Catch an injection attempt

Runs the sample. Generated for this page; it reads the connection string from the environment and first remakes the sample database from sample-schema.json.

using ArxSamples.MongoDb;
using ArxSamples.MongoDb.Operations.Update.RealCases;

// The connection string comes from the environment, never from the code (see "Configure the connection").
var connectionString = Environment.GetEnvironmentVariable("ARX_SAMPLES_MONGODB")
    ?? throw new InvalidOperationException("Set the ARX_SAMPLES_MONGODB environment variable to your MongoDB connection string.");

var dbContext = new SampleContext(connectionString);

// Every run starts from the sample data: this deletes and makes again what sample-schema.json lists
// (save the file in the project folder, see Get started).
await dbContext.Direct.ResetAsync();

await new RealCase1_CatchAnInjectionAttempt().RunAsync(dbContext);

The sample, as it is in the repository.

using ARX.SDK;
using ARX.SDK.Models;
using ARX.SDK.MongoDb.Services;
using ARX.SDK.Services;

using static ArxSamples.MongoDb.SampleOutput;

namespace ArxSamples.MongoDb.Operations.Update.RealCases;

/// <summary>
/// Two attacks on an update endpoint: an operator as a field name, and a match value built to match every document.
/// </summary>
/// <remarks>
/// A field name with <c>$</c> is ARX1017 before anything is sent. A match value that is a document with operator keys
/// (<c>{ "$ne": null }</c>) is compared as data: ARX wraps it in <c>$eq</c>, so it finds no document instead of all of them.
/// </remarks>
public sealed class RealCase1_CatchAnInjectionAttempt : ISample
{
    public string Name => "update-real-1-catch-an-injection-attempt";

    public string Title => "Catch an injection attempt";

    public async Task RunAsync(SampleContext dbContext)
    {
        var account = new ArxEntity("account");
        account["name"] = "Trey Research";
        account["account_number"] = "ACC-M821";
        account["credit_limit"] = 5000m;
        await dbContext.Service.CreateAsync(account);

        await Scenario1_AnOperatorAsAFieldNameAsync(dbContext.Service);

        await Scenario2_AMatchBuiltToFindEverythingAsync(dbContext.Service);
    }

    /// <summary>1. A posted field named "$set": ARX1017.</summary>
    private static async Task Scenario1_AnOperatorAsAFieldNameAsync(ArxMongoDbService service)
    {
        Step("1. An operator as a field name");

        var change = new ArxEntity("account");
        change["account_number"] = "ACC-M821";
        change["$set"] = "{ credit_limit: 1000000 }";

        try
        {
            await service.UpdateAsync(change, new ArxUpdateOptions { Match = ArxMatch.Key("account_number") });
        }
        catch (ArxValidationException exception) when (exception.Code == ArxErrorCode.SuspectedInjection)
        {
            ShowError(exception);
        }

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * db.account.find({ account_number: "ACC-M821" }, { credit_limit: 1 })
         * -- Expect: 1 document, credit_limit NumberDecimal("5000").
         * ===========================================================
         */
    }

    /// <summary>2. An account number posted as JSON <c>{ "$ne": null }</c>: compared as data, it matches nothing (ARX2002).</summary>
    private static async Task Scenario2_AMatchBuiltToFindEverythingAsync(ArxMongoDbService service)
    {
        Step("2. A match built to find everything");

        var change = new ArxEntity("account");
        change["account_number"] = new ArxJsonB { SerializedValue = "{ \"$ne\": null }" };
        change["credit_limit"] = 1_000_000m;

        try
        {
            await service.UpdateAsync(change, new ArxUpdateOptions { Match = ArxMatch.Columns("account_number") });
        }
        catch (ArxException exception) when (exception.Code == ArxErrorCode.RecordNotFound)
        {
            ShowError(exception);
        }

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * db.account.countDocuments({ credit_limit: NumberDecimal("1000000") })
         * -- Expect: 0.
         * ===========================================================
         */
    }
}

  > 1. An operator as a field name
      caught ArxValidationException: ARX1017 SuspectedInjection: Attribute name '$set' looks like an SQL injection attempt (contains '$' (a MongoDB operator)). ARX refused it before sending anything to the database. Names must come from your code or a fixed list, never from user input.
  > 2. A match built to find everything
      caught ArxException: ARX2002 RecordNotFound: Update of 'account': no document matched the entity's columns (account_number).