minh hoạ (MongoDB, Node.js + Express)",[113,114,116],"h3",{"id":115},"_41-vulnerable-code-không-xử-lý-input","4.1 Vulnerable code (không xử lý input)",[118,119,124],"pre",{"className":120,"code":121,"language":122,"meta":123,"style":123},"language-js shiki shiki-themes github-light github-dark","\u002F\u002F Vulnerable: dùng body trực tiếp vào query\napp.post('\u002Flogin', async (req, res) => {\n  const { username, password } = req.body;\n  \u002F\u002F suppose users is a MongoDB collection\n  const user = await users.findOne({ username: username, password: password });\n  if (user) res.send('ok'); else res.send('fail');\n});\n","js","",[36,125,126,135,180,207,213,236,272],{"__ignoreMap":123},[127,128,131],"span",{"class":129,"line":130},"line",1,[127,132,134],{"class":133},"sJ8bj","\u002F\u002F Vulnerable: dùng body trực tiếp vào query\n",[127,136,138,142,146,149,153,155,159,162,166,168,171,174,177],{"class":129,"line":137},2,[127,139,141],{"class":140},"sVt8B","app.",[127,143,145],{"class":144},"sScJk","post",[127,147,148],{"class":140},"(",[127,150,152],{"class":151},"sZZnC","'\u002Flogin'",[127,154,59],{"class":140},[127,156,158],{"class":157},"szBVR","async",[127,160,161],{"class":140}," (",[127,163,165],{"class":164},"s4XuR","req",[127,167,59],{"class":140},[127,169,170],{"class":164},"res",[127,172,173],{"class":140},") ",[127,175,176],{"class":157},"=>",[127,178,179],{"class":140}," {\n",[127,181,183,186,189,193,195,198,201,204],{"class":129,"line":182},3,[127,184,185],{"class":157},"  const",[127,187,188],{"class":140}," { ",[127,190,192],{"class":191},"sj4cs","username",[127,194,59],{"class":140},[127,196,197],{"class":191},"password",[127,199,200],{"class":140}," } ",[127,202,203],{"class":157},"=",[127,205,206],{"class":140}," req.body;\n",[127,208,210],{"class":129,"line":209},4,[127,211,212],{"class":133},"  \u002F\u002F suppose users is a MongoDB collection\n",[127,214,216,218,221,224,227,230,233],{"class":129,"line":215},5,[127,217,185],{"class":157},[127,219,220],{"class":191}," user",[127,222,223],{"class":157}," =",[127,225,226],{"class":157}," await",[127,228,229],{"class":140}," users.",[127,231,232],{"class":144},"findOne",[127,234,235],{"class":140},"({ username: username, password: password });\n",[127,237,239,242,245,248,250,253,256,259,262,264,266,269],{"class":129,"line":238},6,[127,240,241],{"class":157},"  if",[127,243,244],{"class":140}," (user) res.",[127,246,247],{"class":144},"send",[127,249,148],{"class":140},[127,251,252],{"class":151},"'ok'",[127,254,255],{"class":140},"); ",[127,257,258],{"class":157},"else",[127,260,261],{"class":140}," res.",[127,263,247],{"class":144},[127,265,148],{"class":140},[127,267,268],{"class":151},"'fail'",[127,270,271],{"class":140},");\n",[127,273,275],{"class":129,"line":274},7,[127,276,277],{"class":140},"});\n",[15,279,280,283,284],{},[18,281,282],{},"Attack vector (JSON-based):"," gửi body ",[36,285,286],{},"{ \"username\": { \"$ne\": null }, \"password\": { \"$ne\": null } }",[26,288,289],{},[29,290,291,292,295],{},"Query trở thành: ",[36,293,294],{},"{ username: { $ne: null }, password: { $ne: null } }"," → sẽ match record có username\u002Fpassword khác null → bypass login.",[113,297,299],{"id":298},"_42-php-form-array-injection-classic","4.2 PHP form array injection (classic)",[15,301,302,303,306],{},"Nếu backend PHP nhận ",[36,304,305],{},"$_POST"," và trực tiếp pass vào Mongo query:",[118,308,313],{"className":309,"code":311,"language":312},[310],"language-text","POST body: username[$ne]=1&password[$ne]=1\n","text",[36,314,311],{"__ignoreMap":123},[15,316,317,318,321,322,324],{},"PHP sẽ parse thành ",[36,319,320],{},"$_POST['username'] = array('$ne' => '1')",", và nếu pass vào driver thì query có ",[36,323,58],{}," operator.",[113,326,328],{"id":327},"_43-where-js-code-execution","4.3 $where \u002F JS code execution",[118,330,333],{"className":331,"code":332,"language":312},[310],"users.find({ $where: \"this.password.length > 0 && this.username == 'admin'\" })\n",[36,334,332],{"__ignoreMap":123},[15,336,337,338,340],{},"Nếu attacker có khả năng inject vào ",[36,339,88],{},", họ có thể chạy JS arbitrary.",[10,342,344],{"id":343},"_5-payload-mẫu-lab-only","5. Payload mẫu (lab-only)",[26,346,347,353,359,365,372],{},[29,348,349,350],{},"Simple operator injection (bypass auth): JSON body: ",[36,351,352],{},"{ \"username\": {\"$ne\": null}, \"password\": {\"$ne\": null} }",[29,354,355,356],{},"Bypass with always-true: ",[36,357,358],{},"{ \"username\": {\"$gt\": \"\"} }",[29,360,361,362],{},"Regex login bypass: ",[36,363,364],{},"{ \"username\": {\"$regex\": \"^admin$\", \"$options\": \"i\"}, \"password\": {\"$exists\": true} }",[29,366,367,368,371],{},"$where execution (if injectable): ",[36,369,370],{},"{ \"$where\": \"function() { return this.password=='abc' || (this.username=='admin' && sleep(5000)) }\" }"," (note: depending on DB version)",[29,373,374,375,378],{},"PHP array injection: ",[36,376,377],{},"username[$ne]=1"," (x-www-form-urlencoded)",[15,380,381,384],{},[18,382,383],{},"Chú ý:"," payload tuỳ DB\u002Fdriver\u002Fversion; không dùng trên system thật.",[10,386,388],{"id":387},"_6-cách-dò-kiểm-thử-nosqli","6. Cách dò \u002F kiểm thử NoSQLi",[26,390,391,394,397,414,417,424,427],{},[29,392,393],{},"Tìm chỗ dùng input để build filter\u002Fquery: login, search, filters, sort, API endpoints, JSON endpoints.",[29,395,396],{},"Thử gửi object\u002Fjson thay vì string (vì many apps parse JSON).",[29,398,399,400,59,402,59,404,59,406,59,408,59,411,413],{},"Dùng variations: ",[36,401,58],{},[36,403,62],{},[36,405,65],{},[36,407,68],{},[36,409,410],{},"$exists",[36,412,88],{}," để thay đổi điều kiện.",[29,415,416],{},"Kiểm tra request content-type khác (JSON vs form-url-encoded) vì parsing khác nhau.",[29,418,419,420,423],{},"Kiểm tra PHP \u002F Python \u002F Ruby backend parsing behavior (PHP ",[36,421,422],{},"foo[bar]=1"," -> array).",[29,425,426],{},"Test blind: quan sát response differences, timing, result counts.",[29,428,429],{},"Dùng proxy (Burp) + script để automate payloads.",[15,431,432,433,436],{},"Công cụ: ",[18,434,435],{},"NoSQLMap"," (tương tự sqlmap), Burp Suite, custom scripts.",[10,438,440],{"id":439},"_7-hậu-quả-thực-tế","7. Hậu quả thực tế",[26,442,443,446,449,452],{},[29,444,445],{},"Bypass authentication (login as any user).",[29,447,448],{},"Đọc\u002Fviết\u002Fxóa toàn bộ dữ liệu.",[29,450,451],{},"Escalation to remote code execution (nếu driver cho phép JS eval e.g., $where với code).",[29,453,454],{},"Data exfiltration, account takeover, impact to confidentiality\u002Fintegrity\u002Favailability.",[10,456,458],{"id":457},"_8-phòng-ngừa-best-practices","8. Phòng ngừa (Best Practices)",[48,460,461,467,473,482,510,520,529,535,541,547,553],{},[29,462,463,466],{},[18,464,465],{},"Không bao giờ pass input raw vào query object"," — luôn validate & canonicalize.",[29,468,469,472],{},[18,470,471],{},"Strict typing \u002F casting",": ép kiểu (cast) input về đúng type trước khi dùng (ví dụ id => ObjectId, số => Number).",[29,474,475,478,479,39],{},[18,476,477],{},"Allowlist values",": dùng allowlist cho fields, sort, filters (ví dụ chỉ cho phép sort theo ",[36,480,481],{},"['name','date']",[29,483,484,487,488,491,492,495,496],{},[18,485,486],{},"Disallow operator characters",": nếu input là string, escape hoặc reject các key bắt đầu bằng ",[36,489,490],{},"$"," hoặc chứa ",[36,493,494],{},"."," (dấu chấm) khi không cần.",[26,497,498],{},[29,499,500,501,504,505,507,508,494],{},"Trong Node.js\u002FMongoose có thể dùng ",[36,502,503],{},"mongo-sanitize"," hoặc tự sanitize: remove keys that start with ",[36,506,490],{}," or contain ",[36,509,494],{},[29,511,512,515,516,519],{},[18,513,514],{},"Use parameterized \u002F safe query builders \u002F ORM",": e.g., Mongoose query APIs but be careful với ",[36,517,518],{},"Model.where()"," that accepts raw objects.",[29,521,522,525,526,528],{},[18,523,524],{},"Avoid $where \u002F eval-like features",": disable or avoid using ",[36,527,88],{},", server-side JavaScript execution.",[29,530,531,534],{},[18,532,533],{},"Least privilege DB user",": account used by app should have minimal rights.",[29,536,537,540],{},[18,538,539],{},"Rate limit & monitoring",": detect unusual patterns.",[29,542,543,546],{},[18,544,545],{},"Content-type strictness",": accept JSON only where expected; validate schema (e.g., using Joi, AJV).",[29,548,549,552],{},[18,550,551],{},"Use schema validation at DB level",": MongoDB schema validation (from v3.6+) to enforce field types\u002Fstructure.",[29,554,555,558],{},[18,556,557],{},"Escape\u002Fencode when generating queries from strings",": if building string-based queries, escape carefully.",[10,560,562],{"id":561},"_9-secure-coding-snippets-nodejs","9. Secure-coding snippets (Node.js)",[118,564,566],{"className":120,"code":565,"language":122,"meta":123,"style":123},"\u002F\u002F Sanitize input example\nconst sanitize = require('mongo-sanitize');\napp.post('\u002Fsearch', (req, res) => {\n  const q = sanitize(req.body.q); \u002F\u002F removes $ and . keys\n  \u002F\u002F ensure q is string\n  if (typeof q !== 'string') return res.status(400).send('bad');\n  const results = await users.find({ name: new RegExp(escapeRegex(q), 'i') });\n});\n\nfunction escapeRegex(str) {\n  return str.replace(\u002F[.*+?^${}()|[\\]\\\\]\u002Fg, '\\\\$&');\n}\n",[36,567,568,573,593,619,636,641,685,724,729,736,753,798],{"__ignoreMap":123},[127,569,570],{"class":129,"line":130},[127,571,572],{"class":133},"\u002F\u002F Sanitize input example\n",[127,574,575,578,581,583,586,588,591],{"class":129,"line":137},[127,576,577],{"class":157},"const",[127,579,580],{"class":191}," sanitize",[127,582,223],{"class":157},[127,584,585],{"class":144}," require",[127,587,148],{"class":140},[127,589,590],{"class":151},"'mongo-sanitize'",[127,592,271],{"class":140},[127,594,595,597,599,601,604,607,609,611,613,615,617],{"class":129,"line":182},[127,596,141],{"class":140},[127,598,145],{"class":144},[127,600,148],{"class":140},[127,602,603],{"class":151},"'\u002Fsearch'",[127,605,606],{"class":140},", (",[127,608,165],{"class":164},[127,610,59],{"class":140},[127,612,170],{"class":164},[127,614,173],{"class":140},[127,616,176],{"class":157},[127,618,179],{"class":140},[127,620,621,623,626,628,630,633],{"class":129,"line":209},[127,622,185],{"class":157},[127,624,625],{"class":191}," q",[127,627,223],{"class":157},[127,629,580],{"class":144},[127,631,632],{"class":140},"(req.body.q); ",[127,634,635],{"class":133},"\u002F\u002F removes $ and . keys\n",[127,637,638],{"class":129,"line":215},[127,639,640],{"class":133},"  \u002F\u002F ensure q is string\n",[127,642,643,645,647,650,653,656,659,661,664,666,669,671,674,676,678,680,683],{"class":129,"line":238},[127,644,241],{"class":157},[127,646,161],{"class":140},[127,648,649],{"class":157},"typeof",[127,651,652],{"class":140}," q ",[127,654,655],{"class":157},"!==",[127,657,658],{"class":151}," 'string'",[127,660,173],{"class":140},[127,662,663],{"class":157},"return",[127,665,261],{"class":140},[127,667,668],{"class":144},"status",[127,670,148],{"class":140},[127,672,673],{"class":191},"400",[127,675,39],{"class":140},[127,677,247],{"class":144},[127,679,148],{"class":140},[127,681,682],{"class":151},"'bad'",[127,684,271],{"class":140},[127,686,687,689,692,694,696,698,701,704,707,710,712,715,718,721],{"class":129,"line":274},[127,688,185],{"class":157},[127,690,691],{"class":191}," results",[127,693,223],{"class":157},[127,695,226],{"class":157},[127,697,229],{"class":140},[127,699,700],{"class":144},"find",[127,702,703],{"class":140},"({ name: ",[127,705,706],{"class":157},"new",[127,708,709],{"class":144}," RegExp",[127,711,148],{"class":140},[127,713,714],{"class":144},"escapeRegex",[127,716,717],{"class":140},"(q), ",[127,719,720],{"class":151},"'i'",[127,722,723],{"class":140},") });\n",[127,725,727],{"class":129,"line":726},8,[127,728,277],{"class":140},[127,730,732],{"class":129,"line":731},9,[127,733,735],{"emptyLinePlaceholder":734},true,"\n",[127,737,739,742,745,747,750],{"class":129,"line":738},10,[127,740,741],{"class":157},"function",[127,743,744],{"class":144}," escapeRegex",[127,746,148],{"class":140},[127,748,749],{"class":164},"str",[127,751,752],{"class":140},") {\n",[127,754,756,759,762,765,767,770,773,777,780,782,785,787,790,793,796],{"class":129,"line":755},11,[127,757,758],{"class":157},"  return",[127,760,761],{"class":140}," str.",[127,763,764],{"class":144},"replace",[127,766,148],{"class":140},[127,768,769],{"class":151},"\u002F",[127,771,772],{"class":191},"[.*+?^${}()|[",[127,774,776],{"class":775},"snhLl","\\]\\\\",[127,778,779],{"class":191},"]",[127,781,769],{"class":151},[127,783,784],{"class":157},"g",[127,786,59],{"class":140},[127,788,789],{"class":151},"'",[127,791,792],{"class":191},"\\\\",[127,794,795],{"class":151},"$&'",[127,797,271],{"class":140},[127,799,801],{"class":129,"line":800},12,[127,802,803],{"class":140},"}\n",[118,805,807],{"className":120,"code":806,"language":122,"meta":123,"style":123},"\u002F\u002F Cast ID safely\nconst { ObjectId } = require('mongodb');\nfunction safeObjectId(id) {\n  if(!ObjectId.isValid(id)) throw new Error('invalid id');\n  return new ObjectId(id);\n}\n",[36,808,809,814,836,850,884,896],{"__ignoreMap":123},[127,810,811],{"class":129,"line":130},[127,812,813],{"class":133},"\u002F\u002F Cast ID safely\n",[127,815,816,818,820,823,825,827,829,831,834],{"class":129,"line":137},[127,817,577],{"class":157},[127,819,188],{"class":140},[127,821,822],{"class":191},"ObjectId",[127,824,200],{"class":140},[127,826,203],{"class":157},[127,828,585],{"class":144},[127,830,148],{"class":140},[127,832,833],{"class":151},"'mongodb'",[127,835,271],{"class":140},[127,837,838,840,843,845,848],{"class":129,"line":182},[127,839,741],{"class":157},[127,841,842],{"class":144}," safeObjectId",[127,844,148],{"class":140},[127,846,847],{"class":164},"id",[127,849,752],{"class":140},[127,851,852,854,856,859,862,865,868,871,874,877,879,882],{"class":129,"line":209},[127,853,241],{"class":157},[127,855,148],{"class":140},[127,857,858],{"class":157},"!",[127,860,861],{"class":140},"ObjectId.",[127,863,864],{"class":144},"isValid",[127,866,867],{"class":140},"(id)) ",[127,869,870],{"class":157},"throw",[127,872,873],{"class":157}," new",[127,875,876],{"class":144}," Error",[127,878,148],{"class":140},[127,880,881],{"class":151},"'invalid id'",[127,883,271],{"class":140},[127,885,886,888,890,893],{"class":129,"line":215},[127,887,758],{"class":157},[127,889,873],{"class":157},[127,891,892],{"class":144}," ObjectId",[127,894,895],{"class":140},"(id);\n",[127,897,898],{"class":129,"line":238},[127,899,803],{"class":140},[10,901,903],{"id":902},"_10-checklist-kiểm-thử-remediation-quick","10. Checklist kiểm thử & remediation (quick)",[26,905,906,909,922,927,930,933],{},[29,907,908],{},"Tìm tất cả các endpoint nhận JSON\u002Fparams\u002Fform data; xác định chỗ dữ liệu được dùng trong filter.",[29,910,911,912,59,914,59,916,59,918,59,920,494],{},"Thử gửi object\u002Fjson payloads với ",[36,913,58],{},[36,915,62],{},[36,917,65],{},[36,919,68],{},[36,921,410],{},[29,923,924,925,39],{},"Thử PHP-style array injection (",[36,926,78],{},[29,928,929],{},"Kiểm tra response khác biệt \u002F timing để phát hiện blind.",[29,931,932],{},"Kiểm tra server xử lý content-type khác nhau (text\u002Fplain, application\u002Fjson, form).",[29,934,935,936,769,938,940],{},"Thực thi fix: sanitize đầu vào, cast kiểu, remove ",[36,937,490],{},[36,939,494],{}," keys, use schema validation, deploy tests.",[942,943,944],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .snhLl, html code.shiki .snhLl{--shiki-default:#22863A;--shiki-default-font-weight:bold;--shiki-dark:#85E89D;--shiki-dark-font-weight:bold}",{"title":123,"searchDepth":137,"depth":137,"links":946},[947,948,949,950,955,956,957,958,959,960],{"id":12,"depth":137,"text":13},{"id":23,"depth":137,"text":24},{"id":45,"depth":137,"text":46},{"id":110,"depth":137,"text":111,"children":951},[952,953,954],{"id":115,"depth":182,"text":116},{"id":298,"depth":182,"text":299},{"id":327,"depth":182,"text":328},{"id":343,"depth":137,"text":344},{"id":387,"depth":137,"text":388},{"id":439,"depth":137,"text":440},{"id":457,"depth":137,"text":458},{"id":561,"depth":137,"text":562},{"id":902,"depth":137,"text":903},"operator\u002Fobject injection, ví dụ PHP\u002FNode, payload phổ biến (`$ne`, `$regex`), cách dò và biện pháp phòng (sanitize, cast, schema validation).","md",{"badge":964,"tags":965,"date":968,"dateDisplay":969,"image":970},"Web Security",[966,967],"Web","NoSQLi","2025-06-20","Jun 20, 2025","\u002Fthumbnails\u002Fowasp-top-ten-1000.png","\u002Fposts\u002Fnosql-injection",{"title":5,"description":961},"posts\u002FNoSQL-Injection","IzJ4K3SvYwPYlxpd5JguJY2NMZmPYqxkWeg1KC88lsw",1787385493858]