codejump
MediumJavaScriptTypeScript

NoSQL Injection — Reject Operator Objects

TypeScriptSecurityInjection

The login handler below passes the request body straight into a MongoDB-style filter.

The bug: MongoDB interprets object values as query operators. An attacker who sends { "username": "admin", "password": { "$ne": null } } as JSON gets a filter that matches any non-null password — logging in as admin without knowing the password.

Your task: fix solve(input) so it only accepts username/password as plain strings — reject (return null) if either field is anything else, like an object carrying a $ne/$gt/$where operator.

Sample tests

Test #1Normal login
Input: [{"password":"secret123","username":"alice"}]
Output: {"password":"secret123","username":"alice"}
Test #2Operator injection on username
Input: [{"password":"x","username":{"$ne":null}}]
Output: null
Test #3Operator injection on password
Input: [{"password":{"$gt":""},"username":"admin"}]
Output: null
← All challenges